Access HDA over SSL - Revision history

Tamorgen: /* Generate your own certificates */

2019-07-17T14:33:12Z

Generate your own certificates

2018-10-31T23:28:05Z

Bonus

2018-10-31T18:47:42Z

Generate your own certificates

2018-10-31T13:21:42Z

Generate your own certificates

2018-10-31T13:19:52Z

Generate your own certificates

2018-10-31T13:19:16Z

Why is this recommended?

2018-10-31T13:16:56Z

Bonus

2018-10-31T13:11:31Z

Bonus

2018-10-31T13:11:10Z

Restart the Apache2 server

2018-10-31T13:10:32Z

Restart the Apache2 server

@@ Line 37: / Line 37: @@
 </nowiki></pre>
-. Create a new file createselfsignedcertificate.sh using vi, nano, or your favorite text editor.
+. Create a new file createRootCA.sh using vi, nano, or your favorite text editor.
 <pre><nowiki>
@@ Line 54: / Line 54: @@
 openssl req -new -sha256 -nodes -out /etc/httpd/ssl.crt/server.csr -newkey rsa:2048 -keyout /etc/httpd/ssl.crt/server.key -config <( cat /etc/httpd/server.csr.cnf )
 openssl x509 -req -in /etc/httpd/ssl.crt/server.csr -CA ~/ssl/rootCA.pem -CAkey ~/ssl/rootCA.key -CAcreateserial -out /etc/httpd/ssl.crt/server.crt -days 3650 -sha256 -extfile v3.ext
 </nowiki></pre>
-. Create the configuration file server.csr.snf.
+. Create the configuration file server.csr.cnf.
 <pre><nowiki>
@@ Line 69: / Line 68: @@
 C=US
 ST=Maryland
-L=Anapolis
+L=Annapolis
 O=Home Administrator
 OU=HDA Domain

@@ Line 148: / Line 148: @@
 == Bonus ==
-Fedora 27/Amahi 11 now supports [https://cockpit-project.org/ Cockpit], a powerful browser-based server administration portal.  To eliminate the SSL warning on this page, you need to create a .cert file using files previously created in this walkthrough.  The .cert file consists of the contents of the server.crt and server.key.  To create the file, run the following commands.  This will automatically place the file in the correct directory.
+Fedora 27/Amahi 11 provides [http://www.amahi.org/apps/cockpit Cockpit], a powerful browser-based server administration portal.  To eliminate the SSL warning on this page, you need to create a .cert file using files previously created in this walkthrough.  The .cert file consists of the contents of the server.crt and server.key.  To create the file, run the following commands.  This will automatically place the file in the correct directory.
 <pre><nowiki>

@@ Line 52: / Line 52: @@
 mkdir /etc/httpd/ssl.crt
 mkdir /etc/httpd/ssl.key
-sudo openssl req -new -sha256 -nodes -out /etc/httpd/ssl.crt/server.csr -newkey rsa:2048 -keyout /etc/httpd/ssl.crt/server.key -config <( cat /etc/httpd/server.csr.cnf )
+openssl req -new -sha256 -nodes -out /etc/httpd/ssl.crt/server.csr -newkey rsa:2048 -keyout /etc/httpd/ssl.crt/server.key -config <( cat /etc/httpd/server.csr.cnf )
-sudo openssl x509 -req -in /etc/httpd/ssl.crt/server.csr -CA ~/ssl/rootCA.pem -CAkey ~/ssl/rootCA.key -CAcreateserial -out /etc/httpd/ssl.crt/server.crt -days 3650 -sha256 -extfile v3.ext
+openssl x509 -req -in /etc/httpd/ssl.crt/server.csr -CA ~/ssl/rootCA.pem -CAkey ~/ssl/rootCA.key -CAcreateserial -out /etc/httpd/ssl.crt/server.crt -days 3650 -sha256 -extfile v3.ext
 </n
 </nowiki></pre>

@@ Line 86: / Line 86: @@
 [alt_names]
 DNS.1 = localhost
 DNS.2 = hda
-DNS.3 = hda.yourdomain
+DNS.3 = hda.''yourdomain''
-DNS.4 = cockpit.yourdomain
+DNS.4 = cockpit.''yourdomain''
 </nowiki></pre>

@@ Line 27: / Line 27: @@
 == Generate your own certificates ==
-'''NOTE:''' Leaving defaults will not make your server less secure.  Make sure that you change "asecretpassword" in the commands below to something else.  Otherwise any commands which don't have "asecretpassword" in it can be copied and pasted.  This has to do with the challenge password for the private key.  If you don't understand what I mean then you should read about [http://en.wikipedia.org/wiki/Public-key_cryptography public-key cryptography] which is essentially what SSL uses.
+'''NOTE:''' Leaving defaults will not make your server less secure.  If you don't understand what I mean then you should read about [http://en.wikipedia.org/wiki/Public-key_cryptography public-key cryptography] which is essentially what SSL uses.
 As of Chrome version 58, the Chrome browser requires SSL certificates to use SAN (Subject Alternative Name) and has removed Common Name (CN).  Using a CN will produce an error within the Security Overview section of the certificate, telling the user that the SAN is missing.  A new method of creating the certificate is required.

@@ Line 7: / Line 7: @@
 [[User:Sag47|Sag47]] 00:38, 15 June 2011 (PDT). Updates and clarifications [[User:Spaceman|spaceman]] 15:23, 27 March 2017 (BST).
+[[User:Tamorgen|Tamorgen]] 09:15, 31 Oct 2018 (EST).  Made changes for Subject Alternative Name.
 '''NOTE:'''  This may interfere with [[Hosting_a_website|Hosting a Website]] tutorial.

@@ Line 147: / Line 147: @@
 == Bonus ==
-Fedora 27/Amahi 11 now supports Cockpit.  To eliminate the SSL on this page, you need to create a .cert file using files previously created in this walkthrough.  The .cert file consists of the contents of the server.crt and server.key.  To create the file, run the following commands.  This will automatically place the file in the correct directory.
+Fedora 27/Amahi 11 now supports Cockpit.  To eliminate the SSL warning on this page, you need to create a .cert file using files previously created in this walkthrough.  The .cert file consists of the contents of the server.crt and server.key.  To create the file, run the following commands.  This will automatically place the file in the correct directory.
 <pre><nowiki>

@@ Line 145: / Line 145: @@
 Restart your server to apply the changes you've made.  If you did everything right you shouldn't receive any warnings when restarting the server.
   systemctl restart httpd
 = Finished =