How to get a free StartSSL.com SSL certificate
I'm writing this up from memory, so errors may appear.
This has been updated to use SHA256 certificates.
Start
- Go to http://www.startssl.com/
- Click on 'Control Panel'
- Click 'Express Lane'
Identity validation
- Fill in the form, submit
- Check your email for the validation code, enter it, submit
- You'll get a client-side certificate, valid for 1 year, installed in your browser's storage. Think of it as your StartSSL account password. Make a backup.
Domain validation
- Enter your domain name
- Choose which email address you'll want to validate (postmaster@, hostmaster@, or webmaster@)
- Check your email for the validation code, enter it, submit
Certificate generation
- Skip the generation step on the startssl website because you'll do it on your server directly
- On your Linux machine, create a
req.cfg
for OpenSSL so you won't have to answer questions repeatedly:
[ req ]
default_bits = 2048
default_keyfile = privkey.pem
distinguished_name = req_distinguished_name
prompt = no
[ req_distinguished_name ]
countryName = LT
stateOrProvinceName = .
localityName = Vilnius
organizationName = Vardenis Pavardenis
organizationalUnitName = .
commonName = example.com
emailAddress = vardenis@example.com
openssl req -config req.conf -newkey rsa:2048 -nodes -keyout subdomain.example.com.pem -sha256 -out subdomain.example.com.csr
chmod 600 subdomain.example.com.pem
-- this is your private key, keep it secret!- copy the text from subdomain.example.com.csr into the StartSSL web form, submit
- choose the validated domain from step 7 (example.com), choose the desired subdomain
- copy the text of the certificate into a file called subdomain.example.com.crt
Installing the certificate into Apache on Ubuntu/Debian systems
- copy/move subdomain.example.com.crt into /etc/ssl/certs/ on your web server
- copy/move subdomain.example.com.pem into /etc/ssl/private/ on your web server
- download https://www.startssl.com/certs/class1/sha2/pem/sub.class1.server.sha2.ca.pem
- copy/move the downloaded sub.class1.server.sha2.ca.pem into /etc/ssl/certs/startssl-class1-intermediate-sha2.crt
- put this in your Apache config (e.g. inside a
<VirtualHost *:443>
directive):
SSLCertificateFile /etc/ssl/certs/subdomain.example.com.crt
SSLCertificateKeyFile /etc/ssl/private/subdomain.example.com.pem
SSLCertificateChainFile /etc/ssl/certs/startssl-class1-intermediate-sha2.crt
sudo a2enmod ssl
sudo apache2ctl configtest && sudo apache2ctl graceful
Verification
openssl s_client -connect subdomain.example.com:443 -servername subdomain.example.com -CApath /etc/ssl/certs < /dev/null
- visit https://www.ssllabs.com/ssltest/analyze.html and test it there too
Certificates for multiple subdomains
- Be sure to edit
/etc/apache2/ports.conf
and make sure it containsNameVirtualHost *:443
- Go to startssl.com, click 'Control Panel', choose the 'Certificate Wizard' tab, ask for a new web server certificate.
- Generate a new CSR and a new certificate, install it as per the above (steps 10--25).
Notes:
- this requires SNI, which means users stuck with Windows XP or Internet Explorer 6 will not be able to see the right certificates and may get scary security warnings
- to get a wildcard certificate or a single certificate valid for multiple subdomains you have to perform Class 2 identity verification (i.e. send StartSSL $59.90 and also scans of two different valid photo IDs, e.g. passport and driver's licence)
Certificates for multiple domains
Same as above, except you also need to perform domain validation again.
Greylisting makes the validation process painful (as in: delays of ~1 hour between form submission and email arrival, even if your postgrey is configured to greylist for only 5 minutes). If you use postgrey you may want to add
startcom.org
to your/etc/postgrey/whitelist_clients
(untested; actual client IPs resolve to names like gateway.startcom.org, mta1.startcom.org, apache-7.startcom.org).