C2Net Stronghold Guide to Installing Root Certificates, Generating CSR and Installing SSL Certificate

Transcription

1 C2Net Stronghold Guide to Installing Root Certificates, Generating CSR and Installing SSL Certificate Copyright. All rights reserved. Trustis Limited Building 273 New Greenham Park Greenham Common Thatcham RG19 6HN E: W: Registered in England No:

2 Table of Contents 1 Introduction Install Root and Intermediate Certificates Certificate Signing Request (CSR) Generation Installing your SSL Server Certificate... 5 T AP-009 C2Net Stronghold V0.1.docx Page 2 of 5

3 1 Introduction This document specifies instructions for Installing the Root and Intermediate certificates, generating your CSR, and Installing your certificate. 2 Install Root and Intermediate Certificates On startup, Stronghold loads CA certificates from the file specified by the SSLCACertificateFile entry in its 'httpd.conf' file. To install the PEM format bundled CA certificate file, reference it in the httpd.conf file. as follows 1. Ensure that you have saved the PEM format bundled CA certificate called healthcarett-chain-pem.txt. This is obtained from Save this as a text file. 2. Open your 'httpd.conf' file and find the SSLCACertificateFile entry. By default the entry will be SSLCACertificateFile='/ssl/CA/healthcarett-chain-pem.txt. You will find 'httpd.conf' in the directory /conf. 3. Open the file identified by SSLCACertificateFile (for example, /ssl/ca/ healthcarett-chain-pem.txt) in a text editor. 4. Open the file that contains the PEM format bundled CA certificates (e.g. healthcarett-chain-pem.txt) in a text editor. 5. Copy the contents of this PEM format bundled CA certificate file (including all the '-----BEGIN CERTIFICATE-----' and '-----END CERTIFICATE----- ' lines) to the clipboard. 6. Now Paste what you have just copied into the file identified by SSLCACertificateFile. In most cases you will want to insert the bundle CA certificate at the end of the file and add a comment to identify the certificate. 7. Save the modified file and close the text editor. 8. Restart your web server. T AP-009 C2Net Stronghold V0.1.docx Page 3 of 5

4 3 Certificate Signing Request (CSR) Generation Note: Keys and certificates are managed through three scripts: genkey, getca and genreq. These are part of the normal Stronghold distribution. Keys and certificates are stored in the directory$ssltop/private/, where SSLTOP is typically /usr/local/ssl. To generate a key pair and CSR for your server: 1. Run genkey, specifying the name of the host or virtual host: genkey hostname. The genkey script displays the filenames and locations of the key file and CSR file it will generate: Key file: /usr/local/www/sslhostname.key CSR file: /usr/local/www/sslhostname.cert Note: If you already have a key for your server, run genreq [servername] to generate only the CSR. 2. Press Enter. The genkey script reminds you to be sure you are not overwriting an existing key pair and certificate. 3. When prompted, enter a key size in bits. Use 2048 bit. If 2048 bit is not available, upgrade to a version which does offer this size. 4. When prompted, enter random key strokes. Stop when the counter reaches zero and genkey beeps. This random data is used to create a unique public and private key pair. 5. When prompted, enter 'y' to create the key pair and CSR. 6. For your CA select 'Other'. 7. Enter the two-letter country code for your country. You must use the correct ISO country code, other abbreviations will not be recognized. For example the correct code for the United Kingdom is GB, not UK. 8. Enter the full name of your state or province. For UK based installations, use YourCounty, e.g. Surrey. 9. Enter the name of your city, town, or other locality. 10. Enter the name of your organisation. 11. Enter the name of your unit within the specified organisation. 12. Enter your web site's fully-qualified name. For example This is also known as your site's common name. Do not include the protocol, such as or ftp://. 13. When you have finished entering the CSR data, genkey automatically creates the CSR. Back up your key file and CSR on a floppy disk and store the disk in a secure location. If you lose your private key or forget the password, you will not be able to install your certificate. T AP-009 C2Net Stronghold V0.1.docx Page 4 of 5

5 4 Installing your SSL Server Certificate You will receive an from the Registration Authority when your certificate request has been approved that contains a link to a location where your server certificate may be obtained. Clicking on this link will bring up a browser window that contains the details of your issued certificate and includes a section that looks something like the following: -----BEGIN CERTIFICATE----- MIAGCSqGSIb3DQEHAqCAMIACAQExADALBgkqhkiG9w0BBwGggDCCAmowggHXA haf UbM77e50M63v1Z2A/5O5MA0GCSqGSIb3DQEOBAUAMF8xCzAJBgNVBAYTAlVTMS Aw (...) E+cFEpf0WForA+eRP6XraWw8rTN8102zGrcJgg4P6XVS4l39+l5aCEGGbauLP5W6 K99c42ku3QrlX2+KeDi+xBG2cEIsdSiXeQS/16S36ITclu4AADEAAAAAAAAA -----END CERTIFICATE Copy everything you see between and including the lines that look like -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- and paste it into an appropriately named text file e.g. myserver.cert Installing the server certificate 2. Save your server certificate as a text file. 3. Install the new certificate using getca, this utility is normally installed in /bin: getca myhostname < /server certificate file location and name Where: myhostname is the common name of the Web server for which the certificate was requested (this is the same as specified when you ran genkey) and '/server certificate file location and name' is the name of the server certificate file. This will save the certificate in the file /ssl/certs/myhostname.cert. 4. Restart your web server. T AP-009 C2Net Stronghold V0.1.docx Page 5 of 5