SSL\/TLS certificates for websites and servers are just one component of a Chain of Trust, a fundamental concept to ensure the security and data integrity of online communications. It involves various elements, including certificate authorities, public and private keys, and digital signatures, to establish and verify the legitimacy of secure connections.<\/p>\n
All certificates are backed by a Certificate Authority and optional intermediary certificates as well.<\/p>\n
Creating a self-signed certificate guarantees encryption of the communication, but it does not protect against MITM (Man-In-The-Middle) attacks.<\/p>\n
By generating a Certificate Authority certificate and key, then installing the CA cert on all devices in a network, the Chain of Trust is completed.<\/p>\n
LOCAL CHAIN OF TRUST<\/strong><\/p>\n Create a CSR (Certificate Signing Request) for a FQDN or Hostname (e.g. domain.local<\/strong>):<\/p>\n Create the signed certificate for the CSR with the CA key:<\/p>\n For the FQDN \/ Hostname certificate to be trusted, the CA certificate must be installed on all hosts in the local network.<\/p>\n Add the CA certificate on Ubuntu\/Debian<\/strong>:<\/p>\n Add the CA certificate on RHEL\/CentOS<\/strong>:<\/p>\n Note:<\/strong> The first and last commands count how many CA certificates are already installed. The number should increase after the update.<\/p>\n The curl<\/strong> command and other applications should now trust certificates issued by that CA.<\/p>\n CHAIN OF TRUST FOR PURCHASED CERTIFICATE<\/strong><\/p>\n Some certificate vendors require that the full chain of trust be provided to work correctly:<\/p>\n Virtual Host configuration on Apache (or any other web server):<\/p>\n Add the CA certificate on Ubuntu\/Debian<\/strong>:<\/p>\n Add the CA certificate on RHEL\/CentOS<\/strong>:<\/p>\n CHAIN OF TRUST WITH BUNDLE CERTIFICATE<\/strong><\/p>\n To serve the same domain over the internet without issues for remote clients that do not have the CA certificate installed:<\/p>\n Optionally, both This bundle certificate provides clients with everything they need to verify the purchased certificate.<\/p>\n LAZY LOCALHOST SELF-SIGNED<\/strong><\/p>\n BONUS<\/strong><\/p>\n On Debian-based systems, this command will wipe and re-add all CA certificates:<\/p>\n If needed, clear all cached certificates:<\/p>\nopenssl genpkey -algorithm RSA -out local-ca.key\r\nchmod 400 local-ca.key\r\nopenssl req -new -x509 -key local-ca.key -out local-ca.crt<\/pre>\n
openssl req -new -key local-ca.key -out domain.local.csr<\/pre>\n
openssl x509 -req -in domain.local.csr -signkey local-ca.key -out domain.local.crt<\/pre>\n
cat \/etc\/ssl\/certs\/ca-certificates.crt | grep BEGIN | wc -l\r\nsudo mv local-ca.crt \/usr\/local\/share\/ca-certificates\/\r\nsudo update-ca-certificates\r\ncat \/etc\/ssl\/certs\/ca-certificates.crt | grep BEGIN | wc -l<\/pre>\n
cat \/etc\/ssl\/certs\/ca-certificates.crt | grep BEGIN | wc -l\r\nsudo mv local-ca.crt \/etc\/pki\/ca-trust\/source\/anchors\/\r\nsudo update-ca-trust\r\ncat \/etc\/ssl\/certs\/ca-certificates.crt | grep BEGIN | wc -l<\/pre>\n
\n\n
\n
domain.com.crt<\/code><\/span><\/li>\ndomain.com.key<\/code><\/li>\n<\/ul>\n<\/li>\n\n
CA.crt<\/code><\/li>\n<\/ul>\n<\/li>\n<\/ul>\nSSLCertificateFile \/etc\/ssl\/certs\/domain.com.crt\r\nSSLCertificateKeyFile \/etc\/ssl\/private\/domain.com.key<\/pre>\n
sudo mv CA.crt \/usr\/local\/share\/ca-certificates\/\r\nsudo update-ca-certificates<\/pre>\n
sudo mv CA.crt \/etc\/pki\/ca-trust\/source\/anchors\/\r\nsudo update-ca-trust<\/pre>\n
\nSSLCertificateFile \/etc\/ssl\/certs\/domain.com.crt\r\nSSLCertificateKeyFile \/etc\/ssl\/private\/domain.com.key\r\nSSLCACertificateFile \/etc\/ssl\/ca\/CA.crt<\/strong><\/pre>\n
.crt<\/code> files can be combined into one:<\/p>\ncat \/etc\/ssl\/certs\/domain.com.crt > \/etc\/ssl\/certs\/bundle_<\/strong>domain.com.crt\r\ncat \/etc\/ssl\/ca\/CA.crt >> \/etc\/ssl\/certs\/bundle<\/strong>_domain.com.crt<\/pre>\n
\nsudo apt install libnss3-tools mkcert -y\r\nsudo mkcert --install<\/pre>\n
\nsudo update-ca-certificates --fresh<\/pre>\n
sudo rm -rf \/etc\/ssl\/certs\/*\r\nsudo update-ca-certificates<\/pre>\n
\n