Part 11 - Configuring HTTPS (SSL)

Archive note: This page documents the January 2016 Raspbian Jessie setup. Read the compatibility and security warning in Part 1 before using any of these commands on a current system.

This was the HTTPS route I was experimenting with in January 2016: OpenSSL created a private key and certificate-signing request, with CAcert intended as the certificate authority. The walkthrough I was following is preserved here.

The surviving instructions create tim.key and tim.csr, but omit the step that produces the tim.crt used later. CAcert’s root was also not automatically trusted by mainstream browsers; clients needed to trust it separately. Let’s Encrypt had entered public beta on 3rd December 2015, just before this article, offering another historical route to publicly trusted certificates.

The command line breaks below have been restored from a 24th August 2019 capture, but that copy has the same certificate-issuance gap. This remains an incomplete record of the experiment, rather than current HTTPS deployment instructions.

You’ll need three things in the intended workflow: a .csr certificate signing request, a .crt signed certificate file and a .key private key file.

cd ~

openssl genrsa -out tim.key 4096

openssl req -new -key tim.key -out tim.csr

The signing-request command asks for these details:

Country Name (Two letter code e.g. AU)

State or Province Name (e.g. NSW)

Locality Name (e.g. Sydney)

Organisational Name (e.g. Tim's Website)

Organisational Unit Name (e.g. Website)

Common Name (Domain name *.tim.net or tim.net)

Email Address (e.g. webmaster@tim.net)

cd ~

wget http://www.cacert.org/certs/root.txt

sudo cp root.txt /etc/ssl/certs/cacert-root.crt

sudo mv tim.key /etc/ssl/private/tim.key

sudo mv tim.crt /etc/ssl/certs/tim.crt

sudo chown root:root /etc/ssl/private/tim.key

sudo chmod 600 /etc/ssl/private/tim.key

sudo chown root:root /etc/ssl/certs/tim.crt

sudo chmod 644 /etc/ssl/certs/tim.crt

Sources

Advance onward to part 12 or head back to the table of contents on page 1.