Coral: apache free server cert

Apache - Free Server Certificate

A free server certificate using the service from http://www.startssl.com/ is a better choice than a self-signed certificate. Please note that The Uniform Server developers have no relation or affiliation with this site. The material is included here only to provide a better alternative to a self-signed certificate. Other choices likely are available.

UniServer 8-Coral
	Home
	Quick Start
	General
»	Apache
	MySQL
	PHP
	MSMTP
	CRON
	DtDNS
	Db Backup
	Perl
	Main Index

StartSSL (StartCom) is a public certification authority providing digital certificates for free! They have their root certificate in all major browsers, which means that certificates issued by StartSSL are trusted by default. Major browsers include Firefox, Internet Explorer, Gogole Chrome, Safari and Opera. The term free means just that, no hidden catches or trials, so The Uniform Server support now includes support for StartCom.

Obtaining a free server certificate requires a number of steps. First you need to have a registered domain name, then you create a certificate-signing request and obtain a personal ID certificate by registering with StartCom. With this in place, you can login to StartCom and have your certificate signed. Finally you install this certificate on your server. This page covers each step in more detail.

Register a domain name

Register a domain name with a registrar of your choice. The information you supply pertains to the domain you are registering. Of importance for obtaining a free certificate is the contact e-mail address you supply. I am referring to the address where a registrar can contact you. This e-mail address will be used by StartCom to verify who you are (domain name). Alternatively, if your domain name is active (site has a mail-server) the site email address can be used for verification.

Note: Your registrar contact e-mail address allows you to obtain a signed certificate before making your site live. This allows you to test your site locally with a signed certificate and confirm that Apache’s SSL Vhost server verification chain works.

Top

Create an account at StartSSL

Creating an account at StartSSL can be done in advance. You are asked for certain details that identify you. This information is used for creating a personal identification (ID) certificate that is installed into your browser. One purpose of this certificate is to automatically log you into your StartSSL account.

Go to [https://www.startssl.com/?app=12/] website
Click Sign up
Fill in all fields in the sign up form and click Continue
An authentication code will be e-mailed to you.
Copy and paste it into the Complete Registration form. Click Continue
Choose the level of security required and click Continue
Allow the pop up to install security certificate into your browser
Click Install
If prompted by your firewall, allow outside access. (Certificate authority)
Click Finish

Note: Backup your client certificates! [Check this link] and follow the instructions appropriate for your browser.

Top

Creating a certificate signing request (CSR)

Generating a certificate-signing request is similar to generating a self-signed certificate. The only difference is to change Hostname from localhost to your registered domain name. For a free StartCom certificate, this field is the only one that is part of the certificate. If you change any of the other fields, the class of the certificate changes as well as its cost, and will require further validation. These instructions cover only the free certificate.

UniController: Server Configuration > Apache > Generate Certificate

This opens the Server Certificate and Key generator menu shown at right
A) Change Common Name (CN) to your registered domain name; for example, fred.com
D) Click Run Generate. After a short time, a confirmation pop-up is displayed.

This generates your new server key (server.key) and CSR (server.csr)

It's important to save these files to a safe and secure location (example: UniServer\certs) as follows:

Save UniServer\openssl\server.csr to folder UniServer\certs
Save UniServer\usr\local\apache2\server_certs\server.key to folder UniServer\certs
Create a new text document named server.crt in folder UniServer\certs

Note 1: The empty file server.crt is where you will copy your signed certificate. Folder UniServer\certs is used only to store your original certificates. It keeps them as a separate group.

Note 2: Folder UniServer\certs is just an example. Ideally you would save its final content to a pen drive, writable CD or another PC for safekeeping.

Top

Sign certificate at StartSSL

Login to StartSSL

Go to https://www.startssl.com/?app=12/ website
Click Authenticate
Click Control Panel

Validation Wizard

Click Validations Wizard tab (top menu)
From drop-down menu choose Domain Name Validation . -- Click continue
Enter the URL of your domain name to be validated
Select an e-mail from the list (select last entry). Note: The last entry is your registrar contact e-mail address. -- Click continue button.
An authentication code is sent to the selected e-mail address.
Copy this authentication code and paste it into Verification Code: Box. -- Click continue button.
Click Finish

Certificates Wizard

Now click the Certificates Wizard tab
From the Certificate Target dropdown menu select Webserver SSL/TLS Certificate -- Click continue button.
Generate Private Key form displayed. Click Skip - We are using our own key.
Submit Certificate Request (CSR) form opens
1. Open file UniServer\certs\server.csr
2. Copy and past its content into the box displayed.
3. Click continue button.
Message displayed Certificate Request Received -- Click continue button.
Select your domain name (from dropdown list) and use www as the subdomain.
1. Your signed certificate is generated and displayed.
2. Copy the displayed content and save it to file
3. UniServer\certs\server.crt

Top

Download StartCom CA Certificates - Information

Note: This section is for information only. The required certificates are preinstalled. A signed certificate requires a verification chain. To implement this on Apache, two additional certificates are required. Download these from StartSSL

At StartSSL, log into your control panel.
Download ca.pem Save to folder UniServer\certs.
Download sub.class1.server.ca.pem Save to folder UniServer\certs.

Note: If you have a higher validated server certificate you need to use the class2 or class3 intermediate CA certificate.

Top

Install certificates

Copy the two files server.key and server.crt to Apache folder server_certs

Copy UniServer\certs\server.key to folder UniServer\usr\local\apache2\server_certs
Copy UniServer\certs\server.crt to folder UniServer\usr\local\apache2\server_certs

Top

Edit SSL Configuration file

Two lines require enabling in Apache’s SSL configuration file as follows:

Edit file: UniServer\usr\local\apache2\conf\extra\ssl.conf

Locate these two lines:

#SSLCertificateChainFile C:/UniServer/usr/local/apache2/server_certs/sub.class1.server.ca.pem
#SSLCACertificateFile    C:/UniServer/usr/local/apache2/server_certs/ca.pem

Remove the # to enable as shown below:

SSLCertificateChainFile C:/UniServer/usr/local/apache2/server_certs/sub.class1.server.ca.pem
SSLCACertificateFile    C:/UniServer/usr/local/apache2/server_certs/ca.pem

Note: Your path to folder UniServer may be different.

Top

Local Test

Before going live with your secure server you can test it locally. To do this your domain name (example fred.com) must resolve to an IP address. This is done through an entry in your hosts file.

Edit file: C:\WINDOWS\system32\drivers\etc\hosts
Add this line: 127.0.0.1 fred.com
Start the Apache server
Click View ssl button
The secure test page should be displayed with no alerts.

Note: Replace fred.com with the hostname you used when creating your CSR. Be sure to remove this line when you are ready to go live.

Top

Where to next

Apache SSL Introduction and overview.

Self-signed Self-signed test certificate details.

Top