12
edits
Changes
From Amahi Wiki
m
sudo openssl req -new -sha256 -nodes -out /etc/httpd/ssl.crt/server.csr -newkey rsa:2048 -keyout /etc/httpd/ssl.crt/server.key -config <( cat /etc/httpd/server.csr.cnf )sudo openssl x509 -req -in /etc/httpd/ssl.crt/server.csr -CA ~/ssl/rootCA.pem -CAkey ~/ssl/rootCA.key -CAcreateserial -out /etc/httpd/ssl.crt/server.crt -days 3650 -sha256 -extfile v3.ext</n
→Generate your own certificates
[[User:Sag47|Sag47]] 00:38, 15 June 2011 (PDT). Updates and clarifications [[User:Spaceman|spaceman]] 15:23, 27 March 2017 (BST).
[[User:Tamorgen|Tamorgen]] 09:15, 31 Oct 2018 (EST). Made changes for Subject Alternative Name.
'''NOTE:''' This may interfere with [[Hosting_a_website|Hosting a Website]] tutorial.
== Generate your own certificates ==
'''NOTE:''' Leaving defaults will not make your server less secure. Make sure that you change "asecretpassword" in the commands below to something else. Otherwise any commands which don't have "asecretpassword" in it can be copied and pasted. This has to do with the challenge password for the private key. If you don't understand what I mean then you should read about [http://en.wikipedia.org/wiki/Public-key_cryptography public-key cryptography] which is essentially what SSL uses.
As of Chrome version 58, the Chrome browser requires SSL certificates to use SAN (Subject Alternative Name) and has removed Common Name (CN). Using a CN will produce an error within the Security Overview section of the certificate, telling the user that the SAN is missing. A new method of creating the certificate is required.
</nowiki></pre>
2. Create a new file createselfsignedcertificatecreateRootCA.sh using vi, nano, or your favorite text editor.
<pre><nowiki>
mkdir /etc/httpd/ssl.crt
mkdir /etc/httpd/ssl.key
</nowiki></pre>
4. Create the configuration file server.csr.snfcnf.
<pre><nowiki>
C=US
ST=Maryland
L=AnapolisAnnapolis
O=Home Administrator
OU=HDA Domain
[alt_names]
DNS.1 = localhost
DNS.2 = ''hostname.yourdomain''
DNS.2 = hda
DNS.3 = hda.''yourdomain''DNS.4 = cockpit.''yourdomain''
</nowiki></pre>
== Bonus ==
Fedora 27/Amahi 11 now supports provides [httpshttp://cockpit-projectwww.amahi.org/ apps/cockpit Cockpit], a powerful browser-based server administration portal. To eliminate the SSL warning on this page, you need to create a .cert file using files previously created in this walkthrough. The .cert file consists of the contents of the server.crt and server.key. To create the file, run the following commands. This will automatically place the file in the correct directory.
<pre><nowiki>
