3 ms·

you could also integrate the paid verified ssl's into this. I remember generating it from godaddy was a pain.. by the way nice work.

by anuaitt 14y ago

dimastopel 14y ago
Thanks. I'll have to integrate with trusted CAs for this. Will check this out.
- e12e 14y ago
  Wait... you're not using the browser's SSL engine, as far as I can tell? So you have copy of the secret key? Please, do not integrate directly, the way your server is set up now. That said, it's a nice GUI(WUI?) for generating the needed openssl.conf-parameters -- so I'm sure you could offer to download that or something, along with copy-paste tools for the need openssl-stuff (openssl -config genrsa... etc). Also, while you need to do your own req, I find http://CAcert.org http://CAcert.org actually is great for my use of private/personal/etc certs. I actually use a script along the lines of: #!/usr/bin/env bash # Helper script for generating ssl keys/reqs #Set the variables used for the script #Expands filenames and paths function expand_vars { stamp=$(date +%d%m%Y) prefix=. conf=$prefix/conf/$host.conf key=$prefix/private/$host-$stamp.key csr=$prefix/csr/$host-$stamp.csr } #Print usage help function usage { cat<<eof $0 <hostname> Generate new key and csr for <hostname> Files: $conf $key $csr eof } if [[ $# -ne 1 ]] then #Set host to a format that lends itself for the usage()-text host="<hostname>" expand_vars usage exit 1 fi host="$1" expand_vars if [[ ! -r $conf ]] then echo "Cannot read config file $conf" echo "Please make a symlink in ./conf to $conf" exit 1 fi for f in $key $csr do if [[ -a $f ]] then echo "$f exist! Please move/delete before attempting to generate new cert" exit 1 fi done echo "Warning: Generating *new* key -- manually create cert if this is not what you want!" openssl req -config $conf -keyout $key -new -out $csr chmod 0640 $key Along with a config file of the form: #This is in conf/example.com.conf [ req ] default_bits = 4096 prompt = no encrypt_key = yes default_md = sha1 distinguished_name = dn utf-8 = yes [ dn ] C = EX #Company code O = Organization Name CN = example.com ST = State L = City emailAddress=you@example.com More advanced scripting is possible -- but now I just copy the config-file and edit the CN -- and run the script and end up with a separate key-file and csr. Upload the csr to cacert.org, get back a cert that I save alongside the key and the csr -- all named with timestamps of generation.

you could also integrate the paid verified ssl's into this. I remember generating it from godaddy was a pain.. by the way nice work.

by anuaitt 14y ago

you could also integrate the paid verified ssl's into this. I remember generating it from godaddy was a pain.. by the way nice work.

dimastopel 14y ago

Thanks. I'll have to integrate with trusted CAs for this. Will check this out.

e12e 14y ago
Wait... you're not using the browser's SSL engine, as far as I can tell? So you have copy of the secret key? Please, do not integrate directly, the way your server is set up now. That said, it's a nice GUI(WUI?) for generating the needed openssl.conf-parameters -- so I'm sure you could offer to download that or something, along with copy-paste tools for the need openssl-stuff (openssl -config genrsa... etc). Also, while you need to do your own req, I find http://CAcert.org http://CAcert.org actually is great for my use of private/personal/etc certs. I actually use a script along the lines of: #!/usr/bin/env bash # Helper script for generating ssl keys/reqs #Set the variables used for the script #Expands filenames and paths function expand_vars { stamp=$(date +%d%m%Y) prefix=. conf=$prefix/conf/$host.conf key=$prefix/private/$host-$stamp.key csr=$prefix/csr/$host-$stamp.csr } #Print usage help function usage { cat<<eof $0 <hostname> Generate new key and csr for <hostname> Files: $conf $key $csr eof } if [[ $# -ne 1 ]] then #Set host to a format that lends itself for the usage()-text host="<hostname>" expand_vars usage exit 1 fi host="$1" expand_vars if [[ ! -r $conf ]] then echo "Cannot read config file $conf" echo "Please make a symlink in ./conf to $conf" exit 1 fi for f in $key $csr do if [[ -a $f ]] then echo "$f exist! Please move/delete before attempting to generate new cert" exit 1 fi done echo "Warning: Generating *new* key -- manually create cert if this is not what you want!" openssl req -config $conf -keyout $key -new -out $csr chmod 0640 $key Along with a config file of the form: #This is in conf/example.com.conf [ req ] default_bits = 4096 prompt = no encrypt_key = yes default_md = sha1 distinguished_name = dn utf-8 = yes [ dn ] C = EX #Company code O = Organization Name CN = example.com ST = State L = City emailAddress=you@example.com More advanced scripting is possible -- but now I just copy the config-file and edit the CN -- and run the script and end up with a separate key-file and csr. Upload the csr to cacert.org, get back a cert that I save alongside the key and the csr -- all named with timestamps of generation.