How to generate a web server certificate for signing with StartSSL | MaxVT's Home On The Net

How to generate a web server certificate for signing with StartSSL

A lot of advice on the web is outdated. There are three critical points that might be out of date or wrong:

  • Use 2048 bit key length. 1024 bit length is no longer considered secure, but if your server software is old enough, it might still be the default setting.

  • Use SHA-256 hash. The default is the older SHA1, which is being phased out since it is considered less secure. Apparently, by choosing SHA-256, you will lose compatibility with Windows XP and Windows Server 2003. Hopefully you do not run those anymore and therefore don’t care.

  • Create a CSR (certificate signing request), not a self-signed certificate. A lot of advice on self-signed certificates was written when SSL certs were expensive. Today, SSL is free (with some limitations), for example with StartSSL. There is no excuse for using self signed certs anymore.

openssl req -new -newkey rsa:2048 -days 365 -nodes -sha256 -out your_key_name.csr -subj "/C=US/ST=California/L=/O=example.com/CN=server.example.com" -keyout your_private_key_name.pem

Replace country, state, org, common name (server name, in this case) as appropriate. digicert has a nice form to generate the subject of the certificate for you; it would be great if they used SHA-256 by default too, but oh well.

This certificate will expire in a year. I don’t mind doing this once a year, and StartSSL will only sign a free certificate for one year.

The first thing you should do is set the private key (your_private_key_name.pem) to be owned by root and remove access by anyone except root.

Look at the resulting csr file. If it starts with -----BEGIN CERTIFICATE REQUEST-----, you’re good. Copy the contents, skip the “form” step in StartSSL, paste the CSR, click a few more Next buttons, download your shiny new modern and signed certificate. Careful, it’s still hot.