16

In light of the recent heartbleed fiasco and whatnot I too have been scrambling to up security on some servers. My question is how do I reissue the Snakeoil cert that comes with Openssl?

The cert that it is currently using was issued in 2012, so clearly before this incident. So it seems like the protocol here is to reissue all certs and I cant find info on how to do so for snakeoil.

I am the only one who uses that cert, for PHPmyadmin, so do I even need to update it?

3
  • 2
    You do know why it is named "snake-oil"? The keys are the same on all installations - so there is really no need to recreate them now. Anyway: creating new ones is a Good Idea™ .
    – guntbert
    Apr 27, 2014 at 20:03
  • Mine randomly broke somehow. I don't know or care how SSL certs work. Just wanted my Postgres to start.
    – sudo
    Mar 16, 2018 at 20:36
  • 1
    They aren't the same, they're issued to the hostname. Apr 27, 2018 at 23:26

2 Answers 2

21
+50

You can use this one-liner to regenerate both files in one shot. You'll need to restart Apache after the cert has been re-created.

openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout /etc/ssl/private/ssl-cert-snakeoil.key -out /etc/ssl/certs/ssl-cert-snakeoil.pem

If you're at all concerned about security (and you should be), then you should regenerate certificates on all affected critical servers, followed by an exhaustive service restart or a system reboot.

If you're just running a play-around box on your LAN that's one thing, but anything you've got on the internet you should definitely reissue.

3
  • Excellent, thanks. Will get to the reissing, nice to see a one liner. Apr 11, 2014 at 1:13
  • 1
    As this is a old question, but has been lifted up again: Today we do have Let's encrypt, which provides free, automated certificates. There's no reason not to use it, if the box is communicating over the public internet.
    – vidarlo
    Aug 18, 2017 at 8:48
  • Awesome, fixed it for me. Postgres was having issues with it.
    – sudo
    Mar 16, 2018 at 20:37
2

Here I found that there is this command:

sudo make-ssl-cert generate-default-snakeoil --force-overwrite
1
  • This solved my isue. Legend! Oct 30, 2020 at 10:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.