Ubuntu/openssl - Revision history

R00t: /* Quick Reference */

2020-12-04T04:51:22Z

‎Quick Reference

2018-10-08T18:11:18Z

2018-09-27T17:27:51Z

2018-09-27T16:28:53Z

2018-09-26T16:24:03Z

2018-09-26T15:57:57Z

2018-09-26T15:47:41Z

2018-09-26T15:40:22Z

2018-08-16T20:33:41Z

2016-12-15T02:14:32Z

‎Export CRT from JKS

@@ Line 21: / Line 21: @@
 "/etc/pki/tls/certs",           // Fedora/RHEL
 "/etc/openssl/certs",           // NetBSD</nowiki>
 ==Generating SAN Certificate==
@@ Line 99: / Line 106: @@
 Enter keystore password:
 </nowiki>
 =Writing an ssl cert directly to a file=
 Here's a quick way to write a SSL cert to a file and strip everything except the cert.

@@ Line 99: / Line 99: @@
 Enter keystore password:
 </nowiki>
-==Writing an ssl cert directly to a file==
+=Writing an ssl cert directly to a file=
 Here's a quick way to write a SSL cert to a file and strip everything except the cert.
   <nowiki>~$ openssl s_client -showcerts -connect google.com:443 </dev/null 2>/dev/null | openssl x509 -outform PEM > mycertfile.pem</nowikI>

← Older revision		Revision as of 17:27, 27 September 2018
Line 126:		Line 126:
	Verify that you have added the CA cert to your system		Verify that you have added the CA cert to your system
	<nowiki>~$sudo openssl x509 -text -in /etc/pki/tls/certs/ca-bundle.crt</nowiki>		<nowiki>~$sudo openssl x509 -text -in /etc/pki/tls/certs/ca-bundle.crt</nowiki>
		+
		+	==Test certificate==
		+	I opted to do a quick and easy httpd server hosting the SSL cert.
		+	<nowiki>~$ sudo yum install -y httpd mod-ssl openssl
		+	~$ sudo cp website.com.key /etc/pki/tls/private/
		+	~$ sudo cp signed.website.com.crt /etc/pki/tls/certs/
		+	~$ sudo vim /etc/httpd/conf.d/ssl.conf
		+	...
		+	SSLCertificateFile /etc/pki/tls/certs/signed.website.com.crt
		+	SSLCertificateKeyFile /etc/pki/tls/private/website.com.key</nowiki>

← Older revision		Revision as of 16:28, 27 September 2018
Line 119:		Line 119:
	The next step is to sign the certificate provided, so you'll need the CSR you created for your site/application.		The next step is to sign the certificate provided, so you'll need the CSR you created for your site/application.
	<nowiki>~$ openssl x509 -req -in ../website.com.csr -CA ./ca.crt -CAkey ./ca.key -CAcreateserial -out ../signed.website.com.crt</nowiki>		<nowiki>~$ openssl x509 -req -in ../website.com.csr -CA ./ca.crt -CAkey ./ca.key -CAcreateserial -out ../signed.website.com.crt</nowiki>
		+
		+	==Adding the CA to CentOS==
		+	copy the CA crt that you created to the following folder and then run the update
		+	<nowiki>~$ sudo cp ca.crt /etc/pki/ca-trust/source/anchors/
		+	~$ sudo update-ca-trust extract</nowiki>
		+	Verify that you have added the CA cert to your system
		+	<nowiki>~$sudo openssl x509 -text -in /etc/pki/tls/certs/ca-bundle.crt</nowiki>

@@ Line 110: / Line 110: @@
   <nowiki>~$openssl genrsa -out ca.key 4096
 ~$ openssl req -new -x509 -key ca.key -out ca.crt</nowiki>
 ==Signing the certificate==
 The next step is to sign the certificate provided, so you'll need the CSR you created for your site/application.

@@ Line 108: / Line 108: @@
 ==Generate CA Key & Certificate==
 Really not much different from creating a normal ssl cert.
-  <nowiki>~$
+  <nowiki>~$openssl genrsa -out ca.key 4096

@@ Line 7: / Line 7: @@
 Great overview about SSL certs and CAs
 https://gist.github.com/Soarez/9688998
 ==Generating SAN Certificate==
@@ Line 88: / Line 102: @@
 Here's a quick way to write a SSL cert to a file and strip everything except the cert.
   <nowiki>~$ openssl s_client -showcerts -connect google.com:443 </dev/null 2>/dev/null | openssl x509 -outform PEM > mycertfile.pem</nowikI>

@@ Line 4: / Line 4: @@
 generating a SSL cert with a SAN
 http://apetec.com/support/GenerateSAN-CSR.htm
 ==Generating SAN Certificate==
 ===Oracle Linux===

← Older revision		Revision as of 20:33, 16 August 2018
Line 81:		Line 81:
	Enter keystore password:		Enter keystore password:
	</nowiki>		</nowiki>
		+	==Writing an ssl cert directly to a file==
		+	Here's a quick way to write a SSL cert to a file and strip everything except the cert.
		+	<nowiki>~$ openssl s_client -showcerts -connect google.com:443 </dev/null 2>/dev/null \| openssl x509 -outform PEM > mycertfile.pem</nowikI>

@@ Line 75: / Line 75: @@
 ====Export CRT from JKS====
   <nowiki>
-~$ keytool -export -alias alias_name -keystore path_to_keystore_file -rfc -file path_to_certificate_file
+~$ keytool -export -alias alias_name -keystore path_to_keystore_file -rfc -file path_to_new_certificate_file
 Example: