Skip to content

Instantly share code, notes, and snippets.

@gbelot2003
Forked from mgedmin/StartSSL.md
Created May 2, 2017 06:14
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save gbelot2003/3d7689ec731b7d51a9015121455b14ff to your computer and use it in GitHub Desktop.
Save gbelot2003/3d7689ec731b7d51a9015121455b14ff to your computer and use it in GitHub Desktop.
Free StartSSL.com SSL certificate HOWTO

How to get a free StartSSL.com SSL certificate

I'm writing this up from memory, so errors may appear.

This has been updated to use SHA256 certificates.

Start

  1. Go to http://www.startssl.com/
  2. Click on 'Control Panel'
  3. Click 'Express Lane'

Identity validation

  1. Fill in the form, submit
  2. Check your email for the validation code, enter it, submit
  3. You'll get a client-side certificate, valid for 1 year, installed in your browser's storage. Think of it as your StartSSL account password. Make a backup.

Domain validation

  1. Enter your domain name
  2. Choose which email address you'll want to validate (postmaster@, hostmaster@, or webmaster@)
  3. Check your email for the validation code, enter it, submit

Certificate generation

  1. Skip the generation step on the startssl website because you'll do it on your server directly
  2. On your Linux machine, create a req.cfg for OpenSSL so you won't have to answer questions repeatedly:
[ req ]
default_bits            = 2048
default_keyfile         = privkey.pem
distinguished_name      = req_distinguished_name
prompt                  = no

[ req_distinguished_name ]
countryName                     = LT
stateOrProvinceName             = .
localityName                    = Vilnius
organizationName                = Vardenis Pavardenis
organizationalUnitName          = .
commonName                      = example.com
emailAddress                    = vardenis@example.com
  1. openssl req -config req.conf -newkey rsa:2048 -nodes -keyout subdomain.example.com.pem -sha256 -out subdomain.example.com.csr
  2. chmod 600 subdomain.example.com.pem -- this is your private key, keep it secret!
  3. copy the text from subdomain.example.com.csr into the StartSSL web form, submit
  4. choose the validated domain from step 7 (example.com), choose the desired subdomain
  5. copy the text of the certificate into a file called subdomain.example.com.crt

Installing the certificate into Apache on Ubuntu/Debian systems

  1. copy/move subdomain.example.com.crt into /etc/ssl/certs/ on your web server
  2. copy/move subdomain.example.com.pem into /etc/ssl/private/ on your web server
  3. download https://www.startssl.com/certs/class1/sha2/pem/sub.class1.server.sha2.ca.pem
  4. copy/move the downloaded sub.class1.server.sha2.ca.pem into /etc/ssl/certs/startssl-class1-intermediate-sha2.crt
  5. put this in your Apache config (e.g. inside a <VirtualHost *:443> directive):
    SSLCertificateFile /etc/ssl/certs/subdomain.example.com.crt
    SSLCertificateKeyFile /etc/ssl/private/subdomain.example.com.pem
    SSLCertificateChainFile /etc/ssl/certs/startssl-class1-intermediate-sha2.crt
  1. sudo a2enmod ssl
  2. sudo apache2ctl configtest && sudo apache2ctl graceful

Verification

  1. openssl s_client -connect subdomain.example.com:443 -servername subdomain.example.com -CApath /etc/ssl/certs < /dev/null
  2. visit https://www.ssllabs.com/ssltest/analyze.html and test it there too

Certificates for multiple subdomains

  1. Be sure to edit /etc/apache2/ports.conf and make sure it contains NameVirtualHost *:443
  2. Go to startssl.com, click 'Control Panel', choose the 'Certificate Wizard' tab, ask for a new web server certificate.
  3. Generate a new CSR and a new certificate, install it as per the above (steps 10--25).

Notes:

  • this requires SNI, which means users stuck with Windows XP or Internet Explorer 6 will not be able to see the right certificates and may get scary security warnings
  • to get a wildcard certificate or a single certificate valid for multiple subdomains you have to perform Class 2 identity verification (i.e. send StartSSL $59.90 and also scans of two different valid photo IDs, e.g. passport and driver's licence)

Certificates for multiple domains

Same as above, except you also need to perform domain validation again.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment