SSL Best Practices Article
October 28, 2013
Here’s a great article on best practices for SSL deployments: https://www.ssllabs.com/downloads/SSL_TLS_Deployment_Best_Practices_1.3.pdf
Here’s a great article on best practices for SSL deployments: https://www.ssllabs.com/downloads/SSL_TLS_Deployment_Best_Practices_1.3.pdf
Had to install an SSL certificate from Trustwave today. The cert was emailed to the customer in a zip file. that contained several formats. For plesk the “.cer” file is the one that we needed. Also for the CA certificate there was a “chain.cer” file. Unfortunately Plesk (Apache) was not happy and complained that the private key did not sign the certificate. This indicates a problem with intermediate certificates. Using the commands given here: View Contents Of SSL Certificate I looked at the certificate and found that it was signed by: C=US, ST=Illinois, L=Chicago, O=Trustwave Holdings, Inc., CN=Trustwave Organization Validation CA, Level 2/emailAddress=ca@trustwave.com The certificate in the chain file was for: C=US, ST=Illinois, L=Chicago, O=Trustwave Holdings, Inc., CN=Trustwave Organization Validation CA, Level 2/emailAddress=ca@trustwave.com and it was signed by: C=US, O=SecureTrust Corporation, CN=SecureTrust CA but there was not certificate for this signer. I found the TrustWave roots here: https://ssl.trustwave.com/support/support-root-download.php Turns out
For this example we’ll install an SSL certificate for acme.com. The certificate authority is Network Solutions. The procedure may be different for other certificate authorities especially in how intermediate certificates are setup. Install mod_ssl if needed
|
1 |
yum install mod_ssl |
Copy SSL certificate to the server – The certificate should be named after the domain name and placed in the /etc/pki/tls/certs folder. For our example the cert will be:
|
1 |
/etc/pki/tls/certs/acme.com.crt |
Copy the intermediate CA bundle to the server – The bundle should be placed in /etc/pki/tls/certs/ and named after the certificate authority. For example, GoDaddy would be “gd_bundle.crt” and Network Solutions would be “ns_bundle.crt”. Sometimes the certificate authority will provide the bundle file. Other times they will just provide a set of separate root and intermediate CA certificates. In this situation, you’ll need to create the bundle file yourself. The bundle is a text file with a series of certificates. The first certificate
Reliable Penguin provides managed web hosting, systems administration, website and server migrations, and expert consulting.
Submit the form—or for immediate service call 866-649-7984.