Home

Search this site:
 

Horshack’s
very
own site

 

This is Bavaria, Germany!
You will find links to Perl,
bootdisks for system administration,
a lot of Linux,
Windows administration
and some personal belongings.
Linux: howto create a certificate

Creating an SSL-certificate for my webserver

 

Self-signed certificate

Create a request for an official certificate

This is the shellscript I do it with, default-values are taken from the file /etc/ssl/openssl.cnf:

The procedure look like this: Check your request at https://secure.comodo.net/utilities/decodeCSR.html

Do the request at the trustcenter

Activate everything in Apache2

More than one SSL-Server with valid certificate per IP-address, vulgo: SNI

This technique is pretty new (http://de.wikipedia.org/wiki/Server_Name_Indication) an 12/2009 this works with Firefox which is enough for me.

Installation Debian Lenny:

# :80 -> only to forward to :443
#
<VirtualHost xxx.yourdomain.de:80>
    ServerName xxx.yourdomain.de
    ServerAdmin lippmann@yourdomain.de


    DirectoryIndex index.html index.php
    DocumentRoot /var/www/xxx/wwwroot
    RewriteEngine on
    RewriteRule ^(.*)$ https://xxx.yourdomain.de$1 [R]
</VirtualHost>


<VirtualHost xxx.yourdomain.de:443>
  ServerName xxx.yourdomain.de
  ServerAdmin lippmann@yourdomain.de


  # enable SNI
  GnuTLSEnable on
  GnuTLSPriorities NORMAL
  GnuTLSCertificateFile /etc/apache2/ssl/xxx.crt
  GnuTLSKeyFile /etc/apache2/ssl/xxx.key


  # Logs Start
  ErrorLog /var/log/apache2/ssl.log
  # Possible values include: debug, info, notice, warn, error, crit,
  # alert, emerg.
  LogLevel warn
  # CustomLog /var/log/apache2/ssl.log combined
  ServerSignature Off
  # Logs Ende

  DirectoryIndex index.html
  DocumentRoot /var/www/xxx/wwwroot

  # xxx
  Alias /xxx/images /usr/share/xxx/images

  Scriptalias /cgi-bin/xxx/ /usr/share/xxx/
  <Location /cgi-bin/xxx/>
      Options ExecCGI FollowSymLinks

      AuthGroupFile /etc/.../htgroup
      AuthUserFile /etc/.../htpasswd
      AuthType basic
      AuthName "the name of the region"
      require valid-user
  </Location>


  # redirect / to some special starting URL
  <Directory "/var/www/xxx/wwwroot">
    Order allow,deny
    Allow from all
    RedirectMatch ^/$ /cgi-bin/xxx/grapher.cgi
  </Directory>

</VirtualHost>

 

Impressum