meta data for this page
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| linux:openssl [2016/03/15 10:08] – niziak | ssl:openssl [2023/06/21 09:56] (current) – niziak | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ==== Add own CA cert ==== | + | ====== RSA keys ====== |
| + | <code bash> | ||
| + | < | ||
| + | Export private key (unencrypted!) | ||
| + | < | ||
| + | Export pub key in OpenSSH format: | ||
| + | < | ||
| + | |||
| + | ==== CA Bundle ==== | ||
| + | === Extract CAs form Mozilla === | ||
| + | Direct download link [[https:// | ||
| + | Page [[https:// | ||
| + | |||
| + | |||
| + | === Add own CA cert === | ||
| <code bash> | <code bash> | ||
| sudo cp foo.crt / | sudo cp foo.crt / | ||
| Line 6: | Line 20: | ||
| ==== Info ==== | ==== Info ==== | ||
| + | Nice site verification tool: [[https:// | ||
| + | |||
| <code bash> | <code bash> | ||
| openssl s_client -showcerts -connect smtp.gmail.com: | openssl s_client -showcerts -connect smtp.gmail.com: | ||
| openssl s_client -connect host.host: | openssl s_client -connect host.host: | ||
| + | |||
| + | # With HTTP server name: | ||
| + | openssl s_client -connect host.host: | ||
| openssl x509 -in certificate.pem -text | openssl x509 -in certificate.pem -text | ||
| + | </ | ||
| + | |||
| + | === Verify crt, csr and key === | ||
| + | < | ||
| + | openssl x509 -noout -modulus -in certificate.crt | openssl md5 | ||
| + | openssl rsa -noout -modulus -in privateKey.key | openssl md5 | ||
| + | openssl req -noout -modulus -in CSR.csr | openssl md5 | ||
| </ | </ | ||
| === Generate key === | === Generate key === | ||
| - | < | + | < |
| + | openssl dhparam -dsaparam -out dh2048.pem 2048 | ||
| + | openssl genrsa -des3 -out domain.com.key 2048 | ||
| + | </ | ||
| + | Remove password from keyfile: | ||
| + | <code bash> | ||
| + | |||
| + | === Generate CSR === | ||
| + | < | ||
| + | With SHA256 | ||
| + | < | ||
| + | |||
| + | |||
| + | === Server certificate chain === | ||
| + | |||
| + | [[https:// | ||
| + | < | ||
| + | certificate_list | ||
| + | This is a sequence (chain) of X.509v3 certificates. | ||
| + | certificate must come first in the list. Each following | ||
| + | certificate must directly certify the one preceding it. Because | ||
| + | certificate validation requires that root keys be distributed | ||
| + | independently, | ||
| + | certificate authority may optionally be omitted from the chain, | ||
| + | under the assumption that the remote end must already possess it | ||
| + | in order to validate it in any case. | ||
| + | </ | ||
| + | |||
| + | |||
| + | It is required to put not only site certificate in your web server configuration, | ||
| + | If your server certificate is in PEM format (text), additional certificates can be simply concatenated. | ||
| + | All certificates should be in correct order. | ||
| + | To verify order | ||
| + | < | ||
| + | < | ||
| + | Certificate chain | ||
| + | 0 s:/ | ||
| + | | ||
| + | 1 s:/ | ||
| + | | ||
| + | 2 s:/ | ||
| + | | ||
| + | </ | ||