Buying a Certificate

Now you're ready to purchase a certificate. Once you've received the certificate, simply repeat the steps in the section called Installing and Testing Your Certificate to install it.

If you purchase your certificate from a well-known CA, you probably won't need to modify your browser to accept the certificate, since many browsers are pre-configured to accept well-known CA's signed certificates.

Purchasing a Certificate From VeriSign

The process of purchasing a certificate from VeriSign is similar to requesting a free test certificate from them. First, however, you'll need to decide which certificate you'd like to purchase. See the section called VeriSign Certificate Packages for a description of VeriSign's certificate products.

In this section, we'll describe the process of purchasing a certificate from VeriSign. Go to http://www.verisign.com/server/. Decide which type of server you want to buy and fill in any information required. Click on Continue until you can choose between their Wizard and their Standard enrollment processes for purchasing certificates. We'll go through the Standard Enrollment process.

From now on, the purchase process is somewhat standardized. In this document, we'll go step-by-step through the process of purchasing a Secure Site certificate, but you should be able to use the instructions to purchase another class of certificate.

Read the information provided. You'll probably want to print out a copy of their step by step guide. You also need to read the Freeware Apache Notice. When you're finished, click on the Continue button at the bottom of the page.
The next step is to "Obtain Proof of Right." This means that you need to prove to VeriSign that your organization is legitimate. The easiest way to do this is to provide them with your D-U-N-S number, but there are other ways if you don't have a D-U-N-S number or you don't want to use one. Refer to the instructions provided by VeriSign if you need to prove your organization's identity with something other than a D-U-N-S number. You'll need the proof, ready for submission to VeriSign, before you can apply for a certificate. Once you have the required documents or a D-U-N-S number, press Continue at the bottom of the page.
The next page is entitled Confirm Domain Name and is shown as Figure 3-7. You need a valid, registered domain name in order to obtain a certificate. This page instructs you to obtain a whois query result for your domain name. The whois result will be used by VeriSign to confirm that your organization actually controls the domain for which you'll be using their certificate.
Figure 3-7. Confirming your Domain Name for VeriSign
Click on the applicable link in the whois lookup pages column, and use their whois service to look up your domain name. Note that you'll need to look up the second level domain name (i.e., just your_domain.com instead of www.your_domain.com). Print out or save the whois query result and return to the VeriSign Web page. Click Continue.
The next page is entitled Generate CSR. There's a warning about key lengths shorter than 512 bits. You can safely ignore this warning if you followed the instructions provided in this manual for creating your key.
If you followed the instructions provided in the section called Generating a Key, and the section called Generating a Certificate Request, you have already generated a certificate signing request (CSR). Your CSR should be saved as /etc/httpd/conf/server.csr. If you have not generated a key and a certificate request, follow the instructions in those two sections. Click on the Continue button to proceed.
On the Submit CSR page, shown as Figure 3-8, you'll see an example of a certificate request.
Figure 3-8. Submitting a CSR to VeriSign
Paste the contents of your server.csr file into the Enter CSR Information text box. Use the drop-down box labeled Select Server Vendor to choose "Red Hat Linux" (or if "Red Hat Linux" is not a choice, choose "Apache Freeware with SSLeay"). Press the Continue button at the bottom of the page.
Confirm the information from your CSR.
The next page, Complete Application, contains an application for you to fill out.
Fill in the Enter Technical Contact Information section with information about your Red Hat Linux Secure Server's administrator or webmaster.
Fill in the Enter Organizational Contact Information section with the appropriate information, according to the instructions provided by VeriSign.
Fill in the Enter Billing Contact Information with information for the person who will be contacted for billing purposes.
Type a "challenge phrase" into the area provided. You may be asked for your challenge phrase if you ever need support from VeriSign, so be sure to record it and keep it someplace safe.
Indicate how you are going to pay for your certificate.
After you've read their server agreement, click on the Continue button at the bottom of the page. Your application will be submitted.

After you've successfully completed your enrollment form and your information and payment has been provided to VeriSign, they will authenticate your organization's identity and issue your certificate. When your application has been approved, they will send your certificate by e-mail to the technical and organizational contacts you provided.

Save the certificate VeriSign sends you in /etc/httpd/conf/server.crt. Follow the steps outlined in the section called Installing and Testing Your Certificate to install your certificate.

Purchasing a Certificate From Thawte

To purchase a certificate from Thawte, follow these instructions:

Point your browser to http://www.thawte.com/certs/server/request.html, where Thawte provides an overview of the necessary steps.
The first thing you need to do is gather the documents that they will require, as discussed in both the section called Proving Your Organization's Identity to Thawte, and the aforementioned Web page.
The next step is to generate a key and a certificate signing request (CSR). If you followed the instructions contained in the section called Generating a Key and the section called Generating a Certificate Request, you already have a key (/etc/httpd/conf/server.key) and a CSR (/etc/httpd/conf/server.csr). If you did not already create your key and certificate request, do so now using the instructions provided in this document.
Use your Web browser to go to Thawte's Buy a Certificate Web page at https://www.thawte.com/cgi/server/step1.exe. Select SSL Server Certificate. Click on the Next button at the bottom of the page.
The next page, Server Cert Enrollment, is shown as figure Figure 3-9. Paste the contents of your /etc/httpd/conf/server.csr file into the Certificate Signing Request (CSR) text box.
Figure 3-9. Thawte Enrollment Form
Choose Red Hat Secure Server from the Web Server Software pull-down menu.
Choose how you want to pay for the certificate.
Click on Next at the bottom of the page.
The next page contains a form you need to fill out.
Figure 3-10. Thawte Application
Under Background Information, select a description for your organization from the pull-down menu, or type your own description into the text box provided.
If you have a D-U-N-S number, type it into the text box under DUNS Number.
Fill in contact information for the person in your organization who will be signing the authorization letter, as described in the section called Proving Your Organization's Identity to Thawte.
Under Technical Contact/Webmaster, fill in contact information for your Red Hat Linux Secure Server's administrator or webmaster.
Click on the Next button at the bottom of the page.
The next page, also entitled Server Cert Enrollment, is the last page of their enrollment form and is shown as Figure 3-11. From the first pull-down menu, choose the currency in which you are going to pay Thawte.
Figure 3-11. Thawte Application
Type the street address for your organization into the Office Street Address text box.
Type in your organization's fax number into the text box under Office Fax Number.
From the pull-down menu under Nearest Thawte Office, choose the Thawte office closest to your organization.
If you want to, you may type a password or challenge phrase into the text box under Privacy Protection Password. After you've submitted your application, you'll be able to check on its status on the Web. If you type a password in here, then only people who know the password will be able to check on the status of your application. If you don't fill one in, anyone can check on your application.
Click on Next at the bottom of the page.
The next page will indicate that your submission is complete. This page provides you with a tracking number for your application, so that you can monitor its status over the Web.
After Thawte receives your documentation and payment, your certificate should be issued by e-mail within five working days.
Save your certificate to /etc/httpd/conf/server.crt. See the section called Installing and Testing Your Certificate, for instructions on installing your certificate.