mxlje/ssl.md

## ssl.md

      
    Raw
  

              ssl.md
            
          
    These commands are needed every time you want to generate a new certificate
signing request to give to an authority in order for them to generate and sign
a certificate for you.
https://letsencrypt.org/ solves a lot of the pain involved with SSL certs, but sometimes
you still need to go the "old school" route. I constantly forget how this stuff works,
so I collected the most important commands (and what they do) here for easy copy & paste.
Generate new private key

This is unencrypted and must be kept private.
$ openssl genrsa -out example.com.key 2048
Generate Certificate Signing Request (CSR) using the private key

$ openssl req -new -sha256 -key example.com.key -out example.com.csr
In a single command (generate private key and CSR)

$ openssl req -new -newkey rsa:2048 -nodes -keyout example.com.key -out example.com.csr
Check a CSR

This allows you to check the information enclosed in a CSR.
$ openssl req -noout -text -in example.com.csr
Diffie-Hellman paratemers

http://blog.ivanristic.com/2013/06/ssl-labs-deploying-forward-secrecy.html
$ openssl dhparam -out dhparam.pem 2048
Self signed cert

Use this to test SSL config loally, but realize that these certs will not be trusted by browsers by default.
You need to manually add it to the OS trust store to get a green lock.
$ openssl req -x509 -newkey -sha256 rsa:2048 -keyout example.com.key -out example.com.crt -days 365 -nodes
-nodes means that the private key will be unencrypted.