I've set up SSL on my webserver, now I need two files:
- a certificate
- a certificate Key
How do I create a self-signed certificate for testing purposes?
asked Jun 17, 2011 at 6:35
Add a comment
|
3 Answers
Ubuntu, even the 'minimal' flavour, comes with the ssl-cert package pre-installed, which means you don't need to do anything.
The files you're looking for are already on your system:
/etc/ssl/certs/ssl-cert-snakeoil.pem
/etc/ssl/private/ssl-cert-snakeoil.key
Advanced:
If for some reason you need to create a fresh certificate, you can run
sudo make-ssl-cert generate-default-snakeoil --force-overwrite
If you want to change the expiration date of you certificate, you can manipulate the make-ssl-cert script at /usr/sbin/make-ssl-cert. Around like 124 there's a line similar to this:
openssl req -config $TMPFILE -new -x509 -nodes \
Where you can change the expiration date by adding the -days argument:
openssl req -config $TMPFILE -new -days 365 -x509 -nodes \
More options can be found in the manual page of req.
answered Jun 17, 2011 at 6:36
-
13ubuntu-server 12.04 ( AMI cloud image) doesn't have ssl-cert installed by default have it. But once ssl-cert is installed - /etc/ssl/certs/ssl-cert-snakeoil.pem becomes available automatically.– StannMay 3, 2012 at 21:24
-
make-ssl-cert takes the key length (and other settings) to use from
/usr/share/ssl-cert/ssleay.cnf. Apr 8, 2014 at 4:23 -
In attempting to test a website in a local vagrant VM instance, I wanted to Google Chrome to act as if it was a totally normal certificate. I had to first set the VM's hostname to match the testing url (e.g.
www.test.mydomain.com) using thehostnamecommand in the VM CLI. Then regenerating the key as you suggest, with--force-overwrite, the key's Common Name (CN) then matched the testing url. Finally, on the host machine, installing the key as a Trusted Root Certificate Authority (in Chrome's Settings/Advanced) gave me the coveted green address bar. Apr 2, 2017 at 7:31 -
1my 9-year old cert stopped working with my upgrade to debian 10, so the
make-ssl-certcommand saved the day for me!– JayenAug 28, 2019 at 8:22 -
1Also, nginx on ubuntu has
/etc/nginx/snippets/snakeoil.confthat sets up paths to certificate files generated byssl-cert.– kolenApr 14, 2020 at 17:55
As already mentioned, Ubuntu Server comes with the necessary tools. Depending on your server version you'll have to look up the specific documentation. I'll try to summarize the self-signed certificate generation process of the current LTS (12.04).
First you generate the keys for the Certificate Signing Request (CSR):
openssl genrsa -des3 -out server.key 2048
It's up to you to enter a passphrase or not. If you do, everytime you (re)start a service usign that certificate, you'll have to provide the passphrase. Otoh you can create an "insecure" key without a passphrase from the secure one:
openssl rsa -in server.key -out server.key.insecure
# shuffle the key names to continue without passphrases
mv server.key server.key.secure
mv server.key.insecure server.key
And now you'll create the CSR from the key. With the CSR and the key a self-signed certificate can be generated:
openssl req -new -key server.key -out server.csr
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
The last step consists of installing the certificate and the key, in Debian/Ubuntu usually in /etc/ssl:
sudo cp server.crt /etc/ssl/certs
sudo cp server.key /etc/ssl/private
And finally the applications using the certificate/key have to be configured accordingly.
The other answers are good, but if for some reason you dont have the listed tools, or dont want to use them, I found an open source tool that is very simple:
minica -domains localhost
This will create key file minica-key.pem and cert file minica.pem. The tool
for creating these is just a single file in the Go language, with no external
dependencies:
