2008年8月21日 星期四

CA

path of the CA files
/usr/lib/ssl/misc (CA.pl samples)
/usr/lib/ssl/openssl.cnf

Step 1.
# vi /usr/lib/ssl/openssl.cnf
and make some change to the script

dir = ./demoCA

default_bits = 2048
default_days = 365

Step 2.
# cd /usr/lib/ssl
# /usr/lib/ssl/misc/CA.pl -newca
(and /private/cakey.pem is created as the private key)

Step 3.
# openssl req -nodes -new -keyout yourserver.key -out yourserver.req -days 365 -config ./openssl.cnf
(and two files : yourserver.key and yourserver.req are created)

Step 4.
# openssl req -x509 -new -key /usr/lib/ssl/yourserver.key -days 1000 -config ./openssl.cnf -out yourserver.crt
(and yourserver.crt is created)

For matching your website name, you should use the URL from your webpage as Common Name, eg : www.yourdomain.com

Change Server cert path in /etc/httpd/conf/ssl/ssl.default-vhost.conf (or where your ssl path is, can be in /etc/httpd/conf/httpd.conf)
You have to restart Apache after certs path changed !

沒有留言: