Creating Your Key and Certificate Request

Next, you'll generate an encryption key and a certificate request. You need the key to create the certificate request. You need the certificate request in order to apply for a certificate from a CA.

Generating a Key

cd to the /etc/httpd/conf directory. Type in the following single command (all on one line), and it will generate your key:

/usr/bin/openssl genrsa -rand /dev/urandom -out /etc/httpd/conf/server.key 1024

Your system will display a message while it generates the key. After it is finished, make sure the key's permissions are correctly set with the following command:

chmod go-rwx /etc/httpd/conf/server.key

The server.key file should be owned by the root user on your system and should not be accessible to any other user. Make a backup copy of this file and keep the backup copy in a safe, secure place. You need the backup copy because if you ever lose the server.key file after using it to create your certificate request, your certificate will no longer work and the CA will not be able to help you. Your only option would be to request (and pay for) a new digital certificate.

Generating a Certificate Request

Once you've created a key, the next step is to generate a certificate request which you will need to send to the CA of your choice. Type in the following single command (all on one line):

/usr/bin/openssl req -new -key /etc/httpd/conf/server.key -out
/etc/httpd/conf/server.csr

Your system will display some instructions and then ask for a series of responses from you. Your inputs will be incorporated into the certificate request. The display, with example responses, will look like this:

You are about to be asked to enter information
that will be incorporated into your certificate
request.
What you are about to enter is what is called a
Distinguished Name or a DN.
There are quite a few fields but you can leave
some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [US]:
State or Province Name []:North Carolina
Locality (City) Name []:Durham
Company (Organization) Name []:Test Company
Department Name []:Testing
Server Host Name []:test.mydomain.com
Administrators E-mail address []:admin@mydomain.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

The default answers appear in brackets ([]) immediately after each request for input. For example, the first information required is the name of the country where the certificate will be used, shown like the following:

Country Name (2 letter code) [US]:

The default input, in brackets, is US. To accept the default, just press Enter, or fill in your country's two letter code.

You will have to type in the rest of the inputs (State or Province Name, Locality (City) Name, Company (Organization) Name, Department Name, Server Host Name, and Administrators E-mail address). All of these should be self-explanatory, but you need to follow these guidelines:

Do not abbreviate the city or state. Write them out (for example, St. Louis should be written out as Saint Louis).
For Server Host Name, make sure you type in the real name of your Red Hat Linux Secure Server (a valid DNS name) and not any aliases which the server may have.
Avoid any special characters like @, #, &, !, etc. Some CAs will reject a certificate request which contains a special character. So, if your company name includes an ampersand (&), spell it out as "and" instead of "&."
You don't need to use either of the extra attributes (A challenge password and An optional company name). To continue without entering these fields, just press Enter to accept the blank default for both inputs.

When you've finished entering your information, a file named server.csr will be created. server.csr is your certificate request, ready to send to your CA.

Next, you must test your Red Hat Linux Secure Server to make sure everything is working properly. To do that, you can either create a test certificate yourself or you can send the certificate request off to a CA in order to get a test certificate. A test certificate from a CA is free and will be e-mailed to you immediately. You will not have to provide any proof of your organization's identity to get a test certificate from a CA.

Note that a test certificate lets you test your Red Hat Linux Secure Server to see if it works, but it is not the same thing as a signed certificate. A test certificate can be used for a limited period of time and you don't have to pay for it. A test certificate will not be accepted by browsers which would normally accept that CA's certificates without asking the user.

The next section covers how to generate your own test certificate and how to get test certificates from both VeriSign and Thawte.