Creating Your Key and Certificate Request

You'll use the OpenSSL program, which was installed with your secure server, to generate an encryption key and a certificate request. You need the key to create the certificate request. You need the certificate request in order to apply for a certificate from a CA. Finally, you need the certificate to run a Red Hat Linux Apache/SSL Server.

Generating a Key

First, you'll use OpenSSL and the system file /dev/urandom to generate a random key. cd to the /etc/httpd/conf directory. Type in the following command, which will generate a 1024 bit key encrypted with the triple-DES cipher:

make genkey

Your system will display a message similar to the following:

1049776 semi-random bytes loaded
Generating RSA private key, 1024 bit long modulus
.................................................
Enter PEM pass phrase:

You now need to type in a password. For best security, your password should be at least eight characters, should include numbers or punctuation, and should not be a word in a dictionary. Also, remember that your password is case sensitive.

Please Note: You will need to remember and enter this password every time you start your Red Hat Linux Apache/SSL Server, so don't forget it.

You will be asked to re-type the password, just to make sure that you didn't make any typos entering it. Once you've typed it in correctly, a file called server.key, containing your key, will be created.

Please Note: If you don't want to have to type in a password every time you start your Red Hat Linux Apache/SSL Server, you will need to use the following two commands instead of make genkey to create the key (note that the first command should be typed in all one one line):

/usr/sbin/openssl genrsa -rand /dev/urandom 1024 > ssl.key/server.key
chmod go-rwx ssl.key/server.key

If you use the immediately previous command to create your key, you will not need to use a password to start your Red Hat Linux Apache/SSL Server. Please realize, however, that disabling the password feature for your secure web server is a security risk. We DO NOT recommend that you disable the password feature for your Red Hat Linux Apache/SSL Server.

The problems associated with not using a password are directly related to the security maintained on the host machine. For example, if an unscrupulous individual compromises the regular UNIX security on the host machine, that person could obtain your private key (the contents of your server.key file). The key could be used to "spoof" Web pages that will appear to be coming from your customers.

If UNIX security practices are scrupulously being followed for the host computer (i.e., all operating system patches and updates are done as soon as they're available, no unnecessary or risky services are operating, etc.), the Red Hat Linux Apache/SSL Server's password may seem unnecessary. However, since your Red Hat Linux Apache/SSL Server shouldn't need to be re-booted very often, the extra security provided by entering a password is a worthwhile effort in most cases.

The server.key file should be owned by the root user on your system and should not be accessible to any other user. Make a backup copy of this file and keep the backup copy in a safe, secure place (a good idea would be to copy this file to a floppy and then keep the floppy someplace secure). You need the backup copy because if you ever lose the server.key file after using it to create your certificate request, your certificate will no longer work and the CA will not be able to help you. Your only option would be to request a new digital certificate and pay for it all over again.

Generating a Certificate Request

Once you've created a key, the next step is to generate a certificate request which you will need to send to the CA of your choice. Type in the following command:

make certreq

Your system will display the following output and will ask you for your password (if you disabled the password option, it won't ask):

Using configuration from /etc/ssl/lib/ssleay.cnf
Enter PEM pass phrase:

Type in the password that you chose when you were generating your key. Your system will display some instructions and then ask for a series of inputs from you. Your inputs will be incorporated into the certificate request. The display, with example inputs, will look like this:

You are about to be asked to enter information
that will be incorporated into your certificate
request.
What you are about to enter is what is called a
Distinguished Name or a DN.
There are quite a few fields but you can leave
some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [US]:
State or Province Name []:North Carolina
Locality (City) Name []:Durham
Company (Organization) Name []:Test Company
Department Name []:Testing
Server Host Name []:test.mydomain.com
Administrators E-mail address []:admin@mydomain.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

The default answers appear in brackets [] immediately after each request for input. For example, the first information required is the name of the country where the certificate will be used, shown like the following:

Country Name (2 letter code) [US]:

Since the Red Hat Linux Apache/SSL Server is restricted for sale to only the US or Canada, your input will be either US or CA. The default input, in brackets, is US. To accept the default input, just press Enter.

You will have to type in the rest of the inputs (State or Province Name, Locality (City) Name, Company (Organization) Name, Department Name, Server Host Name, and Administrators E-mail address). All of these should be self-explanatory. Do not abbreviate the city or state. Write them out (for example, St. Louis should be written out as Saint Louis). For Server Host Name, make sure you type in the real name of your Red Hat Linux Apache/SSL Server (a valid DNS name), and not any aliases which the server may have.

You don't need to use either of the extra attributes (A challenge password and An optional company name). Just press Enter to accept the blank default for both inputs.

When you've finished inputting your information, a file named server.csr will be created. server.csr is your certificate request, ready to send to your CA.

Next, you need to test your Red Hat Linux Apache/SSL Server to make sure everything is working properly. To do that, you need to either send the certificate request off to a CA in order to get a test certificate, or to create a test certificate yourself.

Note that a test certificate lets you test your Red Hat Linux Apache/SSL Server to see if it works, but it is not the same thing as a signed certificate. A test certificate can be used for a short period of time and you don't have to pay for it. A test certificate will not be accepted by browsers which would normally accept that CA's certificates without asking the user.

The next section covers how to get test certificates from both VeriSign and Thawte, as well as how to create a test certificate yourself.