SSL Certificates

August 2021

Prerequisites:

1. Login to namecheap for cert management
2. Login to dns made easy for dns verification method
3. Already paid cert renewal or something that Ivan does with the credit card.

Generate certificate request file that needs to be uploaded to the cert authority:

radu@ryzen:~/omnivore/certs$ openssl req -new -nodes -days 365 -keyout omnivore.com.au.key -out omnivore.com.au.csr -newkey rsa:2048

Ignoring -days; not generating a certificate

Can't load /home/radu/.rnd into RNG

140234128601536:error:2406F079:random number generator:RAND_load_file:Cannot open file:../crypto/rand/randfile.c:88:Filename=/home/radu/.rnd

Generating a RSA private key

......................+++++

........+++++

writing new private key to 'omnivore.com.au.key'

-----

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [AU]:

State or Province Name (full name) [Some-State]:New South Wales

Locality Name (eg, city) []:Sydney

Organization Name (eg, company) [Internet Widgits Pty Ltd]:City Beach Software Pty Ltd

Organizational Unit Name (eg, section) []:Omnivore

Common Name (e.g. server FQDN or YOUR name) []:*.omnivore.com.au

Email Address []:support@omnivore.com.au

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

radu@ryzen:~/omnivore/certs$ ls

namecheap-2019  namecheap-2020  omnivore.com.au.csr  omnivore.com.au.key  readme.txt

radu@ryzen:~/omnivore/certs$ ls -ltrh

total 40K

drwxrwxr-x 2 radu radu 4.0K Jun  3  2020 namecheap-2019

drwxrwxr-x 2 radu radu 4.0K Aug 30 16:30 namecheap-2020

-rw-rw-r-- 1 radu radu    0 Aug 30 16:31 readme.txt

-rw------- 1 radu radu 1.7K Aug 30 16:32 omnivore.com.au.key

-rw-rw-r-- 1 radu radu 1.1K Aug 30 16:33 omnivore.com.au.csr

Copy omnivore.com.au.csr, paste into namecheap input form.

Use cname verification method.

Use this as admin email: request@citybeachsoftware.com

Login to https://cp.dnsmadeeasy.com/ 

username: citybeach

password: gBUIDPmoNTmW

New CNAME record

Name: _180984B9C5EA02AAB39711E6713CC11F

Aliased to: 0F7792152DF521F521D136747E068C7C.F37BCD8AA48D2D04D0A8A9BB4EBDBD7B.612c7c8880ef8.comodoca.com.

After it's verified, it'll send an email "ORDER #546837548 - Your PositiveSSL Wildcard Certificate for *.omnivore.com.au"

with a zip file containing 

1. STAR_omnivore_com_au.ca-bundle

2. STAR_omnivore_cu_au.crt

Do this:

cat STAR_omnivore_com_au.crt STAR_omnivore_com_au.ca-bundle > omnivore.com.au.crt

What is needed in production:

1. omnivore.com.au.key

2. omnivore.com.au.crt

They go into:

/etc/nginx/ssl

Copy the 2 files on all the servers that run or might run nginx, ie some clusters have nginx active on the db box, some have on one of the webservers/tomcat boxes.

Restart nginx and verify that the cert shows the new expiry date at end of Sep 2022 GMT / Oct 1st 2022 AEST (depending on the browser you'll see GMT time or local time).