1

Spiceworks comes packaged with a self-signed SSL certificate. While this is fine for most folks, you may want to add your own public SSL certificate obtained from a Certificate Authority (CA).

This how-to demonstrates a fairly simple process for creating and incorporating your own SSL certificate into Spiceworks.

Step 1: Backup Current Spiceworks SSL Certificates And httpd.conf Files

backup.PNG

It’s always a good idea to back up config files, right? The same is true when working with the httpd.conf file. Also, you’ll want to keep backup copies of the current SSL certs.

To start, head over to C:\Program Files (x86)\Spiceworks\httpd\conf and copy the httpd.conf file to a safe location (Desktop, Documents, etc.).

Next, head to the \Spiceworks\httpd\ssl folder and do the same for the ssl-cert.pem and ssl-private-key.pem files.

Step 2: Install OpenSSL

Next, we’ll need to install OpenSSL. Why? OpenSSL provides a straightforward way to generate a private key and a certificate signing request (CSR).

Nowadays, openssl.org doesn’t provide Windows binaries. So, it’s necessary to find it elsewhere. Currently, this is the site I use: Win32/Win64 OpenSSL Installer for Windows - Shining Light Productions.

After you’ve downloaded that file, run the installer.

After the installation completes, you may need to set an environment variable within Windows after installing OpenSSL. To do that, run the following in a command prompt.:
Set OPENSSL_CONF=C:\OpenSSL-Win32\bin\openssl.cfg (where C:\OpenSSL-Win32 is the installation directory of OpenSSL).

Step 3: Generate A Private Key

Installed OpenSSL and set the environmental variable? Good. Now it’s time to generate a private key.

First, bring up a command prompt and run the following command:
openssl req -new -newkey rsa:2048 -nodes -keyout private.key -out request.csr

2048-bit RSA keys are most common, but you may want to check with the CA you’ve chosen.

One important thing to note is the “-nodes” parameter. This means “no DES encryption.” Why? Apache on Windows requires an unencrypted private key. Using DES will bork this process.

Your private key will likely be in the C:\OpenSSL directory or in the C:\OpenSSL-Win32 directory

Step 4: Fill Out CSR Info

Once the private key has been generated, you’ll be asked to fill out a bit of info. This is for the CSR you’ll be sending to your CA.

If you’re not sure what to enter for these prompts, you’ll want to contact your CA.

NOTE: The common name MUST be the fully qualified domain name (FQDN) of the Spiceworks host. For example: helpdesk.mydomain.com

Your CSR will likely be in the C:\OpenSSL directory or in the C:\OpenSSL-Win32 directory

Step 5: Send Your CSR To Your CA

Holy acronymns, Batman!

In this step you’ll need to send your CSR to your CA. Normally, you do this via your CA’s web portal but that can vary based on your CA. As with the other steps, ask your CA if you’re in doubt.

When you send the CSR, specify that you’ll be using Apache.

Step 6: Download Your Certificate

Your CA should send your certificate to the email address you specified when creating your CSR. You should also be able to download this from your CA’s web portal.

If you’re downloading the certificate from your CA’s web portal, you’ll likely have a number of different download options. In most cases, you’ll want to choose the “Apache” option. Not sure? Check with your CA!

Step 7: Download The Intermediate Certificate

Some CA’s require an intermediate certificate in addition to the primary SSL certificate. It’s always a good idea to check with your CA on this step.

Most likely, you’ll download the intermediate certificate along with your primary SSL certificate if you downloaded it via your CA’s web portal.

Again, if you’re not sure about this step contact your CA! Not knowing whether you need an intermediate certificate or not can cause a lot of frustration in the next few steps.

Step 8: Copy Your Certificate(s) And Primary Key To Spiceworks

Okay, now you should have everything you need. Depending on your CA, you may have one or two certificates to drop into place.

NOTE: At this point you’ll need to shutdown Spiceworks and keep it offline until the you’re finished with the entire process.

If your CA doesn’t require an intermediate certificate, you’ll want to copy your SSL certificate to the C:\Program Files (X86)\Spiceworks\httpd\ssl folder. Then, rename the certificate to ssl-cert.pem.

If your CA requires an intermediate certificate as well, follow the step mentioned above and then copy your intermediate certificate to the C:\Program Files (x86)\Spiceworks\httpd\ssl directory and rename to ssl-intermediate.pem.

NOTE: This is probably the single-most confusing part of the process. If you don’t know which certificate is the primary and which is the intermediate, contact your CA! They’ll be able to tell you and it will save you the headache of trial and error.

Finally, copy your private key over to the C:\Program Files (x86)\Spiceworks\httpd\ssl folder and rename it to ssl-private-key.pem.

Step 9: Edit The http.conf File

httpdconf.PNG

Done with that? Great!

If you don’t have an intermediate certificate, you can skip this step. Go ahead. Do it.

Still here? You must have an intermediate certifcate, then. Head over to C:\Program Files (x86)\Spiceworks\httpd\conf and open the httpd.conf file.

Toward the bottom, you’ll see the following lines:
<VirtualHost *:443 >
SSLEngine on
SSLOptions +StrictRequire
SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2
SSLCipherSuite HIGH:!ADH
SSLCertificateFile “ssl/ssl-cert.pem”
SSLCertificateKeyFile “ssl/ssl-private-key.pem”

We’ll want to add the following line just before the line:
SSLCertificateChainFile “ssl/ssl-intermediate.pem”

So, when you’re finished, you should have:
<VirtualHost *:443 >
SSLEngine on
SSLOptions +StrictRequire
SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2
SSLCipherSuite HIGH:!ADH
SSLCertificateFile “ssl/ssl-cert.pem”
SSLCertificateKeyFile “ssl/ssl-private-key.pem”
SSLCertificateChainFile “ssl/ssl-intermediate.pem”

Now, save the httpd.conf file.

Step 10: Start Spiceworks

startup.PNG
startup.PNG1024×473 100 KB

Woo! Made it through…

Now, all you need to do is start Spiceworks. If the app won’t start, shutdown Spiceworks, restore the original certificate files and httpd.conf file, and read back through the steps and see if you missed anything.

Most often, problems stem from renaming the incorrect files. For example, you may have renamed the primary certificate to “ssl-intermediate” instead of “ssl-certificate” on accident.

If the app starts, we’re golden!

When updating Spiceworks in the future, it may be necessary to drop in the certificate files and httpd.conf file in place once more.

To avoid headaches, go ahead and create a backup of the httpd folder and save it someplace outside of the Spiceworks installation directory.

Then, during the next update, drop the httpd folder back into place.

Now that you’ve finished, you have your own public SSL cert incorporated into Spiceworks.

If you’re stuck at any point in this process, it’s always a good idea to reach out to your CA and ensure you’ve downloaded the correct files and renamed them correctly.

43 Spice ups
2

Thanks for the write up on this process. Always helps!

3

Was planning already. Good thing you have it ahead of me.
Thank you!

4

What is the impact on Remote Agents and Remote Collectors set up with the original Self Signed Cert? Is a reinstall required for the RAs required? Do I need to accomplish these steps for the RCs? Thanks as I am trying to get a feel for then scope of effort ahead.

5

Worked Flawlessy with StartSSL.com free certificate. Thanks. A good thing would be to integrate SW with Let’s Encrypt.

6

Will this step work if i generated the certificate through iis? I already have the .pem file after following the step the site is still untrusted.

7

Thanks for sharing this. I use my own internal CA so this worked for me too.

8

I’m having trouble with this. It seems that my old cert (the one that worked and I believe I originally created with IIS) says “-----BEGIN RSA PRIVATE KEY-----” But the key I got back from Godaddy downloading the apache cert says “-----BEGIN CERTIFICATE-----”

When I try to install the cert using the instructions by only renaming the cert the apache service wont start and errors out.

What am I missing?

Nevermind. It seems what I t thought was the issue wasn’t an issue at all.

I completely missed which files to rename to what (even though he explicitly said to pay attention). I was using the actual cert for the private key not realizing the private.key file that was created during the openssl commands located in the openssl directory was the file that I had to put in the httpd/ssl folder and rename ssl-private-key.pem.

Next time I’ll follow directions better.

9

For anyone else that goes through these steps and it gets stuck on the “Starting Up” splash screen. Here is one thing you can check…my certs came from startssl with .crt extensions. I had to stop windows from hiding the extension of files so when I renamed the files it wouldn’t try to keep the .crt extension. it was naming my file ssl-cert.pem.crt instead of ssl-cert.pem Now that I’ve done that all is well. Thanks for this write up

10

Thanks for this, worked great. Up and running in no time. Thanks to Luke05478 also about the file extensions tip, ashamed to admit I had made that mistake initially!

11

ON step 3 I received a message ‘openssl’ is not recognized as an internal or external command, operable program or batch file.
What have I done wrong to this point?

Openssl is installed and I checked environmental labels and everything is configured properly

12

Are you including the OpenSSL part of the text in the command as per the instructions? If so remove that, it should start with “req”

13

i tried both with openssl and just the req and both get not recognized as internal or external command

14

I am getting the error when I ran the following command. pleas help.
C:\OpenSSL-Win64>openssl req -new -newkey rsa:2048 -nodes -keyout private.key -out request.csr
‘openssl’ is not recognized as an internal or external command,
operable program or batch file.

15

ZackaryCSOS
to let it work , navigate firstly to pass C:\OpenSSL-Win32\bin then type the cmd.

" cd C:\OpenSSL-Win32\bin "

16

Sorry, but no. If I try to run this from the bin folder, I get this:

C:\OpenSSL-Win64\bin>openssl req -new -newkey rsa:2048 -nodes -keyout private.key -out request.csr
Can’t open C:\Program Files\Common Files\SSL/openssl.cnf for reading, No such file or directory
2632:error:02001003:system library:fopen:No such process:crypto\bio\bss_file.c:74:fopen(‘C:\Program Files\Common Files\SSL/openssl.cnf’,‘r’)
2632:error:2006D080:BIO routines:BIO_new_file:no such file:crypto\bio\bss_file.c:81:
Generating a 2048 bit RSA private key
…+++
…+++
writing new private key to ‘private.key’

unable to find ‘distinguished_name’ in config
problems making Certificate Request
2632:error:0E06D06A:configuration file routines:NCONF_get_string:no conf or environment variable:crypto\conf\conf_lib.c:272:

I added the environment variable as described above. There appears to be a PATH problem, but does anyone have any ideas?

17

+1 to David4845. I received the same errors. It did produce a private.key output file, but I’m concerned that it’s not correct based on the errors. I also added the environment variable and double checked it for accuracy. I would appreciate any feedback on this.

18

I having an issue step 8. The apache download for GoDaddy consists of two certificate files with .crt file extension and a private key with a .pem extension. Am I supposed to rename these file extensions? Any help would be appreciated.

19

Step 3 isn’t fully developed if you are using Powershell (Run as Admin). You need to add ./ to the front of the command to ensure PS knows what it’s executing. Make Sure to change the directory First.

PS C:\Windows\system32> cd c:\openssl-win32\bin

PS C:\openssl-win32\bin> ./openssl req -new -newkey rsa:2048 -nodes -keyout private.key -out request.csr