Title: Manage SSL Certificates
Course: CIS 208: Linux/UNIX III: Intermediate System Administration, Networking, and Security ~ For IGNITE Review > Section: Learning Modules

Manage SSL Certificates

Once a CA has been created, it will be possible to sign certificates when requested.  A special file called a Certificate Signing Request (CSR) will be sent from a client to the manager of the CA.  Many programs and/or embedded devices will create a CSR for a client, but they can be manually generated as well.

In this example, we will manually create a CSR for use on www.mysite.com. Start by ensuring that the latest version of openssl is installed.

yum install openssl

- After running the next command, several questions will need to be answered.  The critical prompt is for the "Common Name" which needs to match the full hostname that will be used to access the server.  In this case it needs to be "www.mysite.com".  If the common name does not match the hostname in the URL, clients will receive an error message.

openssl req -new -nodes -keyout www.mysite.com.key -out www.mysite.com.csr

- The key file needs to be kept secret and services such as httpd will need read access to it.  The csr file can safely be sent to the manager of the CA.
- The CA manager can copy the csr file to the csrs directory under /etc/pki/tls/my_ca.  This file can be renamed if desired, since not all clients follow standard naming conventions.  To verify the file, run this command and check the output for mistakes.

openssl req -in csrs/www.mysite.com.csr -text -verify -noout

When ready to proceed, run the following commands to create a pem file with the certificate.

openssl ca -out certs/www.mysite.com.crt -infiles csrs/www.mysite.com.csr
cat certs/www.mysite.com.crt my_ca-cert.pem > certs/www.mysite.com.pem

- The CA manager can now send the www.mysite.com.pem file to the requestor, and it includes the certificates for the website as well as the CA in a single file.

In the future, the CA manager can renew the website certificate by simply running the above commands again.  If the website is still using the original key file, the new certificate file will work without any modifications.