Linux self signed cert with openssl and import into Chrome
Budget: $30 – $250 CAD
Hello !
I need someone to guide me through the command line to complete this task.
You will not have access to the VM.
I have an isolated VM on a LAN which only has a common name and no external DNS entries. It uses OpenLiteSpeed as a web server and I need to create a self signed certificate so that the web server can use it, and finally, import it into Chrome so that the red warning disappears whenever I access it. I know how to configure the web server and import the SSL into Chrome and I was able to make the whole thing work once but now it doesn't work anymore. I undid something somewhere and now I am stuck and have limited time. I am on Rocky Linux 8 (same as Red Hat).
Tasks involved:
- Correct the steps outlined below so that I can replicate and apply by my side
1- [GENERATE AND SIGN CERTIFICATE]
% cd /usr/local/lsws
Generate an RSA private key of size 2048:
% openssl genrsa -des3 -out rootCA.key 2048
Generate a root certificate:
% openssl req -x509 -new -nodes -key rootCA.key -sha256 -out rootCA.pem
To check just created root certificate:
% openssl x509 -in rootCA.pem -text -noout
Create a private key to be used during the certificate signing process:
% openssl genrsa -out tls.key 2048
Use the private key to create a certificate signing request:
% openssl req -new -key tls.key -out tls.csr
Create a config file:
% vi v3.ext
# Extensions to add to a certificate request
basicConstraints = CA:FALSE
authorityKeyIdentifier = keyid:always, issuer:always
keyUsage = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment
subjectAltName = @alt_names
[ alt_names ]
DNS.1 = <domain name>
Sign the CSR using v3.ext:
% openssl x509 -req -in tls.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out tls.crt -sha256 -extfile v3.ext
Verify that the certificate is built correctly:
% openssl verify -CAfile rootCA.pem -verify_hostname <domain name> tls.crt
Set permissions:
% chmod 600 rootCA*
% chmod 600 tls*
% chmod 600 v3.ext
2- [RELOAD WEB SITE TO RELOAD THE SSL CERTIFICATE]
It references:
Private Key File /usr/local/lsws/tls.key
Certificate File /usr/local/lsws/tls.crt
3- [IMPORT CERTIFICATE INTO CHROME]
ref: https://www.pico.net/kb/how-do-you-get-chrome-to-accept-a-self-signed-certificate/
I need someone to guide me through the command line to complete this task.
You will not have access to the VM.
I have an isolated VM on a LAN which only has a common name and no external DNS entries. It uses OpenLiteSpeed as a web server and I need to create a self signed certificate so that the web server can use it, and finally, import it into Chrome so that the red warning disappears whenever I access it. I know how to configure the web server and import the SSL into Chrome and I was able to make the whole thing work once but now it doesn't work anymore. I undid something somewhere and now I am stuck and have limited time. I am on Rocky Linux 8 (same as Red Hat).
Tasks involved:
- Correct the steps outlined below so that I can replicate and apply by my side
1- [GENERATE AND SIGN CERTIFICATE]
% cd /usr/local/lsws
Generate an RSA private key of size 2048:
% openssl genrsa -des3 -out rootCA.key 2048
Generate a root certificate:
% openssl req -x509 -new -nodes -key rootCA.key -sha256 -out rootCA.pem
To check just created root certificate:
% openssl x509 -in rootCA.pem -text -noout
Create a private key to be used during the certificate signing process:
% openssl genrsa -out tls.key 2048
Use the private key to create a certificate signing request:
% openssl req -new -key tls.key -out tls.csr
Create a config file:
% vi v3.ext
# Extensions to add to a certificate request
basicConstraints = CA:FALSE
authorityKeyIdentifier = keyid:always, issuer:always
keyUsage = nonRepudiation, digitalSignature, keyEncipherment, dataEncipherment
subjectAltName = @alt_names
[ alt_names ]
DNS.1 = <domain name>
Sign the CSR using v3.ext:
% openssl x509 -req -in tls.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out tls.crt -sha256 -extfile v3.ext
Verify that the certificate is built correctly:
% openssl verify -CAfile rootCA.pem -verify_hostname <domain name> tls.crt
Set permissions:
% chmod 600 rootCA*
% chmod 600 tls*
% chmod 600 v3.ext
2- [RELOAD WEB SITE TO RELOAD THE SSL CERTIFICATE]
It references:
Private Key File /usr/local/lsws/tls.key
Certificate File /usr/local/lsws/tls.crt
3- [IMPORT CERTIFICATE INTO CHROME]
ref: https://www.pico.net/kb/how-do-you-get-chrome-to-accept-a-self-signed-certificate/