74

I've set up SSL on my webserver, now I need two files:

  • a certificate
  • a certificate Key

How do I create a self-signed certificate for testing purposes?

3 Answers 3

109

Ubuntu, even the 'minimal' flavour, comes with the ssl-cert package pre-installed, which means you don't need to do anything.

The files you're looking for are already on your system:

/etc/ssl/certs/ssl-cert-snakeoil.pem
/etc/ssl/private/ssl-cert-snakeoil.key


Advanced:

If for some reason you need to create a fresh certificate, you can run

sudo make-ssl-cert generate-default-snakeoil --force-overwrite 

If you want to change the expiration date of you certificate, you can manipulate the make-ssl-cert script at /usr/sbin/make-ssl-cert. Around like 124 there's a line similar to this:

openssl req -config $TMPFILE -new -x509 -nodes \ 

Where you can change the expiration date by adding the -days argument:

openssl req -config $TMPFILE -new -days 365 -x509 -nodes \ 

More options can be found in the manual page of req.

6
  • 13
    ubuntu-server 12.04 ( AMI cloud image) doesn't have ssl-cert installed by default have it. But once ssl-cert is installed - /etc/ssl/certs/ssl-cert-snakeoil.pem becomes available automatically.
    – Stann
    May 3, 2012 at 21:24
  • make-ssl-cert takes the key length (and other settings) to use from /usr/share/ssl-cert/ssleay.cnf.
    – Tim Smith
    Apr 8, 2014 at 4:23
  • In attempting to test a website in a local vagrant VM instance, I wanted to Google Chrome to act as if it was a totally normal certificate. I had to first set the VM's hostname to match the testing url (e.g. www.test.mydomain.com) using the hostname command in the VM CLI. Then regenerating the key as you suggest, with --force-overwrite, the key's Common Name (CN) then matched the testing url. Finally, on the host machine, installing the key as a Trusted Root Certificate Authority (in Chrome's Settings/Advanced) gave me the coveted green address bar. Apr 2, 2017 at 7:31
  • 1
    my 9-year old cert stopped working with my upgrade to debian 10, so the make-ssl-cert command saved the day for me!
    – Jayen
    Aug 28, 2019 at 8:22
  • 1
    Also, nginx on ubuntu has /etc/nginx/snippets/snakeoil.conf that sets up paths to certificate files generated by ssl-cert.
    – kolen
    Apr 14, 2020 at 17:55
23

As already mentioned, Ubuntu Server comes with the necessary tools. Depending on your server version you'll have to look up the specific documentation. I'll try to summarize the self-signed certificate generation process of the current LTS (12.04).

First you generate the keys for the Certificate Signing Request (CSR):

openssl genrsa -des3 -out server.key 2048

It's up to you to enter a passphrase or not. If you do, everytime you (re)start a service usign that certificate, you'll have to provide the passphrase. Otoh you can create an "insecure" key without a passphrase from the secure one:

openssl rsa -in server.key -out server.key.insecure
# shuffle the key names to continue without passphrases
mv server.key server.key.secure
mv server.key.insecure server.key

And now you'll create the CSR from the key. With the CSR and the key a self-signed certificate can be generated:

openssl req -new -key server.key -out server.csr
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

The last step consists of installing the certificate and the key, in Debian/Ubuntu usually in /etc/ssl:

sudo cp server.crt /etc/ssl/certs
sudo cp server.key /etc/ssl/private

And finally the applications using the certificate/key have to be configured accordingly.

0
0

The other answers are good, but if for some reason you dont have the listed tools, or dont want to use them, I found an open source tool that is very simple:

minica -domains localhost

This will create key file minica-key.pem and cert file minica.pem. The tool for creating these is just a single file in the Go language, with no external dependencies:

https://github.com/jsha/minica

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.