« Sun Java 5 & Fedora Core 6 | Main | My Favorite Commands… »
Creating & Debugging SSL Certificates
By Matt | October 3, 2007
Generating a public SSL certificate:
Information Needed: Country Name (2 letter code) [AU]: State or Province Name (full name) [Some-State]: Locality Name (e.g., city) [ ]: Organization Name (e.g., company) [Internet Widgets Pty Ltd]: Organizational Unit Name (e.g., section) [ ]: Common Name (e.g., YOUR name) [ ]: (See my email...) Email Address [ ]:
Generate a CSR from an existing private key:
openssl req -new -key private-key.pem -out /home/rfagundo/csr_2007.pem
==========================================
Some handy commands:
View the key:
openssl rsa -noout -text -in name.key
View the CSR:
openssl req -noout -text -in name.csr
View the Certificate:
openssl x509 -noout -text -in name.crt
Modulus (+ Exponent) should match between the key and the others…otherwise you get a key mismatch 
==========================================
Squid Reverse Proxy & SSL:
Squid can’t handle seperate chainfiles. But it’s a pretty easy fix.
Use this sample for an Apache conf file for a site being moved to Squid:
SSLEngine on
SSLCertificateFile /etc/httpd/ssl/mysite/www.mysite.com.crt
SSLCertificateKeyFile /etc/httpd/ssl/mysite/mysite.key
SSLCertificateChainFile /etc/httpd/ssl/mysite/sf_intermediate.crt
This process certainly can be modified / simplified as needed:
Copy the www.mysite.com.crt to squid_www.mysite.com.crt
Copy the text from sf_intermediate.crt and paste it to the bottom of squid_www.mysite.com.crt.
Here’s the Squid SSL line that uses those:
https_port 8081 cert=/etc/httpd/ssl/mysite/squid_www.mysite.com.crt key=/etc/httpd/ssl/mysite/mysite.key vhost defaultsite=www.mysite.com
BTW, in the above sample…
public ip:443 = Apache running SSL
public ip:8081 = Squid running SSL, which then connects to 127.0.0.1:8080 on Apache *not* running SSL.
In production, you take public ip:443 off apache, and have Squid listen on public ip:443 instead.
Topics: Web Hosting Tools | No Comments »
Comments
You must be logged in to post a comment.