15

In light of the recent heartbleed fiasco and whatnot I too have been scrambling to up security on some servers. My question is how do I reissue the Snakeoil cert that comes with Openssl?

The cert that it is currently using was issued in 2012, so clearly before this incident. So it seems like the protocol here is to reissue all certs and I cant find info on how to do so for snakeoil.

I am the only one who uses that cert, for PHPmyadmin, so do I even need to update it?

  • 2
    You do know why it is named "snake-oil"? The keys are the same on all installations - so there is really no need to recreate them now. Anyway: creating new ones is a Good Idea™ . – guntbert Apr 27 '14 at 20:03
  • Mine randomly broke somehow. I don't know or care how SSL certs work. Just wanted my Postgres to start. – sudo Mar 16 '18 at 20:36
  • 1
    They aren't the same, they're issued to the hostname. – Paused until further notice. Apr 27 '18 at 23:26
18
+50

You can use this one-liner to regenerate both files in one shot. You'll need to restart Apache after the cert has been re-created.

openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout /etc/ssl/private/ssl-cert-snakeoil.key -out /etc/ssl/certs/ssl-cert-snakeoil.pem

If you're at all concerned about security (and you should be), then you should regenerate certificates on all affected critical servers, followed by an exhaustive service restart or a system reboot.

If you're just running a play-around box on your LAN that's one thing, but anything you've got on the internet you should definitely reissue.

| improve this answer | |
  • Excellent, thanks. Will get to the reissing, nice to see a one liner. – foochow Apr 11 '14 at 1:13
  • 1
    As this is a old question, but has been lifted up again: Today we do have Let's encrypt, which provides free, automated certificates. There's no reason not to use it, if the box is communicating over the public internet. – vidarlo Aug 18 '17 at 8:48
  • Awesome, fixed it for me. Postgres was having issues with it. – sudo Mar 16 '18 at 20:37
1

Here I found that there is this command:

sudo make-ssl-cert generate-default-snakeoil --force-overwrite
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.