You must be root to generate a key.
First, use the cd command to change to
the /etc/httpd/conf/ directory. Remove
the fake key and certificate that were generated during the
installation with the following commands:
rm ssl.key/server.key
rm ssl.crt/server.crt
|
Next, create your own random key. Change to the /usr/share/ssl/certs/ directory and type in the
following command:
Your system displays a message similar to the following:
umask 77 ; \
/usr/bin/openssl genrsa -des3 1024 > /etc/httpd/conf/ssl.key/server.key
Generating RSA private key, 1024 bit long modulus
.......++++++
................................................................++++++
e is 65537 (0x10001)
Enter pass phrase:
|
You now must enter in a passphrase. For security reason, it
should contain at least eight characters, include numbers and/or
punctuation, and it should not be a word in a dictionary. Also,
remember that your passphrase is case sensitive.
 |
Note |
| |
You are required to remember and enter this passphrase every
time you start your secure server. If you forget this passphrase,
the key must be completely re-generated.
|
Re-type the passphrase to verify that it is correct. Once you
have typed it in correctly, /etc/httpd/conf/ssl.key/server.key, the file
containing your key, is created.
Note that if you do not want to type in a passphrase every time
you start your secure server, you must use the following two
commands instead of make genkey to create
the key.
Use the following command to create your key:
/usr/bin/openssl genrsa 1024 > /etc/httpd/conf/ssl.key/server.key
|
Then, use the following command to make sure the permissions are
set correctly for the file:
chmod go-rwx /etc/httpd/conf/ssl.key/server.key
|
After you use the above commands to create your key, you do not
need to use a passphrase to start your secure server.
 |
Caution |
| |
Disabling the passphrase feature for your secure server is a
security risk. It is not recommended that
you disable the passphrase feature for secure server.
|
Problems associated with not using a passphrase are directly
related to the security maintained on the host machine. For
example, if an unscrupulous individual compromises the regular UNIX
security on the host machine, that person could obtain your private
key (the contents of your server.key
file). The key could be used to serve webpages that appear to be
from your secure server.
If UNIX security practices are rigorously maintained on the host
computer (all operating system patches and updates are installed as
soon as they are available, no unnecessary or risky services are
operating, and so on), secure server's passphrase may seem
unnecessary. However, since your secure server should not need to
be re-booted very often, the extra security provided by entering a
passphrase is a worthwhile effort in most cases.
The server.key file should be owned by
the root user on your system and should not be accessible to any
other user. Make a backup copy of this file and keep the backup
copy in a safe, secure place. You need the backup copy because if
you ever lose the server.key file after
using it to create your certificate request, your certificate no
longer works and the CA is not able to help you. Your only option
is to request (and pay for) a new certificate.
If you are going to purchase a certificate from a CA, continue
to Section 26.7
Generating a Certificate Request to Send to a CA. If you
are generating your own self-signed certificate, continue to
Section 26.8 Creating
a Self-Signed Certificate.
