HowTo (Creating SSL Certificates using OpenSSL)

[angelaprice7172 (Angela4036)]

I am looking for help to do this task and was advised I should create a How To even though I do not have the full answer. My original question can be found here, if you need to know why I am trying to do this.

http://community.spiceworks.com/topic/99752?page=1#entry-411458

Here are my instructions for creating SSL Certificates using OpenSSL, it falls over at creating the master certificate. I think it has to do with the install directory.

Recommendations or better instructions for creating my own ssl certs for spiceworks and client machines would be appreciated.

----- Install OpenSSL -----

1. Logon as Administrator and install openssl-0.9.8h-1-setup.exe (follow default prompts)
2. Check Installation Directory for Openssl.exe is C:\Program Files\GnuWin32\bin
3. Add C:\Program Files\GnuWin32\bin to System Variable System Path “PATH” (to ensure that the openssl command will run from any command prompt directory)

----- Prepare System for Use -----

1. Logon as user and open command prompt

2. Change directory to C:\netadmin and create directory SSL (this is our working directory)
   md ssl

3. Change directory to C:\netadmin\ssl and create the following directories:
   md keys

md requests

md certs

4. Create the following text files by entering the following (where next line indicates carriage return and ^Z indicates Ctrl-Z)

copy con database.txt
^Z

copy con serial.txt
01
^Z

----- Create Certificate Authority (CA) -----

1. Create a 1024-bit private key

openssl genrsa -des3 -out keys/ca.key 1024

2. Enter PEM pass pharase (choose a memorable pass phrase to use for this key)
3. Verifying password - Enter PEM pass phrase (type your pass phrase again for verification)

----- Create Master Certificate -----

1. Next we create a master certificate based upon this key, to use when signing other certificates

openssl req -config openssl.conf -new -x509 -days 1001 -key keys/ca.key -out certs/ca.cer

2. Enter PEM pass phrase (type your pass phrase here)
3. Enter Country Name:
4. Enter State or Province Name:
5. Enter Locality Name:
6. Enter Organisation Name:
7. Enter Organisational Unit Name:
8. Enter Common Name (eg your website domain name):
9. Enter Email Address:

----- Export CA Certificate in PKCS12 Format -----

1. Convert the pem file to a der file for use by client machines

openssl x509 -in ca.pem -outform DER -out ca.der

[josephdyer8037 (Joseph6282)]

I don’t know if this will help you, but this is how I created and installed a cert from Starfield (godaddy). I imagine it will work for any other CA.

1. Download and install openssl 0.9.8h. Just need it for the openssl.cnf file.

2. Open a command prompt and browse to the ssl folder in the Spiceworks application folder (ie "cd C:\Program Files\Spiceworks\httpd\ssl"

3. Type the following two commands substituting server.company.com for the fully qualified domain name for the Spiceworks application. Include the two periods “…”, unless you have different relative paths to the openssl.exe installed with SW. Remember the passphrase you type in!

   …\bin\openssl genrsa -des3 -out priv-server.company.com.pem 2048

   …\bin\openssl req -config “C:\Program Files (x86)\GnuWin32\src\openssl\0.9.8h\openssl-0.9.8h\apps\openssl.cnf” -new -key priv-server.company.com.pem -out server.company.com.csr

4. Upload the csr file to Starfield

When the new cert is returned from Starfield, both the new cert and the bundle extract them to the ssl directory

5. If you made a passphrase for the private key, these two steps will remove it:

   rename the priv-server.company.com.pem to old-priv-server.company.com.pem

   …\bin\openssl rsa -in old-priv-server.company.com.pem -out priv-server.company.com.pem

6. These two steps convert the crt format to pem for the starfield cert:

   …\bin\openssl x509 -in server.company.com.crt -out server.company.com.der -outform DER

   …\bin\openssl x509 -in server.company.com.der -inform DER -out server.company.com.pem -outform PEM

7. These two steps convert the starfield bundle crt format to pem:

   …\bin\openssl x509 -in sf_bundle.crt -out sf_bundle.der -outform DER

   …\bin\openssl x509 -in sf_bundle.der -inform DER -out sf_bundle.pem -outform PEM

8. In httpd\conf\httpd.conf change/add the following lines (should copy the original file first):

    SSLCertificateFile "ssl/server.company.com.pem"
    SSLCertificateKeyFile "ssl/server.company.com.pem"
    SSLCertificateChainFile "ssl/sf_bundle.pem"
   

9. Restart Spiceworks

[milanchaudhari (sundrift)]

Good info…
I was searching for this only.

[mioszsuchy3633 (Milosz Suchy)]

Or you can use this little JAVA app - http://portecle.sourceforge.net/

[kaismets9585 (Kai Smets)]

i’ve done this on school it was slightly different but almost the same good how to

[craigshuey (Craig9848)]

I could not get this to work. The installation, including sources, did not have an OPENSSL.CNF file. There was a strange file called OPENSSL with no extension that Windows Server thought was a speed dial applet. I even tried renaming this to OPENSSL.CNF with no success. This is the fourth community article on this and none of them are complete or seem to work. It would be NICE if Spiceworks technical support actually reviewed these or gave us instructions that WORKED on Windows Servers.

[rs51901 (RS-CP)]

@Craig9848:

Follow these steps to help you get past the openssl.cnf error:

Unable to load config info from /usr/local/ssl/openssl.cnf

[fraserpeakman7238 (fpeakman)]

Thank you Joseph6282 your instructions worked like a charm.

[stuart8776 (spike7)]

Thanks for this info; have been needing to research it.

[salmankv6843 (Salman Al Farisi)]

So now I can go with free ssl (openssl), I cam make replay after testing it, Thanks for the info.