This is Bavaria, Germany!
#!/bin/sh
SERVER=ssl.brainstorm.zirndorf.de
PRIVATE_KEY=$SERVER.private.key
CERTIFICATE_FILE=$SERVER.crt
VALID_DAYS=365
echo Delete old private key
rm $PRIVATE_KEY
echo Create new private/public-keys without passphrase for server
openssl genrsa -out $PRIVATE_KEY 1024
echo Create selfsigned certificate
rm $CERTIFICATE_FILE
# From man req:
# -x509
# this option outputs a self signed certificate instead
# of a certificate request. This is typically used to
# generate a test certificate or a self signed root CA.
# The extensions added to the certificate (if any) are
# specified in the configuration file.
openssl req -new \
-days $VALID_DAYS \
-key $PRIVATE_KEY \
-x509 \
-out $CERTIFICATE_FILE
echo private-keyfile is $PRIVATE_KEY
echo server-certificate-file is $CERTIFICATE_FILE
ls -l $PRIVATE_KEY $CERTIFICATE_FILE
This is the shellscript I do it with, default-values are taken from the file /etc/ssl/openssl.cnf:
#!/bin/sh SERVER=ssl.yourserver.de PRIVATE_KEY=$SERVER.private.key CERTIFICATE_FILE=$SERVER.crt SIGNING_REQUEST=$SERVER.signing.request VALID_DAYS=365 echo Delete old private key rm $PRIVATE_KEY echo Create new private/public-keys without passphrase for server openssl genrsa -out $PRIVATE_KEY 1024 echo Create file for signing request rm $SIGNING_REQUEST openssl req -new -days $VALID_DAYS -key $PRIVATE_KEY -out $SIGNING_REQUEST echo Filename for signing request is: $SIGNING_REQUEST echo Send the content of the file to the certification authority. echo For example: Christian Heutger [c.heutger@psw.biz] echo from http://www.ssl-certs.de cat $SIGNING_REQUEST echo You can check this request at echo https://secure.comodo.net/utilities/decodeCSR.htmlThe procedure look like this:
# ./create_signing_request.sh Delete old private key Create new private/public-keys without passphrase for server Generating RSA private key, 1024 bit long modulus ..................................................++++++ ......++++++ e is 65537 (0x10001) Create file for signing request You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [DE]:DE State or Province Name (full name) [Some-State]:Bayern Locality Name (eg, city) []:Zirndorf Organization Name (eg, company) [Internet Widgits Pty Ltd]:MyCompany AG Organizational Unit Name (eg, section) []:EDV Common Name (eg, YOUR name) []:ssl.yourserver.de Email Address []:edv@mycompany.ag Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: Filename for signing request is: ssl.yourserver.de.signing.request Send the content of the file to the certification authority. For example: Christian Heutger [c.heutger@psw.biz] from http://www.ssl-certs.de -----BEGIN CERTIFICATE REQUEST----- MIIB3jCCAUcCAQAwgZ0xCzAJBgNVBAYTAkRFMQ8wDQYDVQQIEwZCYXllcm4xETAP ... lEA= -----END CERTIFICATE REQUEST----- You can check this request at https://secure.comodo.net/utilities/decodeCSR.htmlCheck your request at https://secure.comodo.net/utilities/decodeCSR.html
This technique is pretty new (http://de.wikipedia.org/wiki/Server_Name_Indication) an 12/2009 this works with Firefox which is enough for me.
Installation Debian Lenny:
# :80 -> only to forward to :443
#
<VirtualHost xxx.yourdomain.de:80>
ServerName xxx.yourdomain.de
ServerAdmin lippmann@yourdomain.de
DirectoryIndex index.html index.php
DocumentRoot /var/www/xxx/wwwroot
RewriteEngine on
RewriteRule ^(.*)$ https://xxx.yourdomain.de$1 [R]
</VirtualHost>
<VirtualHost xxx.yourdomain.de:443>
ServerName xxx.yourdomain.de
ServerAdmin lippmann@yourdomain.de
# enable SNI
GnuTLSEnable on
GnuTLSPriorities NORMAL
GnuTLSCertificateFile /etc/apache2/ssl/xxx.crt
GnuTLSKeyFile /etc/apache2/ssl/xxx.key
# Logs Start
ErrorLog /var/log/apache2/ssl.log
# Possible values include: debug, info, notice, warn, error, crit,
# alert, emerg.
LogLevel warn
# CustomLog /var/log/apache2/ssl.log combined
ServerSignature Off
# Logs Ende
DirectoryIndex index.html
DocumentRoot /var/www/xxx/wwwroot
# xxx
Alias /xxx/images /usr/share/xxx/images
Scriptalias /cgi-bin/xxx/ /usr/share/xxx/
<Location /cgi-bin/xxx/>
Options ExecCGI FollowSymLinks
AuthGroupFile /etc/.../htgroup
AuthUserFile /etc/.../htpasswd
AuthType basic
AuthName "the name of the region"
require valid-user
</Location>
# redirect / to some special starting URL
<Directory "/var/www/xxx/wwwroot">
Order allow,deny
Allow from all
RedirectMatch ^/$ /cgi-bin/xxx/grapher.cgi
</Directory>
</VirtualHost>