Before we can start building our world-changing website or application on LEMP, we have to lay the foundation – the stack. In this hands-on lab, we will walk through the creation of self-signed SSL certificates.
Completing this lab will provide have a good understanding of how to create SSL certificates using OpenSSL on Ubuntu Linux.
Learning Objectives
Successfully complete this lab by achieving the following learning objectives:
- Create a Certificate Authority Private Key and Certificate
Become
root:sudo su -Create a directory to store our certificates:
mkdir -p /etc/nginx/certificatescd /etc/nginx/certificatesGenerate a private key for the CA:
openssl genrsa 2048 > ca-key.pemGenerate the X509 certificate for the CA. For this step, just hit Enter for all the questions and use the default answers:
openssl req -new -x509 -nodes -days 365000 -key ca-key.pem -out ca-cert.pem- Create a Private Key for the NGINX Server
Generate a private key and create a certificate request for the NGINX server:
openssl req -newkey rsa:2048 -days 365000 -nodes -keyout server-key.pem -out server-req.pemWe will have to answer some questions.
Process the key to remove the passphrase:
openssl rsa -in server-key.pem -out server-key.pemWe should see the following:
writing RSA key- Create a Self-Signed Certificate for the NGINX Server
Generate a self-signed X509 certificate for the NGINX server:
openssl x509 -req -in server-req.pem -days 365000 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 -out server-cert.pemWe now have self-signed X509 certificates for the NGINX server in the
/etc/nginx/certificatesdirectory.We need to allow the
nginxuser access to the certificates. Add read permission for group and other:chmod 644 *- Verify the Self-Signed Certificate for the NGINX Server
Let’s use the
openssl verifycommand to verify that the X509 certificate was correctly generated:openssl verify -CAfile ca-cert.pem server-cert.pemWe should see the following:
server-cert.pem: OK
