Jan 21, 2020 Convert CRT SSL Certificate to PEM Format on Linux. Let’s look on how to convert CRT/DER certificate file to the PEM format on Linux. First, you need to install the OpenSSL package. On RedHat/CentOS/Fedora you can install OpenSSL as follows: yum install openssl. In this case the openssl-1:1.1.1c-2.el8.x8664 package is already installed. Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un.x-like operating systems. It only takes a minute to sign up. Apache - Generate private key from an existing.crt file. I have some apache instances running smoothly with a home-made generated certificate.
SSL (Secure Sockets Layer) is a cryptographic protocol that allows secure data flow between a server and its clients using symmetric/asymmetric keys by using a digital certificate signed by a Certificate Authority (CA).
This tutorial provides an approach on how to set up Secure Sockets Layer (SSL) communication cryptographic protocol on Apache Web Server installed in Red Hat Enterprise Linux/CentOS 7.0, and generate self-signed Certificates and Keys with the help of a bash script which greatly simplifies the entire process.
1. To enable SSL on Apache HTTP Server use the following command to install SSL Module and OpenSSL tool-kit which is needed for SSL/TLS support.
Install SSL Module
2. After SSL module has been installed, restart HTTPD daemon and add a new Firewall rule to ensure that SSL port – 443 – it’s opened to outside connections on your machine in listen state.
3. To test SSL connection, open a remote browser and navigate to your server IP address using HTPS protocol on https://server_IP.
Test SSL Connection
4. The previous SSL communication between the server and client was done using a default Certificate and Key automatically generated on installation. In order to generate new private keys and self-signed certificates pairs create the following bash script on a executable system path ($PATH).
For this tutorial /usr/local/bin/ path was chosen, make sure the script has executable bit set and, then, use it as a command to create new SSL pairs on /etc/httpd/ssl/ as Certificates and Keys default location.
Use the following file content.
5. Now make this script executable and launch it to generate a new pair of Certificate and Key for your Apache SSL Virtual Host.
Fill it with your information and pay attention to Common Name value to match your server FQDN or in case of Virtual Hosting to match the Web address you will be accessing when connecting to a secure website.
Enter SSL Information
6. After the Certificate and Key are generated, the script will present a long listing of all your Apache SSL pairs stored in /etc/httpd/ssl/ location.
7. Other approach on generating SSL Certificates and Keys is by installing crypto-utils package on your system and generate pairs using genkey command, which can impose some problems especially when used on a Putty terminal screen.
So, I suggest to use this method only when you are directly connected to a screen monitor.
Install Crypto Package
8. To add the new Certificate and Key to your SSL website, open your website configuration file and replace SSLCertificateFile and SSLCertificateKeyFile statements with the new pairs location and names accordingly.
9. If the Certificate is not issued by a trusted CA – Certification Authority or the hostname from certificate does not match the hostname who establish the connection, an error should appear on your browser and you must manually accept the certificate.
SSL Certificate Error
That’s it! Now you can use apache_sslas a command line on RHEL/CentOS 7.0 to generate as many pairs of self-signed Certificates and Keys you need, and all will be kept on /etc/httpd/ssl/ path with the Key file protected with 700 permissions.
Today we will discuss how to generate a self-signed SSL certificate on Linux. SSL is on a lot of people’s minds today. With free Let’s Encrypt certificates becoming extremely common, there’s no reason for anyone to not use SSL – not to mention the search ranking benefits, and the fact that browsers will trust your site.
However, you can also create your own self-signed SSL certificate for private use on your server. One big reason to do this is encryption. While your personal certificate won’t mean anything to browsers, and visitors will still get a warning message if they visit your site directly, you can at least be sure that you’re protected against “man-in-the-middle” attacks. A self-signed certificate is a good first step when you’re just testing things out on your server, and perhaps don’t even have a domain name yet.
So here’s a step by step procedure on how to create a self-signed SSL certificate on Linux.
The first step is to use the “openssl” package on Linux/CentOS to create an RSA key pair. To do this, make sure that you have the package installed. If not, install it with:
Chances are that you already have it available on your system. If so, generate the key/pair using the following command:
This command uses 2048 bit encryption and outputs a file called “keypair.key” as shown here:
As you can see, the key has been generated and placed in the current directory.
The “/etc/httpd” folder is where the system keeps all the important SSL related stuff. So first, let’s create a new folder to hold all the files relating to our private key:
I’ve called the folder “httpscertificate” and will refer to it for all the other command line examples.
To extract the private key from the keypair file that we just created, type in the following:
Replace the section in bold with the IP address of your own server. Or if you’re able to access your site with a domain name, you can use that as well.
This will create a “key” file in the folder that we just created. And when that’s done, we can delete the original keypair file:
With the key, we can create a special “csr” file that we can either sign ourselves or submit to a “Certificate Authority”. It’s in a standardized format. To create it, type the following command:
Again, replace the items in bold with the IP address or domain name that you settled on in step 2. When you run this command, the tool will ask you for a bunch of personal information:
A CA can use these details to verify that you are indeed who you say you are. Fill up as much information as you can.
Once you’ve finished entering these details, the tool will wrap up its work and place a “csr” file in the directory we created for just this purpose.
With the CSR, we can create the final certificate file as follows:
This creates a “crt” file along with all the others. Here’s a screenshot of the final files in our security folder:
Now we need to tell Apache where these files are.
First, we need to install the “mod_ssl” package with the command:
Once done, this will place a “ssl.conf” file inside the /etc/httpd/conf.d/ folder. We need to modify this default file:
Now scroll down till you find the lines starting with:
Change the default paths with the paths to the certificate file and key file respectively as shown here:
Save your changes. Now just restart Apache with:
And you’re done! When Apache restarts, it will be configured to allow SSL connections.
When you connect to your IP address via HTTPS the next time, you’ll be warned that it’s not a trusted certificate:
That’s ok. We know this since we signed it ourselves! Just proceed and it’ll take you to the final site:
Here you can see that it’s using the certificate that we created. It’s not much use for anyone else visiting your site since they can’t verify your identity. But you know it’s safe, and moreover that it’s encrypted. No man in the middle attacks!
If you are one of our Managed VPS hosting clients, we can do all of this for you. Simply contact our system administrators and they will respond to your request as soon as possible.
If you liked this blog post on how to create a self-signed SSL certificate on Linux, please share it with your friends on social media networks, or if you have any question regarding this blog post, simply leave a comment below and we will answer it. Thanks!