View source for Create an Apache2 self signed certificate

#REDIRECT 
[[Create certificates for Apache2]]


== Not updated ==

Gain root privileges, continue as root from this point until 'exit'.

<syntaxhighlight lang=bash>
sudo -i
</syntaxhighlight>

<syntaxhighlight lang=bash>
mkdir /etc/apache2/ssl
cd /etc/apache2/ssl
</syntaxhighlight>

Create private key:

<syntaxhighlight lang=bash>
openssl genrsa -des3 -out server.key 4096 
</syntaxhighlight>

Use a secure password / pass phrase ***cert-pass-phrase*** when creating the CSR:

<syntaxhighlight lang=bash>
openssl req -new -key server.key -out server.csr
</syntaxhighlight>

# Pass phrase: ***cert-pass-phrase***
# Country Name (2 letter code) [AU]:NL
# State or Province Name (full name) [Some-State]:Noord Brabant
# Locality Name (eg, city) []:Eindhoven
# Organization Name (eg, company) [Internet Widgits Pty Ltd]:Wilbert Volkers
# Organizational Unit Name (eg, section) []:Volkers
# Common Name (eg, YOUR name) []:wilbertvolkers.dyndns.org
# Email Address []:wilbertvolkers@yahoo.com

You can leave these empty now (press enter):

# A challenge password []:        
# An optional company name []:

Remove pass phrase ***cert-pass-phrase*** from the key so that apache need not ask the pass phrase each time it starts:

<syntaxhighlight lang=bash>
cp server.key server.key.passphrased
openssl rsa -in server.key.passphrased -out server.key
</syntaxhighlight>

Generating a Self-Signed Certificate valid for 365 days

<syntaxhighlight lang=bash>
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
</syntaxhighlight>

As the key is now not protected by a password you should only allow root to have access to the key, set permissions:

<syntaxhighlight lang=bash>
cd /etc/apache2/ssl
chown root:root *
chmod go-rwx *
exit
</syntaxhighlight>