Hello Everyone I need to create the key for my secure server I am just starting out with SSL so do not want to pay verisign yet later yes but now right now I am reading a decent webpage that tells you how to do it but there is a few paragraphs that I dont understand Here is the website.
**********begin paste* How can I create and use my own Certificate Authority (CA)? [L] The short answer is to use the CA.sh or CA.pl script provided by OpenSSL. The long and manual answer is this: Create a RSA private key for your CA (will be Triple-DES encrypted and PEM formatted): $ openssl genrsa -des3 -out ca.key 1024 Please backup this ca.key file and remember the pass-phrase you currently entered at a secure location. You can see the details of this RSA private key via the command $ openssl rsa -noout -text -in ca.key And you can create a decrypted PEM version (not recommended) of this private key via: $ openssl rsa -in ca.key -out ca.key.unsecure Create a self-signed CA Certificate (X509 structure) with the RSA key of the CA (output will be PEM formatted): $ openssl req -new -x509 -days 365 -key ca.key -out ca.crt You can see the details of this Certificate via the command: $ openssl x509 -noout -text -in ca.crt Prepare a script for signing which is needed because the ``openssl ca'' command has some strange requirements and the default OpenSSL config doesn't allow one easily to use ``openssl ca'' directly. So a script named sign.sh is distributed with the mod_ssl distribution (subdir pkg.contrib/). Use this script for signing. Now you can use this CA to sign server CSR's in order to create real SSL Certificates for use inside an Apache webserver (assuming you already have a server.csr at hand): $ ./sign.sh server.csr This signs the server CSR and results in a server.crt file. *************end paste********* I dont understand what they meen about preparing a script for signing. can someone help me created my first certificates thank you so much. Luc --------------------------------------------------------- This message sent using EMUmail -- http://www.emumail.com --------------------------------------------------------- Jumping through hoops to get E-mail on the road? You've got two choices: Join the circus, or use MollyMail. Molly Mail -- http://www.mollymail.com ______________________________________________________________________ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
