Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

In light of the recent heartbleed fiasco and whatnot I too have been scrambling to up security on some servers. My question is how do I reissue the Snakeoil cert that comes with Openssl?

The cert that it is currently using was issued in 2012, so clearly before this incident. So it seems like the protocol here is to reissue all certs and I cant find info on how to do so for snakeoil.

I am the only one who uses that cert, for PHPmyadmin, so do I even need to update it?

share|improve this question
1  
You do know why it is named "snake-oil"? The keys are the same on all installations - so there is really no need to recreate them now. Anyway: creating new ones is a Good Idea™ . –  guntbert Apr 27 at 20:03
add comment

1 Answer 1

up vote 9 down vote accepted

You can use this one-liner to regenerate both files in one shot. You'll need to restart Apache after the cert has been re-created.

openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout /etc/ssl/private/ssl-cert-snakeoil.key -out /etc/ssl/certs/ssl-cert-snakeoil.pem

If you're at all concerned about security (and you should be), then you should regenerate certificates on all affected critical servers, followed by an exhaustive service restart or a system reboot.

If you're just running a play-around box on your LAN that's one thing, but anything you've got on the internet you should definitely reissue.

share|improve this answer
    
Excellent, thanks. Will get to the reissing, nice to see a one liner. –  Foo_Chow Apr 11 at 1:13
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.