Skip to main content

Setting Up SSL Certificate

Nowadays, an SSL certificate which is usually used for HTTPS connections become pretty important. Even Google starts to give a ranking boost to secure HTTPS/SSL sites. There are several cheap certificates that you can buy like Comodo PositiveSSL. I usually buy cheap certificates from Namecheap.com which provides SSL certificates as low as $4/year. After you buy the certificate, you need to set up your server. Here are the steps to set up an SSL certificate on your server.

1. Purchase the certificate
You can buy the certificate from Namecheap.com. After you buy it, you need to activate your certificate by providing your generated CSR file.

2. Generate private key and CSR file
In a Linux server, you can run the following command on the terminal to generate a private key and CSR file.

$ openssl req -new -newkey rsa:2048 -nodes -keyout mydomain.com.key -out mydoain.com.csr 

When you run the command, you will be asked for Country ID, domain name, registrant email, etc. For the domain name, you have to fill it with a valid domain name that will use the certificate. For the registrant email, it is better if you use your domain email account e.g. yourname@yourdomain.com.
After you run the command, there will be mydomain.com.key (private key) and mydomain.com.csr (CSR) in your current directory.

3. Activate your certificate
Go to your purchase lists and choose to activate your certificate. Copy contents of your CSR file then paste it on provided CSR box on the website. The system will generate some certificate files. You can choose to get the certificate files by email. For Comodo certificate, you will get four files including AddTrustExternalCARoot.crt (Root CA), COMODORSAAddTrustCA.crt (Intermediate CA), COMODORSADomainValidationSecureServerCA.crt (Intermediate CA), and www_mydomain_com.crt (SSL certificate).

4. Install SSL certificate
Copy all certificate files to your server. To make your SSL certificate fully works for your domain, you need to combine the CA certificate into a single certificate. If you access your domain only from a browser, it's not necessary to combine the certificates. If you want to make your SSL secured domain can be accessed by any services, you should combine the certificates. The order of combination files should be right as the following command.

$ cat www_mydomain_com.crt COMODORSADomainValidationSecureServerCA.crt COMODORSAAddTrustCA.crt AddTrustExternalCARoot.crt > mydomain.com.crt

After running the command, mydomain.com.crt will contain an SSL certificate and all CA certificates. You must keep your private key and SSL certificate secure by setting up read and write permission only for root and no permission for others.
To implement the certificate into a server application, you need to set appropriate configuration for the application. For example:
Nginx

server {
    listen 443;
    ssl on;
    ssl_certificate /path/to/ssl/mydomain/mydomain.com.crt;
    ssl_certificate_key /path/to/ssl/mydomain/mydomain.com.key;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ...
}

Gitlab Community Edition
For the Gitlab server, by default, you should store the certificate in "/etc/gitlab/ssl/" with a valid domain name for the file name. If your domain name in "/etc/hostname" is "server.mydomain.com", your private key or your SSL certificate should be named "server.mydomain.com.<key/crt>". It's because the "#{node['fqdn']}" configuration variable will be translated into your hostname.

nginx['ssl_certificate'] = "/etc/gitlab/ssl/#{node['fqdn']}.crt"
nginx['ssl_certificate_key'] = "/etc/gitlab/ssl/#{node['fqdn']}.key"

5. Additional step
Some server applications need a CA certificate bundle to perform an SSL connection. You can generate a CA bundle by performing the last command without an SSL certificate. The order of combination files should be right too.

$ cat COMODORSADomainValidationSecureServerCA.crt COMODORSAAddTrustCA.crt AddTrustExternalCARoot.crt > ca-bundle.crt

Comments

  1. Hey what a brilliant post I have come across and believe me I have been searching out for this similar kind of post for past a week and hardly came across this. Thank you very much and will look for more postings from you Get for more information buy certificate

    ReplyDelete
  2. Thanks for publishing such best knowledge with us. You are doing such a great job. This info is very helpful for everyone. Keep it up. Thanks.Read more info about approval certification

    ReplyDelete

Post a Comment

Popular posts from this blog

Configuring Swap Memory on Ubuntu Using Ansible

If we maintain a Linux machine with a low memory capacity while we are required to run an application with high memory consumption, enabling swap memory is an option. Ansible can be utilized as a helper tool to automate the creation of swap memory. A swap file can be allocated in the available storage of the machine. The swap file then can be assigned as a swap memory. Firstly, we should prepare the inventory file. The following snippet is an example, you must provide your own configuration. [server] 192.168.1.2 [server:vars] ansible_user=root ansible_ssh_private_key_file=~/.ssh/id_rsa Secondly, we need to prepare the task file that contains not only the tasks but also some variables and connection information. For instance, we set /swapfile  as the name of our swap file. We also set the swap memory size to 2GB and the swappiness level to 60. - hosts: server become: true vars: swap_vars: size: 2G swappiness: 60 For simplicity, we only check the...

Rangkaian Sensor Infrared dengan Photo Dioda

Keunggulan photodioda dibandingkan LDR adalah photodioda lebih tidak rentan terhadap noise karena hanya menerima sinar infrared, sedangkan LDR menerima seluruh cahaya yang ada termasuk infrared. Rangkaian yang akan kita gunakan adalah seperti gambar di bawah ini. Pada saat intensitas Infrared yang diterima Photodiode besar maka tahanan Photodiode menjadi kecil, sedangkan jika intensitas Infrared yang diterima Photodiode kecil maka tahanan yang dimiliki photodiode besar. Jika  tahanan photodiode kecil  maka tegangan  V- akan kecil . Misal tahanan photodiode mengecil menjadi 10kOhm. Maka dengan teorema pembagi tegangan: V- = Rrx/(Rrx + R2) x Vcc V- = 10 / (10+10) x Vcc V- = (1/2) x 5 Volt V- = 2.5 Volt Sedangkan jika  tahanan photodiode besar  maka tegangan  V- akan besar  (mendekati nilai Vcc). Misal tahanan photodiode menjadi 150kOhm. Maka dengan teorema pembagi tegangan: V- = Rrx/(Rrx + R2) x Vcc V- = 150 / (1...

Deploying a Web Server on UpCloud using Terraform Modules

In my earlier post , I shared an example of deploying UpCloud infrastructure using Terraform from scratch. In this post, I want to share how to deploy the infrastructure using available Terraform modules to speed up the set-up process, especially for common use cases like preparing a web server. For instance, our need is to deploy a website with some conditions as follows. The website can be accessed through HTTPS. If the request is HTTP, it will be redirected to HTTPS. There are 2 domains, web1.yourdomain.com and web2.yourdomain.com . But, users should be redirected to "web2" if they are visiting "web1". There are 4 main modules that we need to set up the environment. Private network. It allows the load balancer to connect with the server and pass the traffic. Server. It is used to host the website. Load balancer. It includes backend and frontend configuration. Dynamic certificate. It is requ...

Configure Gitlab SMTP Setting

Gitlab CE or EE is shipped with the capability to send messages through SMTP service as the basic feature to send notifications or updates to the users. The configuration parameters are available in /etc/gitlab/gitlab.rb . Each SMTP service provider has a different configuration, therefore the Gitlab configuration parameters should be adjusted according to the requirements. Some examples have been provided by Gitlab here . This is an example if you use the Zoho service. gitlab_rails['smtp_enable'] = true gitlab_rails['smtp_address'] = "smtp.zoho.com" gitlab_rails['smtp_port'] = 587 gitlab_rails['smtp_authentication'] = "plain" gitlab_rails['smtp_enable_starttls_auto'] = true gitlab_rails['smtp_user_name'] = "gitlab@mydomain.com" gitlab_rails['smtp_password'] = "mypassword" gitlab_rails['smtp_domain'] = "smtp.zoho.com" This is another example of using Amazon SES w...

API Gateway Using KrakenD

The increasing demands of users for high-quality web services create the need to integrate various technologies into our application. This will cause the code base to grow larger, making maintenance more difficult over time. A microservices approach offers a solution, where the application is built by combining multiple smaller services, each with a distinct function. For example, one service handles authentication, another manages business functions, another maintains file uploads, and so on. These services communicate and integrate through a common channel. On the client side, users don't need to understand how the application is built or how it functions internally. They simply send a request to a single endpoint, and processes like authentication, caching, or database querying happen seamlessly. This is where an API gateway is effective. It handles user requests and directs them to the appropriate handler. There are several tools available for building an API gateway, su...

Running CI/CD Pipeline with GitLab CI

GitLab allows us to deploy CI/CD pipeline runners on our own resources within our environment. This option is available not only for the self-hosted plan but also for the cloud service plan (gitlab.com). With this setup, unlike GitHub Action, we can avoid incurring additional costs for extended pipeline runtime. This is because we can deploy the runner on an on-demand server and optimize its usage. GitLab CI offers several options for setting up resources to run CI/CD pipelines. A runner can be configured to handle jobs for specific groups or projects using designated tags. It can also be set to use different executors, such as Shell, Docker, Kubernetes, or VirtualBox. A comparison table of the supported executors is available in the executor documentation . Some executors offer greater flexibility and ease of use, while others may be more rigid but enhance server security. Installing the runner in our machine For example, we will deploy the runner on an Ubuntu serve...