The Tuxnetworks Linux Bible: certificate

Monday, 6 May 2019

Create and install an SSL certificate in Apache

Lets create a SSL encrypted website using apache.

Prequisites:
A working unsecured website on port 80

If your server is behind a firewall you will need to open/forward port 443

A publicly accessible FQDN is configured for the site.

Enable ssl on apache;

sudo a2ensite default-ssl.conf

Installing certbot;

sudo apt install certbot python-certbot-apache

Use certbot to create a free certificate;

sudo certbot --apache certonly

Follow the prompts, they are self explanatory.

Note: This will break if the certbot cannot resolve your domain name properly. I have used the --certonly flag to stop certbot from editing apache configs because I prefer to do it myself. Apparently if you drop that flag you can skip the next step.

Once you are done you should have a shiny new certificate in /etc/letsencrypt/live/www.example.com/

Now, if you did not allow certbot to modify your apache configs you will need tell apache to use your new certificate.

Edit the file that contains the virtualhost configuration for your web site. The virtualhost section should look like this;

ServerName www.example.com
ServerAdmin brettg@tuxnetworks.com
DocumentRoot /var/www/html

(...)

Modify it to look like this;

ServerName www.example.com
ServerAdmin admin@example.com
DocumentRoot /var/www/html
SSLEngine on
SSLCertificateFile /etc/letsencrypt/live/www.example.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/www.example.com/privkey.pem

(...)

Restart your apache server and you should now be able to browse your site using https.

Note: If you want your site to work in both encrypted (SSL) mode as well as unsecured mode then when you are modifying the virtualhost config in apache copy that entire section to the end of the file and make the changes shown above in the new section

Tuesday, 6 July 2010

Add VMware Server certificate to Chrome

When you connect to your VMware Server host console using the Google Chrome browser you will be presented with a warning about the site certificate being invalid. This is because the certificate is self signed due to it being generated during the vmware install process.

In Firefox you simply click "allow exception" and this warning disappears for good.

Chrome does not have a similar exception mechanism unfortunately. Chrome uses the "NSS Shared DB" which is part of the OS. From their website "On Linux, Chromium uses the NSS Shared DB. Rather than reinvent the wheel and create another certificate configuration tool, we are going to wait for a system certificate configuration utility to be created and launch that. In the mean time, you can configure certificates with the NSS command line tools."

This is how we do it. My host server is named "jupiter", you should change this to suit yours obviously.

Install the nss toolset;

sudo apt-get install libnss3-tools

Obtain the certificate from your server;

echo QUIT | openssl s_client -connect site:8333 | sed -ne '/BEGIN CERT/,/CERT/p'END

This will produce a lot of output. Select and copy the section that looks like this;

Note: You should include the BEGIN and END tag lines.

Create a file to store the certificate;

vi ~/jupiter.cert

and paste in the code you copied.

Add the certificate to your store;

certutil -d sql:$HOME/.pki/nssdb -A -t "P,," -n vmware-jupiter -i ~/jupiter.cert

"vmware-jupiter" is a nickname, you can use whatever you like there as long as it makes some sense to you

.
You should be able to browse your host without seeing any error*

You can list the certificates that are installed like this;

certutil -d sql:$HOME/.pki/nssdb -L

To look at the details of a certificate;

certutil -d sql:$HOME/.pki/nssdb -L -n certificate_nickname

And finally, to delete a certificate;

certutil -d sql:$HOME/.pki/nssdb -D -n certificate_nickname

* You will still get a red "broken certificate" indicator in the browser address bar but you wont be asked to proceed every time you connect.