SSL Certificate Signing Request
Ensure the openssl package is
not vulnerable to Heartbleed attack. To ensure the same, check the version of
openssl package. Following are the
versions which are not vulnerable,
Ø
Openssl 1.0.1g
Ø
Openssl 1.0.0 branch
Ø
Openssl 0.9.8 branch
Only openssl 1.0.1
through 1.0.1f are vulnerable to
Heartbleed attack. If server has any version between 1.0.1 and 1.0.1f, then openssl needs to be updated before
generating the CSR/Key. This can be checked using following command.
# rpm –qa |
grep openssl
1.
Generate
Private key
# openssl genrsa -des3 -out server.key 1024
Pass phrase needed.
Give the passphrase as it would be kept secret.
The
generated private key looks like follows,
# cat server.key
-----BEGIN
RSA PRIVATE KEY-----
Proc-Type:
4,ENCRYPTED
DEK-Info:
DES-EDE3-CBC,485B3C6371C9916E
ymehJu/RowzrclMcixAyxdbfzQphfUAk9oK9kK2
jadfoiyqthakLKNqw9z1MoaqkPyqeHevUm26no
AJKIETHKJADFS2BGb0n61/Ksk8isp7evLM4+QY
KAQETKjdiahteksMJOjXLq+vf5Ra299fZPON7yr
-----END RSA
PRIVATE KEY-----
2.
Generate
Certificate signing request
# openssl req -new -key server.key -out
server.csr
Enter pass
phrase for server.key:
Enter the
same passphrase which we have given in point 1. You are about to be asked to
enter information that will be incorporated into your certificate request.
What you are
about to enter is what is called a Distinguished Name or a DN.
There are
quite a few fields but you can leave some blank
For some
fields there will be a default value, If you enter '.', the field will be left
blank. -----
Country Name
(2 letter code) [GB]:IN
State or
Province Name (full name) [Berkshire]:
Locality
Name (eg, city) [Newbury]:
Organization
Name (eg, company) [My Company Ltd]:
Organizational
Unit Name (eg, section) []:
Common Name
(eg, your name or your server's hostname) []:
Email
Address []: Valid Email ID for which
certificate to be sent
Please enter
the following 'extra' attributes to be sent with your certificate request
A challenge
password []:
An optional
company name []:
# ls -ltr server.*
-rw-r--r-- 1
root root 963 Jun 13 20:26 server.key
-rw-r--r-- 1
root root 664 Jun 13 20:35 server.csr
3.
Then server.csr needs to be sent to Certifying
authority for SSL certificate.
