In this post I will explain how to create a self-signed certificate for testing purposes.\u00a0 If you have a virtual machine running on your home network (such as inside VirtualBox, Hyper-V, or inside Windows Subsystem for Linux), it will not be able to get a Certificate Authority (CA) signed SSL certificate because it isn’t accessible on a static IP address attached to a domain name.\u00a0 However, you may still want to set it up as if it was a public facing server in order to test out a configuration, e.g. Postfix, GitLab.<\/p>\n
You must have\u00a0openssl<\/strong>\u00a0installed.\u00a0 This will be installed on any Linux machine, but under Windows, binaries can be hard to come by.\u00a0 I recommend installing the excellent development environment MSYS2, and installing it by opening up an MSYS2 window and typing:<\/p>\n Once it’s installed, you’ll be creating a private key, a certificate request, and then you’ll sign the request with the private key to create a public certificate. You can use any names you want for the files, but I have chosen to replicate what Let’s Encrypt gives you by default.<\/p>\n Generate the private key<\/p>\n Generating RSA private key, 2048 bit long modulus Generate the certificate request <\/p>\n Generate the certificate by signing the certificate request with the private key<\/p>\n <\/p>\n Now move them to a standard spot for certificates.<\/p>\n You may now reference them in software that uses certificates such as Apache, Nginx, or Node.js apps. You will still get a warning saying that the certificate is invalid, but the data sent will be encrypted.<\/p>\n","protected":false},"excerpt":{"rendered":" In this post I will explain how to create a self-signed certificate for testing purposes.\u00a0 If you have a virtual machine running on your home network (such as inside VirtualBox, Hyper-V, or inside Windows Subsystem for Linux), it will not be able to get a Certificate Authority (CA) signed SSL certificate because it isn’t accessible … <\/p>\npacman -S openssl<\/pre>\n
sudo openssl genrsa -out "privkey.pem" 2048<\/pre>\n
\n…..+++++
\n…+++++
\ne is 65537 (0x10001)<\/p>\n
\nYou’ll be entering in some information here. The important one is the Common Name. Although you don’t have a real domain, it’s a good idea to make up one for your private network. I have seen people use the .lcl extension for it. Do not enter anything for the challenge password.<\/p>\nsudo openssl req -new -key "privkey.pem" -out "certrequest.pem"<\/pre>\n
You are about to be asked to enter information that will be incorporated\r\ninto your certificate request.\r\nWhat you are about to enter is what is called a Distinguished Name or a DN.\r\nThere are quite a few fields but you can leave some blank\r\nFor some fields there will be a default value,\r\nIf you enter '.', the field will be left blank.\r\n-----\r\nCountry Name (2 letter code) [AU]:US<\/strong>\r\nState or Province Name (full name) [Some-State]:New Mexico<\/strong>\r\nLocality Name (eg, city) []:Albuquerque\r\nOrganization Name (eg, company) [Internet Widgits Pty Ltd]:.<\/strong>\r\nOrganizational Unit Name (eg, section) []:.<\/strong>\r\nCommon Name (e.g. server FQDN or YOUR name) []:*.example.lcl<\/strong>\r\nEmail Address []:john.doe@example.lcl<\/strong>\r\n\r\nPlease enter the following 'extra' attributes\r\nto be sent with your certificate request\r\nA challenge password []:\r\nAn optional company name []:<\/pre>\n
sudo openssl x509 -req -days 30 -in "certrequest.pem" -signkey "privkey.pem" -out "cert.pem"<\/pre>\n
Signature ok\r\nsubject=C = US, ST = New Mexico, L = Albuquerque, CN = *.example.lcl, emailAddress = john.doe@example.lcl\r\nGetting Private key<\/pre>\n
\r\nsudo chmod 644 cert.pem\r\nsudo chmod 644 certrequest.pem\r\nsudo chmod 640 privkey.pem\r\nsudo mv cert.pem \/etc\/ssl\/certs\r\nsudo mv certrequest.pem \/etc\/ssl\/certs\r\nsudo mv privkey.pem \/etc\/ssl\/private\r\n<\/pre>\n