Red Hat Enterprise Linux 3: System Administration Guide
Prev | Chapter 27. Apache HTTP Secure Server Configuration | Next

# 27.8. Creating a Self-Signed Certificate

You can create your own self-signed certificate. Note that a self-signed certificate does not provide the security guarantees of a CA-signed certificate. See Section 27.5 Types of Certificates for more details about certificates.

To make your own self-signed certificate, first create a random key using the instructions provided in Section 27.6 Generating a Key. Once you have a key, make sure you are in the `/usr/share/ssl/certs` directory, and type the following command:

    make testcert

The following output is shown, and you are prompted for your passphrase (unless you generated a key without a passphrase):

    umask 77 ; \
    /usr/bin/openssl req -new -key /etc/httpd/conf/ssl.key/server.key
    -x509 -days 365 -out /etc/httpd/conf/ssl.crt/server.crt
    Using configuration from /usr/share/ssl/openssl.cnf
    Enter pass phrase:

After you enter your passphrase (or without a prompt if you created a key without a passphrase), you are asked for more information. The computer's output and a set of inputs looks like the following (provide the correct information for your organization and host):

    You are about to be asked to enter information that will be incorporated
    into your certificate request.
    What you are about to enter is what is called a Distinguished Name or a
    DN.
    There are quite a few fields but you can leave some blank
    For some fields there will be a default value,
    If you enter '.', the field will be left blank.
    -----
    Country Name (2 letter code) [GB]:US
    State or Province Name (full name) [Berkshire]:North Carolina
    Locality Name (eg, city) [Newbury]:Raleigh
    Organization Name (eg, company) [My Company Ltd]:My Company, Inc.
    Organizational Unit Name (eg, section) []:Documentation
    Common Name (your name or server's hostname) []:myhost.example.com
    Email Address []:myemail@example.com

After you provide the correct information, a self-signed certificate is created in `/etc/httpd/conf/ssl.crt/server.crt`. Restart the secure server after generating the certificate with following the command:

    /sbin/service httpd restart

Prev | Home | Next
Generating a Certificate Request to Send to a CA | Up | Testing The Certificate