Create OpenSSL certificate for Apache (SSL with Apache2)

make-ssl-cert generate-default-snakeoil --force-overwrite 
a2enmod ssl
a2ensite default-ssl
service apache2 restart
 
# install packages
apt-get install openssl
# apache2 apache2.2-common php5
 
# enable ssl in apache
a2enmod ssl
a2ensite default-ssl
 
 
# default
make-ssl-cert generate-default-snakeoil --force-overwrite
 
# customized
openssl \
    req \
    -x509 \
    -newkey rsa:2048 \
    -sha256 \
    -nodes \
    -days 365 \
    -keyout /etc/ssl/private/$(hostname -f).key \
    -out /etc/ssl/certs/$(hostname -f).pem \
    -subj "/C=DE/ST=NRW/L=Bonn/O=Example Inc/OU=IT/CN=www.example.com/emailAddress=info@www.example.com"
 
sed -i "s|SSLCertificateFile .*$|SSLCertificateFile /etc/ssl/certs/$(hostname -f).pem|g" /etc/apache2/sites-enabled/default
sed -i "s|SSLCertificateKeyFile .*$|SSLCertificateKeyFile /etc/ssl/private/$(hostname -f).key|g" /etc/apache2/sites-enabled/default
 
chown root:root /etc/ssl/certs/www.example.com.pem
chmod 644 /etc/ssl/certs/www.example.com.pem
 
chown root:ssl-cert /etc/ssl/private/www.example.com.key
chmod 640 /etc/ssl/private/www.example.com.key
 
 
# view supported protocols
cat /etc/apache2/mods-available/ssl.conf | grep SSLProtocol
 
 
# creating an RSA key (use -des3 to create a password protected key file)
openssl genrsa -out key.pem 1024
 
# creating a certificate request
openssl req -new -nodes -x509 -out /etc/ssl/certs/ssl-cert-snakeoil.pem -keyout /etc/ssl/private/ssl-cert-snakeoil.key -days 365 -subj "/C=DE/ST=NRW/L=Cologne/O=Your Company/OU=IT/CN=www.YOUR_SERVER.com/emailAddress=you@YOUR_SERVER.com"
 
# restart apache
service apache2 restart

# v2
openssl x509 -req -days 365 -in dns.server.com.csr -signkey dns.server.com.key -out dns.server.com.crt
openssl req -new -nodes -x509 -out /etc/ssl/certs/ssl-cert-snakeoil.pem -keyout /etc/ssl/private/ssl-cert-snakeoil.key -days 365 -subj "/C=US/ST=CA/L=City/CN=localhost/emailAddress=root@localhost"
 
cp /etc/ssl/private/dns.server.com.crt /etc/ssl/certs/
 
 
# view certificate info
openssl req -noout -text -in dns.server.com.csr
 
cat /etc/apache2/sites-enabled/default-ssl | grep SSLCertificateFile
cat /etc/apache2/sites-enabled/default-ssl | grep SSLCertificateKeyFile
 
 
mv /etc/ssl/certs/ssl-cert-snakeoil.pem /etc/ssl/certs/ssl-cert-snakeoil.pem.org
mv /etc/ssl/private/ssl-cert-snakeoil.key  /etc/ssl/private/ssl-cert-snakeoil.key.org
 
cp /etc/ssl/certs/dns.server.com.crt /etc/ssl/certs/ssl-cert-snakeoil.pem
cp /etc/ssl/private/dns.server.com.key  /etc/ssl/private/ssl-cert-snakeoil.key
 
/etc/init.d/apache2 restart

# v3 #
# fix hostname
echo "$(ifconfig eth0| grep "inet addr" | cut -d ":" -f2 | cut -d" " -f1)     $(hostname).$(cat /etc/resolv.conf | grep domain | cut -d" " -f2) $(hostname)" >> /etc/hosts
 
# generate certificate with snakeoil
sudo make-ssl-cert generate-default-snakeoil --force-overwrite 
/etc/init.d/apache2 restart
 
 
# check certificate expiration
openssl x509 -noout -enddate -in /etc/ssl/certs/ssl-cert-snakeoil.pem
 
 
# disable SSLv2 and SSLv3
SSLProtocol ALL -SSLv2 -SSLv3
SSLHonorCipherOrder On
SSLCompression Off