I hope I remember this right.... here goes:
(paths and stuff will probably differ)
Iīm lazy, so I entered my country, e-mail and stuff into
/usr/local/ssl/lib/ssleay.conf first.
Iīll describe 2 methods, there are probably 100 others
-------------------------
with apache-sslīs script:
run 'make-dummy-certificate'
fill in stuff, httpsd.pem + a checksum symlink will be created.
(fill in your server url in the field: Common Name)
the make-dummy-certificate script:
cd /var/tmp
/usr/local/ssl/bin/ssleay req \
-config /usr/local/ssl/lib/ssleay.cnf \
-new -x509 -days 999 -nodes -out /etc/httpsd/conf/httpsd.pem \
-keyout /etc/httpsd/conf/httpsd.pem; \
ln -sf /etc/httpsd/conf/httpsd.pem \
/etc/httpsd/conf/`/usr/local/ssl/bin/ssleay \
x509 -noout -hash < /etc/httpsd/conf/httpsd.pem`.0
point apache-sslīs config directives to the pem file:
SSLCACertificatePath /etc/httpsd/conf <- needed?
SSLCertificateFile /etc/httpsd/conf/httpsd.pem
---------------------------
with SSLeay's CA.sh script:
set up a new CA (Certificate Authority?)
CA.sh -newca
enter your CA password
create a new request
CA.sh -newreq
fill in stuff, newreq.pem will be created.
(fill in your server url in the field: Common Name)
enter your personal key password
sign the request
CA.sh -sign
enter CA password
if you do not want to enter the personal key password
every time the server starts, remove it from the key (in newreq.pem)
with ssleay rsa -in newreq.pem -out key.pem
append the key to the certificate: cat key.pem >> newcert.pem
point apache-sslīs config directive to the pem file:
SSLCACertificatePath /etc/httpsd/conf <- needed?
SSLCertificateFile /etc/httpsd/conf/newcert.pem
maybe you have to create the symlink also... well, it wont hurt:
ssleay x509 -noout -hash < newcert.pem --> gives e.g. 6ff777df
make the symlink:
ln -sf /etc/httpsd/conf/newcert.pem 6ff777df.0 <--- don't forget .0
----------------------- phew
start up your server.... and cross your fingers
rzdrav@pcnet.co.nz wrote:
>
> At 06:57 PM 7/7/98 +0200, you wrote:
> >Thanks, all!
> >Now it works like a charm.
>
> Could you write in a couple points, how you worked it out?
> I mean from CA.sh -newca to the end
>
> It would be very useful for the beginers.
Who isn't a beginner? :)
--
Magnus Stenman http://www.hkust.semailto:stone@hkust.se