Skip to main content

SSL

Dev​

mkcert is a simple tool for making locally-trusted development certificates. It requires no configuration.

mkcert example.com "*.example.com" example.test localhost 127.0.0.1 ::1

VSCode Live Server

"liveServer.settings.donotVerifyTags": true,
"liveServer.settings.donotShowInfoMsg": true,
"liveServer.settings.https": {
    "enable": true, //set it true to enable the feature.
    "cert": "/Users/gonsakon/localhost.pem", //full path
    "key": "/Users/gonsakon/localhost-key.pem", //full path
}

System​

certmgr.msc

# List CA
Get-ChildItem Cert:\LocalMachine\Root

# List my CA
certutil -store my

Certbot​

Install​

# Install Ubuntu 22.04
sudo apt-get install certbot

# Install Ubuntu 20.04
sudo apt-get install letsencrypt
sudo apt-get install python3-certbot-nginx

# Remove certbot-auto and any Certbot OS packages
sudo apt-get remove certbot

snap

# Install snapd
sudo apt install snapd
sudo snap install core; sudo snap refresh core

# Install Certbot
sudo snap install --classic certbot

# Prepare the Certbot command
sudo ln -s /snap/bin/certbot /usr/bin/certbot

Config​

# Default path
/etc/letsencrypt/

# List cert
sudo certbot certificates

# Cert only, -d can support multi domains
certbot \
certonly \
--webroot \
--webroot-path /var/www/letsencrypt \
--agree-tos \
--email [email protected] \
-d domain.com -d www.domain.com -d sub.domain.com

# Response
Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/domain.com/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/domain.com/privkey.pem

# auto config for nginx
sudo certbot --nginx -d domain.com

# lists all certificates
sudo certbot certificates

# Check Certificate Name
ls /etc/letsencrypt/renewal
# If there are -0001 -0002 ... delete all and cerbot again.
# Delete
sudo certbot delete --cert-name $CERTIFICATE_NAME


# Convert the keys to PKCS12
openssl pkcs12 -export -in fullchain.pem \ 
                 -inkey privkey.pem \ 
                 -out keystore.p12 
                 -name tomcat \
                 -CAfile chain.pem \
                 -caname root

# Assume the machine that woking on is the one with running Spring Boot. The previous keystore.p12 is still in the memory, meaning that you need to restart your application! It’s not always viable to simply restart a running application.

Auto Renew​

# Check `certbot.timer` existed
systemctl list-timers

# Timer config
vi /etc/systemd/system/timers.target.wants/certbot.timer
# From Snap
vi /etc/systemd/system/timers.target.wants/snap.certbot.renew.timer

Auto reload, post hook

vi /etc/letsencrypt/renewal-hooks/post/01-restart-nginx
chmod +x /etc/letsencrypt/renewal-hooks/post/01-restart-nginx
#! /bin/sh

set -e # Exit the script if an error happens
sudo service nginx reload

Maintain​

Letsencrypt certbot auto renew not working (Debian, Ubuntu) systemd.

# Simulate
certbot renew --dry-run

# Renew timers
sudo systemctl status snap.certbot.renew.timer #snap
sudo systemctl status certbot.timer

# List all current systemd timers
systemctl list-timers --all

systemctl list-units | grep certbot.renew

find / -name certbot

# Verify that these files exist.
ls /lib/systemd/system/certbot.service
ls /lib/systemd/system/certbot.timer
ls /etc/cron.d/certbot

# Log
/var/log/letsencrypt/letsencrypt.log

Trouble Shooting​

fullchain.pem (failure)​

Challenge failed for domain domain.com.

Occurs when domain DNS directing are removed.

Remove old certificate then create new one, remember ignore removed domains.

After creation succeed, maybe show "Not secure" in web browser, clean or try another one.

Chrome "Active content with certificate errors"​

To clear this error without a restart:

  • Open developer tools
  • Go to the Application tab
  • Clear storage
  • Close and re-open tab

Commenters have pointed out the following:

  • Must close all tabs in all windows which are open to the same domain (including subdomains).
  • Uncheck "cookies" before clearing storage to preserve login information etc.

Too many failed authorizations recently​

Delete all in /etc/letsencrypt/accounts

Snakeoil​

The ssl-snakeoil.key is a key created by ssl-cert package post-install scripts. It's created for the snakeoil user and should not be deleted.

sudo apt-get install ssl-cert
sudo make-ssl-cert generate-default-snakeoil
sudo usermod --append --groups ssl-cert yyuu
ls -l /etc/ssl/certs/ssl-cert-snakeoil.pem /etc/ssl/private/ssl-cert-snakeoil.key

Concept​

Practice with OpenSSL​

1. Generate a Root Certificate​

# Generate a Private Key for the Root CA
# This creates a 2048-bit RSA private key.
openssl genrsa -out rootCA.key 2048

# Create a Self-Signed Root CA Certificate
# This will prompt you to enter some information, such as country code, organization name, etc. This command generates a self-signed certificate valid for 1024 days.
openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 1024 -out rootCA.pem

2. Create an Intermediate CA​

# Create an Intermediate CA
openssl genrsa -out intermediateCA.key 2048

# Create a Certificate Signing Request (CSR) for the Intermediate CA
# When filling in the required information, make sure at least some of it is different from the root CA, like the organization name.
openssl req -new -key intermediateCA.key -out intermediateCA.csr

# Sign the Intermediate CA CSR with the Root CA
# This signs the intermediate CA certificate with the root CA's private key.
openssl x509 -req -in intermediateCA.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out intermediateCA.crt -days 500 -sha256

3. Create an End-Entity Certificate (e.g., for a website's SSL Certificate)​

# Generate a Private Key
openssl genrsa -out server.key 2048

# Create a CSR
# Make sure the “Common Name” field is your website address when filling in the information.
openssl req -new -key server.key -out server.csr

# Sign the CSR Using the Intermediate CA
# This generates the SSL certificate for the website.
openssl x509 -req -in server.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out server.crt -days 500 -sha256

Verify

# server.crt: OK
openssl verify -CAfile rootCA.pem -untrusted intermediateCA.crt server.crt

4. Install and Use the Certificates​

Depending on your server setup (like Apache, Nginx, etc.), you need to install the generated website.crt and website.key to the appropriate location and configure the server to use these certificates to enable HTTPS.

5. Add Root CA and Intermediate CA Certificates to Trust Store​

You may need to add rootCA.pem and intermediateCA.pem to your system or browser's trust store so that they trust end-entity certificates signed by these certificates.

Note:

  • These steps are for training and learning purposes. In a real production environment, certificates issued by a trusted third-party CA should be used.
  • Ensure to keep your private keys secure and do not expose them to unauthorized individuals.
  • error 18 at 0 depth lookup:self signed certificate, don't use the same Common Name(CN)

6. Hello World​

echo "Hello World" | openssl enc -aes-256-cbc -a -salt -pbkdf2 -iter 10000 -pass pass:pa55word > doc

cat doc | openssl enc -aes-256-cbc -d -a -pbkdf2 -iter 10000 -pass pass:pa55word

Self CA​

# Linux only, windows not support process substitution `<(...)`
openssl req -x509 -out localhost.crt -keyout localhost.key \
  -newkey rsa:2048 -nodes -sha256 \
  -subj '/CN=localhost' -extensions EXT -config <( \
   printf "[dn]\nCN=localhost\n[req]\ndistinguished_name = dn\n[EXT]\nsubjectAltName=DNS:localhost\nkeyUsage=digitalSignature\nextendedKeyUsage=serverAuth")