Code, Docs & Tools
Apache: how to create a self-signed SSL certificate
Introduction
If you need to protect a website with an SSL certificate but you don't want to buy one, you can create your own self-signed certificate using openssl.
Self-signed certificates give you the same protection than the regular ones. The problem is that browsers won't recognize who has generated it, and so they will show an alert saying the certificate is not trusted.
For test environments or internal usage, this would be perfectly safe.
Note:
• See how to create a multi-domain SSL certificate
How to create the self-signed SSL certificate
To create the self-signed SSL certificate you need the openssl libraries and application on your PC.
The certificate can be created with the following command:
$ openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout mysitename.key -out mysitename.crt
You'll have to enter the certificate details.
This is an example of the full process (in bold the data you have to enter):
$ openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout example.com.key -out example.com.crt
Generating a 2048 bit RSA private key
....................................................................+++
.................................................................................................................+++
writing new private key to 'example.com.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:GB
State or Province Name (full name) [Some-State]:England
Locality Name (eg, city) []:London
Organization Name (eg, company) [Internet Widgits Pty Ltd]:WizLab
Organizational Unit Name (eg, section) []:IT
Common Name (e.g. server FQDN or YOUR name) []:www.example.com
Email Address []:john@example.com
In the above example, a certificate for www.example.com is created. The certificate is composed by two files: example.com.crt is the certificate, and example.com.key is the key.
Apache configuration
The last step is the virtual host configuration on Apache:
<VirtualHost 1.2.3.4:443>
ServerName www.example.com
DocumentRoot /www
ErrorLog logs/www.example.com-error.log
CustomLog logs/www.example.com-access.log combined
SSLEngine on
SSLCertificateFile certs/example.com.crt
SSLCertificateKeyFile certs/example.com.key
</VirtualHost>
You can finally restart Apache to make the changes effective.