Create a Self-Signed SSL Certificate with OpenSSL

 
This Self-Signed SSL Certificate was created on a server running CentOS 5.7 with Virtual Hosts and SELinux disabled.

To begin, change to the following directory. We will temporarily create our SSL files here.

Generate Your Private Key.

Generate Certificate Signing Request (CSR).

Sign Certificate Signing Request (CSR).

Create a Backup of the Private Key.

Remove the Pass-Phrase from the Private Key.

Create the following directories.

Move SSL files to the directories that were just created.

Change permissions on the SSL files so they can only be read by the root user (-r--------).

Edit Virtual Host Configuration File:

You will need to add the following at the top of your Virtual Host file (the asterisk can be replaced by your IP address):

Add a VirtualHost record similar to this:

Quit and save the file and then restart Apache

Configuring the firewall:

You should now have a site working over HTTPS using a self-signed certificate. If you can’t connect you may need to open the port on your firewall. To do this amend your iptables rules:

Description of Commands:

OpenSSL is a cryptography toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) network protocols and related cryptography standards required by them.

The genrsa command generates an RSA private key.

-des3
This option encrypts the private key with the triple DES cipher before outputting it.
-out “filename”
This specifies the output filename to write to or standard output by default.
-2048 [numbits]
The size of the private key to generate in bits. This must be the last option specified. The default is 512.

The req command primarily creates and processes certificate requests in PKCS#10 format. It can additionally create self signed certificates for use as root CAs for example.

-new
This option generates a new certificate request.
-key “filename”
This specifies the file to read the private key from.

The x509 command is a multi purpose certificate utility. It can be used to display certificate information, convert certificates to various forms, sign certificate requests like a “mini CA” or edit certificate trust settings.

-req
By default a certificate is expected on input. With this option a certificate request is expected instead.
-days “arg”
Specifies the number of days to make a certificate valid for. The default is 30 days.
-in “filename”
This specifies the input filename to read a certificate from or standard input if this option is not specified.
-signkey “filename”
This option causes the input file to be self signed using the supplied private key.

The rsa command processes RSA keys.