Creating a Certificate Signing Request

341

your identity. A passport contains your name, birth date, and birthplace. An SSL certificate contains your name, location (country, state/province, and city), organization name, and e-mail address.

Passports (and SSL certificates) also provide some method for ensuring that your identity is correct. Your passport contains a photograph that someone can compare with your face. An SSL certificate contains the public half of a public/private key pair.

A passport also contains safeguards against forgery: Every passport contains a watermark, and many governments will soon issue passports that contain holograms (which are very difficult to forge). Likewise, an SSL certificate is digitally signed with the issuer’s private key, and any tampering makes the digital signature invalid.

Passports and SSL certificates share another important characteristic: They’re both issued by trusted third parties. A border authority isn’t likely to trust a passport that you’ve issued to yourself. Instead, a passport office (the U.S. State Department, for example) verifies your identity and issues a passport. Foreign governments trust that the passport office has done a thorough job investigating your identity. SSL certificates work the same way.

Choosing an SSL Certificate

To obtain an SSL certificate, you send a request (called a certificate signing request, or CSR), along with proof of your identity, to a trusted authority. The trusted authority (also known as a certification authority, or CA) compares your request to the proof of identity that you provide, and if it’s satisfied that you are who you claim to be, it issues you a certificate. The certificate that you receive is signed with the issuer’s private key — you can verify the signature by using the issuer’s public key.

A self-signed certificate is untrustworthy (but useful for testing).

A certificate signed by a local CA (a CA that you create and manage yourself) can be trusted by your peers.

A certificate signed by a well-known CA can be trusted by outside parties (that is, customers).

Obtaining a signed certificate costs money. The CA assumes the work of verifying your identity and maintaining a database of valid certificates. A number of companies are in the certification business, and two of the best known are VeriSign (www.verisign.com) and thawte (www.thawte.com). If you decide to go this route, see the following section, “Creating a Certificate Signing Request,” for details on how to get the certificate from a CA.

If you want to test out your Web site before you shell out a few bucks to a CA, you can create a self-signed certificate. A self-signed certificate looks and acts like a normal certificate except for one very important difference: You should never trust a self-signed certificate. Trusting a self-signed certificate is like trusting a self-issued passport. Anyone can create a self-signed certificate, and more importantly, anyone can forge a self-signed certificate. We explain how this is done in the “Creating a Self-Signed Certificate” section, later in this technique.

In some cases, you may want to act as a CA yourself. For instance, if you head up the IT department at a large company, you can issue certificates to in-house Web servers without having to pay a third-party CA for each one. You might use your in-house CA to distribute trusted software or deliver confidential content such as payroll information.

Creating a Certificate

Signing Request

You can get three different types of SSL certificate, and each provides a different level of trust:

To request a signed certificate from a CA, you must first create a certificate signing request (or CSR). The

342 Technique 45: Safeguarding Your Apache Server with SSL Certificates

CSR contains two important pieces of information: your identity and your public key.

In an SSL certificate, the identity is called the subject (and the CA is called the issuer). Every subject

(and every issuer) is identified by the following information:

Location (country, state/province, city)

Organization (organization name and organizational unit)

Common name (the name of your Web server, as seen by the outside world)

E-mail address

If you’re a Fedora user, you can use the tools installed with Apache to generate a CSR (we show you how in a moment). If you’re not using Fedora, you have a bit more work to do: We suggest using Webmin and Webmin’s Certificate and Key Management module to generate a CSR. Technique 17 shows you how to install and use Webmin (the Certificate and Key Management module is an add-on that you’ll have to download separately from the www.webmin. com Web site).

Fedora makes it easy to create a CSR (and the public/private key pair that you need in order to sign the CSR):

1. Open a terminal window and give yourself superuser privileges with the su command.

2. Move to the directory /etc/httpd/conf:

# cd /etc/httpd/conf

3.Type make certreq and press Enter.

4.If you have an existing server key (it’s stored in

/etc/httpd/conf/ssl.key/server.key), you’re prompted for the passphrase for that key. If you don’t have an existing server key, OpenSSL creates a new server key for you and asks for a passphrase that will protect your private server key from unauthorized use. In either case, type in the passphrase and press Enter.

The OpenSSL program now asks you a series of questions regarding your identity.

5. Enter the two-letter code for your country.

For example, type US for United States or CA for Canada.

6. Enter the full name (not the abbreviation) for your state or province.

7. Enter the name of your organization (a company name, for example).

8. Enter the name of your department within the organization. Or, if you’re requesting a certificate for your entire organization, just press Enter.

9. Enter the name of your Web server (for example, www.example.com). If you have (or plan to have) multiple Web servers at your site, use a * in place of the host name, like this: *.example. com (you still need to include your domain name).

It’s very important that you enter your real Web server name here. When the CA issues a certificate, it belongs to a specific Web site. If you try to use that certificate on a Web server with a different name, visitors to your Web site will be greeted with a scary message warning of certificate forgery.

10. Enter your e-mail address.

11. Next, you’re prompted for two extra pieces of information: a challenge password and an optional company name. Just press Enter twice to ignore those questions.

OpenSSL saves the resulting CSR (certificate signing request) in /etc/httpd/conf/ssl.csr/ server.csr.

If you’d like to see what’s inside the CSR in humanreadable form, use the following command:

$openssl req -text -in ssl.csr/server.csr.

You see a result similar to that shown in Listing 45-1.

Creating a Certificate Signing Request

343

LISTING 45-1: EXAMINING A CERTIFICATE SIGNING REQUEST

Certificate Request: Data:

Version: 0 (0x0)

Subject: C=US, ST=Virginia, L=Anytown, O=TrixieWare, OU=Cosmology, CN=www.trixieware.com/emailAddress=[e-mail]

Subject Public Key Info:

Public Key Algorithm: rsaEncryption RSA Public Key: (1024 bit)

Modulus (1024 bit): 00:ac:fd:51:b4:b0:42:80:eb:cf:7f:53:54:64:1b: 8a:13:fe:45:81:9c:7b:d5:a4:58:23:68:3a:d1:84: 0e:51:77:57:21:27:b6:3a:5b:e1:50:ca:81:2e:5e: e2:65:36:9e:64:ed:63:88:a7:d0:55:2f:58:a9:19: 39:2b:85:0a:c2:a2:3b:a6:ce:3e:a1:57:a8:99:72: 32:6d:40:70:32:86:10:a6:f0:09:ac:f9:66:e9:64: c1:a0:d3:ca:7a:61:01:4a:b0:3f:5b:0d:15:1d:58: 6a:01:b9:ca:e2:c8:dd:ac:49:03:4e:e4:3e:1d:fb: c3:ef:ca:30:c0:1e:6f:a9:39

Exponent: 65537 (0x10001) Attributes:

a0:00

Signature Algorithm: md5WithRSAEncryption 04:61:e0:3d:4b:69:2b:92:27:fb:e7:f1:a1:e2:2a:21:3d:89: 7f:ba:67:9a:34:9c:9e:73:00:f4:79:6c:0a:bf:57:99:6d:08: 0e:ad:4d:a8:0c:5a:f3:fc:43:a2:4a:fc:5a:24:c7:4b:02:55: 1d:be:d8:2a:12:49:91:d0:f1:c3:61:62:d8:73:95:62:c9:f8: ca:6a:c2:34:f7:67:02:34:5d:dc:b6:36:59:46:c7:9d:36:7a: 29:8a:4d:de:5e:f6:b9:52:26:33:e5:8d:f2:fd:cf:da:4b:65: f6:4f:fa:12:cf:10:13:d7:bb:1b:f7:22:60:b9:9a:4d:20:49: 81:80

-----BEGIN CERTIFICATE REQUEST-----

MIIB3DCCAUUCAQAwgZsxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJWYTETMBEGA1UE

BxMKRnJvZyBMZXZlbDETMBEGA1UEChMKVHJpeGllV2FyZTESMBAGA1UECxMJQ29z

bW9sb2d5MRswGQYDVQQDExJ3d3cudHJpeGlld2FyZS5jb20xJDAiBgkqhkiG9w0B

CQEWFW5ld2Rvb0B0cml4aWV3YXJlLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAw

gYkCgYEArP1RtLBCgOvPf1NUZBuKE/5FgZx71aRYI2g60YQOUXdXISe2OlvhUMqB

Ll7iZTaeZO1jiKfQVS9YqRk5K4UKwqI7ps4+oVeomXIybUBwMoYQpvAJrPlm6WTB

oNPKemEBSrA/Ww0VHVhqAbnK4sjdrEkDTuQ+HfvD78owwB5vqTkCAwEAAaAAMA0G

CSqGSIb3DQEBBAUAA4GBAARh4D1LaSuSJ/vn8aHiKiE9iX+6Z5o0nJ5zAPR5bAq/

V5ltCA6tTagMWvP8Q6JK/Fokx0sCVR2+2CoSSZHQ8cNhYthzlWLJ+MpqwjT3ZwI0

Xdy2NllGx502eimKTd5e9rlSJjPljfL9z9pLZfZP+hLPEBPXuxv3ImC5mk0gSYGA

-----END CERTIFICATE REQUEST-----

You can see that the certificate contains all the information that you entered. The CSR is digitally signed with your private key; the CA verifies the signature by using the public key included in the CSR.

Send the CSR (/etc/httpd/conf/ssl.csr/server.csr) to the certification authority that you’ve selected, along with the proof-of-identity documents that it requires.

344 Technique 45: Safeguarding Your Apache Server with SSL Certificates

When you receive the final certificate, simply copy it to /etc/httpd/conf/ssl.crt/server.crt and restart your Apache server.

Creating a Self-Signed

Certificate

Creating a self-signed certificate with Fedora is just as easy as creating a CSR, but you end up with a test certificate rather than a request that you send to a CA. Again, if you’re not using Fedora, we recommend that you generate SSL certificates with the help of Webmin’s Certificate and Key Management module (see Technique 17 for more details).

Here are the steps you need to follow to create a selfsigned certificate with Fedora:

1. Open a terminal window and give yourself superuser privileges with the su command.

2. Move to the directory /etc/httpd/conf:

# cd /etc/httpd/conf

3.Type make testcert and press Enter.

4.You’re prompted for the password that protects your private server key. Type in the password and press Enter.

5.OpenSSL prompts you for the same information that you provide when creating a CSR (location, organization, e-mail address, and so on). Answer each question in turn.

After you’ve answered the last question (your e-mail address), OpenSSL creates a self-signed certificate and saves it in /etc/httpd/conf/ssl. crt/server.crt.

To view the certificate at the command line, use the following command:

# openssl x509 -in ssl.crt/server.crt -text

You’ll see that the issuer and subject are identical — that’s a self-signed certificate.

Fedora automatically saves the self-signed certificate where Apache expects to find it. To see your certificate in action, restart your Apache server:

# /sbin/service httpd restart Stopping httpd: [OK] Starting httpd:

Apache/2.0.47 mod_ssl/2.0.47 (Pass Phrase Dialog)

Some of your private key files are encrypted for security reasons.

In order to read them you have to provide us with the pass phrases.

Server localhost.localdomain:443 (RSA) Enter pass phrase:

Ok: Pass Phrase Dialog successful.

Notice that Apache now asks for the passphrase that protects your server’s private key.

Now, open a Web browser and connect to

https://127.0.0.1

Notice the preceding URL starts with https rather than http. That means it’s connecting to a secure server.

You’ve just created a self-signed certificate and installed it on your own Apache server.

Because your users may receive a warning when they encounter this certificate, it’s a good idea to give them a little forewarning about what’s going on. See the sidebar, “When Mozilla encounters a selfsigned certificate,” for details on how this works.

When Mozilla encounters a self-signed certificate

Self-signed certificates are not very trustworthy. When you visit a site with a self-signed certificate, you should receive a warning screen from Mozilla asking if you know this joker and if his certificate is good enough for you (see the following figure). From here, follow these steps to examine the certificate: