First create a certificate request. This one is for anncons.net. You will enter the Domain name in the "common name" field: cd /etc/httpd/conf/ca ./CA.sh -newreq ====== You should see the following output ====== Generating a 1024 bit RSA private key ....++++++ .....++++++ writing new private key to 'newreq.pem' Enter PEM pass phrase: oedopusrex Verifying - Enter PEM pass phrase: oedopusrex ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [US]: State or Province Name (full name) [North Carolina]: Locality Name (eg, city) [Raleigh]: Organization Name (eg, company) [AnnCons Consulting]: Organizational Unit Name (eg, section) [HQ]: Common Name (eg, YOUR name) [anncons]:anncons.net Email Address []:webmaster@anncons.net #### NOTE: Leave the "challenge password" blank ### Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: Request (and private key) is in newreq.pem ### Now sign the newly generated cert request ### ### NOTE: the pass phrase asked for is the one used to ### ### generate the CA (not the above "oedopusrex") ### [root@anncons1 ca]# ./CA.sh -sign Using configuration from openssl.cnf Enter pass phrase for ./anncons/private/cakey.pem: april showers bring may flowers Check that the request matches the signature Signature ok Certificate Details: Serial Number: 2 (0x2) Validity Not Before: Jul 25 04:43:40 2003 GMT Not After : Jul 24 04:43:40 2004 GMT Subject: countryName = US stateOrProvinceName = North Carolina localityName = Raleigh organizationName = AnnCons Consulting organizationalUnitName = HQ commonName = anncons.net emailAddress = webmaster@anncons.net X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: 46:A4:B4:90:69:06:7B:0D:E3:68:59:AB:92:3B:CF:BE:94:A2:D8:7C X509v3 Authority Key Identifier: keyid:96:7F:6E:33:1E:F3:25:D6:77:81:D2:D2:90:38:4D:FF:B3:D2:B1:4C DirName:/C=US/ST=North Carolina/L=Raleigh/O=AnnCons Consulting/OU=HQ/CN=anncons/emailAddress=admin@anncons.net serial:00 Certificate is to be certified until Jul 24 04:43:40 2004 GMT (365 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated Certificate: Data: Version: 3 (0x2) Serial Number: 2 (0x2) Signature Algorithm: sha1WithRSAEncryption Issuer: C=US, ST=North Carolina, L=Raleigh, O=AnnCons Consulting, OU=HQ, CN=anncons/emailAddress=admin@anncons.net Validity Not Before: Jul 25 04:43:40 2003 GMT Not After : Jul 24 04:43:40 2004 GMT Subject: C=US, ST=North Carolina, L=Raleigh, O=AnnCons Consulting, OU=HQ, CN=anncons.net/emailAddress=webmaster@anncons.net Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (1024 bit) Modulus (1024 bit): 00:cc:eb:8b:91:c1:9c:50:37:9d:8e:52:46:ce:59: 19:83:8b:38:c5:e0:38:26:3d:1d:03:3a:3f:61:4c: 58:e9:d0:19:22:cc:91:67:3a:f9:d1:3b:14:67:8d: ba:c2:69:9f:14:a8:72:0d:57:fe:69:0f:65:0b:7e: f0:fc:05:20:60:79:4e:c0:b7:c8:73:b3:e0:e2:ce: ee:09:81:5b:52:78:8a:e8:aa:98:7f:2e:8e:8e:37: 4e:7e:df:47:fa:fb:cc:df:d4:19:76:ce:45:40:8d: b0:d9:83:ae:fc:b6:d6:c8:24:50:ea:53:7f:87:a8: d0:96:b6:57:33:91:7e:af:0f Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: 46:A4:B4:90:69:06:7B:0D:E3:68:59:AB:C2:3B:CF:BE:94:A2:D8:7C X509v3 Authority Key Identifier: keyid:96:7F:6E:33:1E:F3:25:D6:77:81:C2:D2:90:38:4D:FF:B3:D2:B1:4C DirName:/C=US/ST=North Carolina/L=Raleigh/O=AnnCons Consulting/OU=HQ/CN=anncons/emailAddress=admin@anncons.net serial:00 Signature Algorithm: sha1WithRSAEncryption 0e:19:c7:1c:5d:7b:97:cb:4a:d5:4a:c3:fe:8f:7b:a6:1b:4d: 0c:c2:4d:44:d8:64:e8:ff:1e:2a:b2:af:9f:51:c3:ed:ef:d7: 56:50:b3:d6:69:bb:16:a2:20:2d:83:0c:3c:6c:90:32:6a:8e: e6:6b:4f:6c:ee:35:dd:b1:65:1d:3b:24:98:dd:87:b1:03:a4: 4e:19:ee:01:6d:36:d6:80:72:7c:87:89:53:57:be:0a:96:94: 06:9f:70:b9:eb:b7:97:10:23:45:bf:68:e5:08:03:e4:03:32: cc:89:96:dc:39:36:3b:e7:e8:69:ca:ce:5a:ae:57:71:a2:0a: 70:88 -----BEGIN CERTIFICATE----- MIID/TCCA2agAwIBAgIBAjANBgkqhkiG9w0BAQUFADCBpzELMAkGA1UEBhMCVVMx FzAVBgNVBAgTDk5vcnRoIENhcm9saW5hMQ0wCwYDVQQHEwRDYXJ5MSUwIwYDVQQK ExxDb250ZW50IE1hbmFnZW1lbnQgU29sdXRpb25zMQswCQYDVQQLEwJIUTESMBAG A1UEAxMJQ29udElvisLiveswJgYJKoZIhvcNAQkBFhljcmFpZ2R1bmNhbkBjb250 ZW50ZGIubmV0MB4XDTAzMDcyNTA0NDM0MFoXDTA0MDcyNDA0NDM0MFowgakxCzAJ BgNVBAYTAlVTMRcwFQYDVQQIEw5Ob3J0aCBDYXJvbGluYTENMAsGA1UEBxMEQ2Fy eTElMCMGA1UEChMcQ29udGVudCBNYW5hZ2VtZW50IFNvbHV0aW9uczELMAkGA1UE CxMCSFExFjAUBgNVBAMTDWNvbnRlbnRkYi5uZXQxJjAkBgkqhkiG9w0BCQEWF3dl Ym1hc3RlckBjb250ZW50ZGIubmV0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB gQDM64uRwZxQN52OUkbOWRmDizjF4DgmPR0DOj9hTFjp0Bki3JFnOvnROxRnjbrC aZ8UqHINV/5pD2ULfvD8BSBgeU7At8hzs+Dizu4JgVtSeIroqph/Lo6ON05+30f6 +8zf0xl2zkVAjbDZf678ttbIJFDqU3+HqNCWtlczkX6vDwIDAQABo4IBMzCCAS8w CQYDVR0TBAIwADAsBglghkgBhvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2Vy dGlmaWNhdGUwHQYDVR0OBBYEFEaktJBpBnsN42hZq5I7z76Uoth8MIHUBgNVHSME gcwwgcmAFJZ/bjMe8yXWd4HS0pA4Tf+z0rFMoYGtpIGqMIGnMQswCQYDVQQGEwJV UzEXMBUGA1UECBMOTm9ydGggQ2Fyb2xpbmExDTALBgNVBAcTBENhcnkxJTAjBgNV BAoTHENvbnRlbnQgTWFuYWdlbWVudCBTb2x1dGlvbnMxCzAJBgNVBAsTAkhRMRIw EAYDVQQDEwlDb250ZW50REIxKDAmBgkqhkiG9w0BCQEWGWNyYWlnZHVuY2FuQGNv bnRlbnRkYi5uZXSCAQAwDQYJKoZIhvcNAQEFBQADgYEADhnHHF17l8tK1UrD/o97 phtNDMJNRNhk6P8eKrKvn1HD7e/XVlCz1mm7FqIgLYMMPGyQMmqO5mtPbO413bFl HTshmN2HsQOkThnuAW021oByfIeJU1e+CpaUBp9wueu3lxAjRb9o5QgD5AMyzImW 3Dk2O+foacrOWq5XcaIKcIg= -----END CERTIFICATE----- Signed certificate is in newcert.pem ### Okay the new signed cert for use on the website ### ### http://anncons.net ### ### is now in the local directory in the file newcert.pem ### ### If you want to use the private key *without* the simple ### ### password "oedopusrex" then you will need to unencrypt ### ### the key as follows... ### [root@anncons1 ca]# openssl rsa -in newreq.pem >host.key Enter pass phrase for newreq.pem: oedopusrex writing RSA key ### Now save the files so you know they belong to anncons.net ### mv host.key anncons.net.key mv newcert.pem anncons.net.cert mv newreq.pem anncons.net_newreq.pem ### The unencrypted private key data should now be in ### ### anncons.net.key ### ### The corresponding certificate data is in anncons.net.cert ### ### You can throw away anncons.net_newreq.pem ### ### Next, copy the new cert and key files into ### ### /etc/ssl/apache/ ### ### ### ### Then setup the virtual SSL hosts using the existing ### ### /etc/httpd/conf.d/41_mod_ssl.default-vhost.conf ### ### as an example. ###