{"id":547,"date":"2010-04-19T01:14:03","date_gmt":"2010-04-19T06:14:03","guid":{"rendered":"http:\/\/yourLinuxGuy.com\/?p=547"},"modified":"2010-04-24T07:43:11","modified_gmt":"2010-04-24T12:43:11","slug":"how-can-i-renew-my-centosapache-ssl-certificate","status":"publish","type":"post","link":"https:\/\/yourLinuxGuy.com\/?p=547","title":{"rendered":"How can I renew my Centos\/Apache SSL certificate?"},"content":{"rendered":"

I got this question the other day from a Centos administrator: “The certwatch<\/code> tool has been sending the me an email warning me that I need to renew the SSL Certificate. What do I do<\/em>?”<\/p>\n

The email message read like the following (names have been changed):<\/p>\n

################# SSL Certificate Warning ################<\/code><\/p>\n

Certificate for hostname 'www.yourlinuxguy.com', in file:
\n\/etc\/pki\/tls\/certs\/www.yourlinuxguy.com.cert
\n<\/code>
\nThe certificate needs to be renewed; this can be done
\nusing the 'genkey' program.<\/code><\/p>\n

Browsers will not be able to correctly connect to this
\nweb site using SSL until the certificate is renewed.
\n<\/code>
\n##########################################################
\nGenerated by certwatch(1)<\/code><\/p>\n

The administrator had searched the Internet, and found mostly impolite\u00a0messages from youngsters about reading the docs. Accurate, perhaps, but not too helpful.\u00a0 This person’s server was not using a public Certificate Authority (CA); just a local one on the box itself (as is common practice in development environments).\u00a0 If you don’t understand all that, it will make more sense as we go on…<\/p>\n

First I want to clarify a couple things.\u00a0 When you run the genkey<\/code> tool, you are actually doing what the name suggests;\u00a0 generating a new key pair (public\/private), from which the certificate is formulated.\u00a0 Technically, you are not *renewing* the certificate as the certwatch<\/code> warning message implies, but that’s okay (it *is* possible in some situations to “renew” a certificate based on an existing key pair, but that’s not important right now). The genkey<\/code> tool makes it so easy and convenient that it is just easier this way. Remember that a certificate is nothing but a public key that is “stamped” with approval by a CA.\u00a0 In this case, the CA is you, too.\u00a0 Not exactly a trusted hierarchy, but there you go…<\/p>\n

So to cut to the chase, it’s really easy.\u00a0 Here’s basically what you need to do:\u00a0 1.) run the tool, and\u00a0 2.) validate your SSL settings in your httpd.conf<\/code>.<\/p>\n

Run The Tool<\/strong><\/p>\n

At this point, you may or may not want to make a backup of your cert files…\u00a0 This is up to you…\u00a0 You can do that with something like this command (of course, your mileage may vary):<\/p>\n

cp -av \/etc\/pki\/tls \/etc\/pki\/tls.bak<\/code><\/p>\n

If you just run the genkey<\/code> tool without specifying the certificate lifetime, it defaults to something like 30 days.\u00a0 Let’s try something a little longer; like 4 years.\u00a0 Now just specify your hostname on the command line:<\/p>\n

genkey --days 1460 www.yourlinuxguy.com<\/code><\/p>\n

…this will launch an interactive tool to do things like generate the random data, make the key pair, and walk you through specifying the content of the certificate (Country, Location, etc.).\u00a0 It will place the new stuff in some default location, and at the end of the process, tell you where it all is.\u00a0 You should take note of the location, but it will likely be what I mentioned above for the backup.<\/p>\n

Validate Your SSL Settings<\/strong><\/p>\n

Now, theoretically, you should be able to restart your Apache daemon.\u00a0 However, you might have used custom names or locations for your certificate files in the past, so you might want to check to be sure they match the SSL settings in your Apache config files.\u00a0 Of course it’s hard for me to tell you where those settings are, since it’s so easy to customize Apache; but here’s a good way to find the two most important values:<\/p>\n

cd \/etc\/httpd
\negrep -R -e \"SSLCertificateKeyFile\" -e \"SSLCertificateFile\" *<\/code><\/p>\n

…and that will likely return results from a file called “ssl.conf<\/code>” or something like that.\u00a0 Edit the config file if necessary; just make sure the values match the place that the genkey<\/code> tool placed the new private key and cert file, and you should be good.<\/p>\n

Now, you can restart Apache…<\/p>\n

\/etc\/init.d\/httpd restart<\/code><\/p>\n

…and you’re done!\u00a0 I hope that helps…<\/p>\n

\ud83d\ude42<\/p>\n","protected":false},"excerpt":{"rendered":"

I got this question the other day from a Centos administrator: “The certwatch tool has been sending the me an email warning me that I need to renew the SSL Certificate. What do I do?” The email message read like…
Read more<\/a><\/p>\n","protected":false},"author":5,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[44,54,11,45],"tags":[],"class_list":["post-547","post","type-post","status-publish","format-standard","hentry","category-apache","category-centos","category-intermediate","category-openssl"],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/pnjn1-8P","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/yourLinuxGuy.com\/index.php?rest_route=\/wp\/v2\/posts\/547","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/yourLinuxGuy.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/yourLinuxGuy.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/yourLinuxGuy.com\/index.php?rest_route=\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/yourLinuxGuy.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=547"}],"version-history":[{"count":8,"href":"https:\/\/yourLinuxGuy.com\/index.php?rest_route=\/wp\/v2\/posts\/547\/revisions"}],"predecessor-version":[{"id":555,"href":"https:\/\/yourLinuxGuy.com\/index.php?rest_route=\/wp\/v2\/posts\/547\/revisions\/555"}],"wp:attachment":[{"href":"https:\/\/yourLinuxGuy.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=547"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/yourLinuxGuy.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=547"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/yourLinuxGuy.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=547"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}