I decided to write this post, as I spent some time researching this the last time I had to do it, so I figured I probably weren’t the only one out there who were kinda clueless on this.
Whether you need to install or update a certificate on an Apache instance, the process is largely the same. To sum it up you first have to create a certificate request (CSR), use the CSR during the ordering process at your favourite issuer, install it, and restart the daemon.
Create a key
If you don’t already have a keyfile you would like to use for your CSR, and later your certificate, you need to create one. This can be done with the command below. Follow the prompt to enter a passphrase, and reenter the passphrase to confirm it.
Create certificate request
To create the CSR run the following command, note how I pass the path of the keyfile as parameter.
Order your certificate online
Whether your favorite supplier is RapidSSL, DigiCert, Symantec (formerly VeriSign), Cloudflare or whatever, the process is largely the same. You choose the certificate type, and pass the content of the request.csr file, in order to receive your certificate.
Install your certificate
If you’re updating an existing certificate, you should be able to find the existing config lines with this command.
Look for the following lines.
If you’re on the other hand configuring from scratch, you most likely won’t have those lines to look for, though you may have them as samples. But you should be able to locate your config file at the following path.
Add the lines noted above, and copy your certificate files and private key to the paths listed.
That should be it, now all you have to do is issue a restart of the httpd with the command below.
Now, you’ll notice that the daemon asks for the passphrase of the private key used for the certificate, and that’s no good. To remove the passphrase from the private key, run the command below.
Now you need to copy over the new private key to the destination noted in your config. Once done, try issuing another httpd restart. This time around is should just restart, without prompting for passphrase, and you’re golden.
Now grab a Miller, and kick back :-)