mgedmin/StartSSL.md

## StartSSL.md

      
            Raw
  

              StartSSL.md
            
          
    How to get a free StartSSL.com SSL certificate
I'm writing this up from memory, so errors may appear.
This has been updated to use SHA256 certificates.
Start

Go to http://www.startssl.com/
Click on 'Control Panel'
Click 'Express Lane'

Identity validation

Fill in the form, submit
Check your email for the validation code, enter it, submit
You'll get a client-side certificate, valid for 1 year, installed in your browser's storage.  Think of it as your StartSSL account password.  Make a backup.

Domain validation

Enter your domain name
Choose which email address you'll want to validate (postmaster@, hostmaster@, or webmaster@)
Check your email for the validation code, enter it, submit

Certificate generation

Skip the generation step on the startssl website because you'll do it on your server directly
On your Linux machine, create a req.cfg for OpenSSL so you won't have to answer questions repeatedly:

[ req ]
default_bits            = 2048
default_keyfile         = privkey.pem
distinguished_name      = req_distinguished_name
prompt                  = no

[ req_distinguished_name ]
countryName                     = LT
stateOrProvinceName             = .
localityName                    = Vilnius
organizationName                = Vardenis Pavardenis
organizationalUnitName          = .
commonName                      = example.com
emailAddress                    = vardenis@example.com


openssl req -config req.conf -newkey rsa:2048 -nodes -keyout subdomain.example.com.pem -sha256 -out subdomain.example.com.csr
chmod 600 subdomain.example.com.pem -- this is your private key, keep it secret!
copy the text from subdomain.example.com.csr into the StartSSL web form, submit
choose the validated domain from step 7 (example.com), choose the desired subdomain
copy the text of the certificate into a file called subdomain.example.com.crt

Installing the certificate into Apache on Ubuntu/Debian systems

copy/move subdomain.example.com.crt into /etc/ssl/certs/ on your web server
copy/move subdomain.example.com.pem into /etc/ssl/private/ on your web server
download https://www.startssl.com/certs/class1/sha2/pem/sub.class1.server.sha2.ca.pem
copy/move the downloaded sub.class1.server.sha2.ca.pem into /etc/ssl/certs/startssl-class1-intermediate-sha2.crt
put this in your Apache config (e.g. inside a <VirtualHost *:443> directive):

    SSLCertificateFile /etc/ssl/certs/subdomain.example.com.crt
    SSLCertificateKeyFile /etc/ssl/private/subdomain.example.com.pem
    SSLCertificateChainFile /etc/ssl/certs/startssl-class1-intermediate-sha2.crt


sudo a2enmod ssl
sudo apache2ctl configtest && sudo apache2ctl graceful

Verification

openssl s_client -connect subdomain.example.com:443 -servername subdomain.example.com -CApath /etc/ssl/certs < /dev/null
visit https://www.ssllabs.com/ssltest/analyze.html and test it there too

Certificates for multiple subdomains

Be sure to edit /etc/apache2/ports.conf and make sure it contains NameVirtualHost *:443
Go to startssl.com, click 'Control Panel', choose the 'Certificate Wizard' tab, ask for a new web server certificate.
Generate a new CSR and a new certificate, install it as per the above (steps 10--25).

Notes:

this requires SNI, which means users stuck with Windows XP or Internet Explorer 6 will not be able to see the right certificates and may get scary security warnings
to get a wildcard certificate or a single certificate valid for multiple subdomains you have to perform Class 2 identity verification (i.e. send StartSSL $59.90 and also scans of two different valid photo IDs, e.g. passport and driver's licence)

Certificates for multiple domains
Same as above, except you also need to perform domain validation again.