Subject: Create new SSL certificate for https

From: cy user <[email-masked]>
Date: Tue, 21 Jan 2003 07:56:22 -0800 (PST)

I need to create new certificate's for my apache server. I'm a little confused on how to do this. Does anyone have a good link they can tell me or anything.

Thanks
Rob
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Daniel Lopez <[email-masked]>
Date: Tue, 21 Jan 2003 08:03:34 -0800

> I need to create new certificate's for my apache server. I'm a little
confused on how to do this. Does anyone have a good link they can tell me or
anything.  

This should give you a good understanding of certificates and how to use the
openssl command line tool to manage them:
http://apacheworld.org/ty24/site.chapter17.html

Best regards

Daniel

---

From: "Marco \"Kiko\" Carnut" <[email-masked]>
Date: Tue, 21 Jan 2003 13:21:13 -0300

Rob,

> I need to create new certificate's for my apache server. I'm a 
> little confused on how to do this. Does anyone have a good link 
> they can tell me or anything.

A simple and very fast way to do it for testing purposes is to
use FreeICP project's free entry-level CA:

   https://ca.freeicp.org/webra/entry-level

Just type your server's address (www.yourserver.com or whatever)
and it'll generate the private key and public certificate for you
right on the spot. Save them to files and point the mod_ssl
SSLCertificateFile and SSLCertificateKeyFile to them. I assume you
can handle the httpd.conf part.

Albeit all that works, this is not very secure. When you move
your server to production status, you should get a higher security
grade certificate.  Unfortunately, the FreeICP project's Verified
Identity CA is still not offering server certificates -- this is
still being implemented to fit their free/collaborative identity
verification system; so, for the time being, you should try one of
the commercial CAs (VeriSign, Thawte, etc).

--Marco "Kiko" Carnut
--Tempest Security Technologies/FreeICP.ORG

---

From: Sasa STUPAR <[email-masked]>
Date: Tue, 21 Jan 2003 17:28:22 +0100

use this command:

openssl req -config openssl.cnf -new -out xxx.csr
openssl rsa -in privkey.pem -out xxx.key
openssl x509 -in xxx.csr -out xxx.cert -req -signkey xxx.key -days 365
openssl x509 -in xxx.cert -out xxx.der.crt -outform DER