{"id":159,"date":"2012-10-25T15:23:01","date_gmt":"2012-10-25T15:23:01","guid":{"rendered":"http:\/\/www.buildingcubes.com\/?p=159"},"modified":"2012-10-25T15:23:01","modified_gmt":"2012-10-25T15:23:01","slug":"installing-ssl-on-apache","status":"publish","type":"post","link":"https:\/\/www.voodoo.business\/blog\/2012\/10\/25\/installing-ssl-on-apache\/","title":{"rendered":"installing proper SSL on apache"},"content":{"rendered":"

You are looking for A-Z instructions, what i am doing here is to show you how to install a godaddy or starfield certificate to a website on apache server on a debian system, if you want the instructions to issue the certificate yourself (self signed certificate), i have covered that in another post, you can adopt this to the system of your choice, here i will explain what i am doing too so that you can adapt it to other systems<\/p>\n

Note that you need a dedicated IP address for every website \/ certificate.
\nI have apache already installed on debian squeeze and running a website with no SSL<\/p>\n

1- Before we begin, you may want to execute<\/p>\n

apt-get update<\/pre>\n
2- Install openSSL, on debian this is done with<\/p>\n
apt-get install openssl ssl-cert<\/pre>\n
3-Create a directory for the keys<\/p>\n
mkdir \/etc\/apache2\/sslkeys<\/pre>\n
4- Creating a PRIVATE key (Give to no one)<\/p>\n
Before executing this command
\nYou will be asked to chose a password and enter it twice, please keep this password on a paper close to you since we will need this password to decrypt this key in the following steps, this password is important during this process, no longer important after that.<\/p>\n
openssl genrsa -des3 -out \/etc\/apache2\/sslkeys\/server.key 2048<\/pre>\n
5- Create a signing request to give to godaddy or starfieldtech
\nBefore executing this command, remember that from the questions you will face, the only one that is TEHNICALLY IMPORTANT IS to use the common name<\/strong> example.com (not www.example.com), unless it is a subdomain other than www you can use subname.example.com, all other fields you should answer as you would like them to appear to people, but the certificate will not work with an incorrect common name<\/strong><\/p>\n
 openssl req -new -key \/etc\/apache2\/sslkeys\/server.key -out \/etc\/apache2\/sslkeys\/server.csr<\/pre>\n
NOTE: we could have created a signing request and a private key in one go with <\/p>\n
openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr<\/pre>\n
But we chose to not do that because this tutorial aims to show you the exact steps and what they do<\/p>\n
6- Now, we have a secure signing request, all we need to do is give that to the issuing authority so that they can give us a signed public key<\/p>\n
UPDATE: Done with the problem of already present in a current certificate<\/a> after 4 days of talking to godaddy<\/p>\n
Now, i can generate my new certificate, but i waiting for 4 days that i could have done without and got it on the first day, the 72 hours written in the manual is probably the MAXIMUM after revoking a certificate, not after canceling it.<\/p>\n
Problem, apache will not start without pass phrase, this also means that rebooting the machine will have the machine hang waiting for apache to start and waiting for a user to enter a password for apache, so we need to decrypt the private key
\nPlease note that this does not make your connection less secure, but in the event that someone gets hold of the key file (That you should protect encrypted or not), they can defeat SSL security.<\/p>\n
\nroot@someserver:~#\/etc\/init.d\/apache2 restart\nRestarting web server: apache2 ... waiting Apache\/2.2.16 mod_ssl\/2.2.16 (Pass Phrase Dialog)\nSome of your private key files are encrypted for security reasons.\nIn order to read them you have to provide the pass phrases.\n\nServer www.example.com:443 (RSA)\nEnter pass phrase:\n\nOK: Pass Phrase Dialog successful.\n<\/pre>\n
Anyway, now we should come back to how to remove the pass phrase from the private key<\/p>\n
Assuming that your RSA key is stored in the file
\n\/etc\/apache2\/sslkeys\/server.key
\nTo decrypt the file, so that apache does not requer a password with every restart
\n1- copy the key file:<\/p>\n
cp \/etc\/apache2\/sslkeys\/server.key \/etc\/apache2\/sslkeys\/server.enc.key<\/pre>\n
Now, decrypt the key (read from the backup file) into the key file in our config<\/p>\n
openssl rsa -in \/etc\/apache2\/sslkeys\/server.enc.key -out \/etc\/apache2\/sslkeys\/server.key<\/pre>\n
Now the encrypted key is in the server.enc.key just in case you need it, and the key used by apache is NOT encrypted and is in server.key file (That apache already uses)<\/p>\n","protected":false},"excerpt":{"rendered":"
You are looking for A-Z instructions, what i am doing here is to show you how to install a godaddy or starfield certificate to a website on apache server on a debian system, if you want the instructions to issue the certificate yourself (self signed certificate), i have covered that in another post, you can […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-159","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/www.voodoo.business\/blog\/wp-json\/wp\/v2\/posts\/159","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.voodoo.business\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.voodoo.business\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.voodoo.business\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.voodoo.business\/blog\/wp-json\/wp\/v2\/comments?post=159"}],"version-history":[{"count":0,"href":"https:\/\/www.voodoo.business\/blog\/wp-json\/wp\/v2\/posts\/159\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.voodoo.business\/blog\/wp-json\/wp\/v2\/media?parent=159"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.voodoo.business\/blog\/wp-json\/wp\/v2\/categories?post=159"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.voodoo.business\/blog\/wp-json\/wp\/v2\/tags?post=159"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}