Infrastructure/infra-docs-fpo
1
0
Fork 0
Code Issues 100 Pull requests 6 Projects Releases Packages Wiki Activity Actions

Add guide how to renew a SSL certificate for fedora service

Browse source 
This renames making-ssl-certificates to ssl-certificates.

Signed-off-by: Michal Konecny <mkonecny@redhat.com>
This commit is contained in:
Michal Konecny 2023-11-01 14:21:15 +01:00
parent a06af07957
commit 503a288196
2 changed files with 26 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

53
modules/sysadmin_guide/pages/making-ssl-certificates.adoc
View file

@ -1,53 +0,0 @@
= SSL Certificate Creation SOP
Every now and then you will need to create an SSL certificate for a
Fedora Service.
== Creating a CSR for a new server
Know your hostname, ie _lists.fedoraproject.org_:
....
export ssl_name=<fqdn of host>
....
Create the cert. 8192 does not work with various boxes so we use 4096
currently.
....
openssl genrsa -out ${ssl_name}.pem 4096
openssl req -new -key ${ssl_name}.pem -out $(ssl_name}.csr
Country Name (2 letter code) [XX]:US
State or Province Name (full name) []:NM
Locality Name (eg, city) [Default City]:Raleigh
Organization Name (eg, company) [Default Company Ltd]:Red Hat
Organizational Unit Name (eg, section) []:Fedora Project
Common Name (eg, your name or your server's hostname)
[]:lists.fedorahosted.org
Email Address []:admin@fedoraproject.org
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
....
send the CSR to the signing authority and wait for a cert. place all
three into private directory so that you can make certs in the future.
== Creating a temporary self-signed certificate
Repeat the steps above but add in the following:
....
openssl x509 -req -days 30 -in ${ssl_name}.csr -signkey ${ssl_name}.pem -out ${ssl_name}.cert
Signature ok
subject=/C=US/ST=NM/L=Raleigh/O=Red Hat/OU=Fedora
Project/CN=lists.fedorahosted.org/emailAddress=admin@fedoraproject.org
....
Getting Private key
We only want a self-signed certificate to be good for a short time so 30
days sounds good.