Ubuntu

14.04

### Introduction

**TLS**, or transport layer security, and its predecessor **SSL**, secure sockets layer, are secure protocols created in order to place normal traffic in a protected, encrypted wrapper.

These protocols allow traffic to be sent safely between remote parties without the possibility of the traffic being intercepted and read by someone in the middle.  They are also instrumental in validating the identity of domains and servers throughout the internet by establishing a server as trusted and genuine by a certificate authority.

In this guide, we'll cover how to create a **self-signed SSL certificate** for Apache on an Ubuntu 14.04 server, which will allow you to encrypt traffic to your server.  While this does not provide the benefit of third party validation of your server's identity, it fulfills the requirements of those simply wanting to transfer information securely.

<$>[note]
**Note:** You may want to consider using Let's Encrypt instead of a self-signed certificate. Let's Encrypt is a new certificate authority that issues free SSL/TLS certificates that are trusted in most web browsers. Check out the tutorial to get started: [How To Secure Apache with Let's Encrypt on Ubuntu 14.04](https://www.digitalocean.com/community/tutorials/how-to-secure-apache-with-let-s-encrypt-on-ubuntu-14-04)
<$>

## Prerequisites

Before you begin, you should have some configuration already taken care of.

We will be operating as a non-root user with sudo privileges in this guide.  You can set one up by following steps 1-4 in our [Ubuntu 14.04 initial server setup guide](https://www.digitalocean.com/community/articles/initial-server-setup-with-ubuntu-14-04).

You are also going to need to have Apache installed.  If you don't already have that up and running, you can quickly fix that by typing:

    sudo apt-get update
    sudo apt-get install apache2

## Step One — Activate the SSL Module

SSL support actually comes standard in the Ubuntu 14.04 Apache package.  We simply need to enable it to take advantage of SSL on our system.

Enable the module by typing:

    sudo a2enmod ssl

After you have enabled SSL, you'll have to restart the web server for the change to be recognized:

    sudo service apache2 restart

With that, our web server is now able to handle SSL if we configure it to do so.

## Step Two — Create a Self-Signed SSL Certificate

Let's start off by creating a subdirectory within Apache's configuration hierarchy to place the certificate files that we will be making:

    sudo mkdir /etc/apache2/ssl

Now that we have a location to place our key and certificate, we can create them both in one step by typing:

    sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/apache2/ssl/apache.key -out /etc/apache2/ssl/apache.crt

Let's go over exactly what this means.

* **openssl**: This is the basic command line tool provided by OpenSSL to create and manage certificates, keys, signing requests, etc.
* **req**: This specifies a subcommand for X.509 certificate signing request (CSR) management.  X.509 is a public key infrastructure standard that SSL adheres to for its key and certificate managment.  Since we are wanting to *create* a new X.509 certificate, this is what we want.
* **-x509**: This option specifies that we want to make a self-signed certificate file instead of generating a certificate request.
* **-nodes**: This option tells OpenSSL that we do not wish to secure our key file with a passphrase.  Having a password protected key file would get in the way of Apache starting automatically as we would have to enter the password every time the service restarts.
* **-days 365**: This specifies that the certificate we are creating will be valid for one year.
* **-newkey rsa:2048**: This option will create the certificate request and a new private key at the same time.  This is necessary since we didn't create a private key in advance.  The `rsa:2048` tells OpenSSL to generate an RSA key that is 2048 bits long.
* **-keyout**: This parameter names the output file for the private key file that is being created.
* **-out**: This option names the output file for the certificate that we are generating.

When you hit "ENTER", you will be asked a number of questions.

The most important item that is requested is the line that reads "Common Name (e.g. server FQDN or YOUR name)".  You should enter the domain name you want to associate with the certificate, or the server's public IP address if you do not have a domain name.

The questions portion looks something like this:

<pre>
Country Name (2 letter code) [AU]:<span class="highlight">US</span>
State or Province Name (full name) [Some-State]:<span class="highlight">New York</span>
Locality Name (eg, city) []:<span class="highlight">New York City</span>
Organization Name (eg, company) [Internet Widgits Pty Ltd]:<span class="highlight">Your Company</span>
Organizational Unit Name (eg, section) []:<span class="highlight">Department of Kittens</span>
Common Name (e.g. server FQDN or YOUR name) []:<span class="highlight">your_domain.com</span>
Email Address []:<span class="highlight">your_email@domain.com</span>
</pre>

The key and certificate will be created and placed in your `/etc/apache2/ssl` directory.

## Step Three — Configure Apache to Use SSL

Now that we have our certificate and key available, we can configure Apache to use these files in a virtual host file.  You can learn more about [how to set up Apache virtual hosts](https://www.digitalocean.com/community/articles/how-to-set-up-apache-virtual-hosts-on-ubuntu-14-04-lts) here.

Instead of basing our configuration file off of the `000-default.conf` file in the `sites-available` subdirectory, we're going to base this configuration on the `default-ssl.conf` file that contains some default SSL configuration.

Open the file with root privileges now:

    sudo nano /etc/apache2/sites-available/default-ssl.conf

With the comments removed, the file looks something like this:

<pre>
&lt;IfModule mod_ssl.c&gt;
    &lt;VirtualHost _default_:443&gt;
        ServerAdmin webmaster@localhost
        DocumentRoot /var/www/html
        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined
        SSLEngine on
        SSLCertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem
        SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key
        &lt;FilesMatch "\.(cgi|shtml|phtml|php)$"&gt;
                        SSLOptions +StdEnvVars
        &lt;/FilesMatch&gt;
        &lt;Directory /usr/lib/cgi-bin&gt;
                        SSLOptions +StdEnvVars
        &lt;/Directory&gt;
        BrowserMatch "MSIE [2-6]" \
                        nokeepalive ssl-unclean-shutdown \
                        downgrade-1.0 force-response-1.0
        BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
    &lt;/VirtualHost&gt;
&lt;/IfModule&gt;
</pre>

This may look a bit complicated, but luckily, we don't need to worry about most of the options here.

We want to set the normal things we'd configure for a virtual host (ServerAdmin, ServerName, ServerAlias, DocumentRoot, etc.) as well as change the location where Apache looks for the SSL certificate and key.

In the end, it will look something like this.  The entries in red were modified from the original file:

<pre>
&lt;IfModule mod_ssl.c&gt;
    &lt;VirtualHost _default_:443&gt;
        ServerAdmin <span class="highlight">admin@example.com</span>
        <span class="highlight">ServerName your_domain.com</span>
        <span class="highlight">ServerAlias www.your_domain.com</span>
        DocumentRoot <span class="highlight">/var/www/html</span>
        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined
        SSLEngine on
        SSLCertificateFile <span class="highlight">/etc/apache2/ssl/apache.crt</span>
        SSLCertificateKeyFile <span class="highlight">/etc/apache2/ssl/apache.key</span>
        &lt;FilesMatch "\.(cgi|shtml|phtml|php)$"&gt;
                        SSLOptions +StdEnvVars
        &lt;/FilesMatch&gt;
        &lt;Directory /usr/lib/cgi-bin&gt;
                        SSLOptions +StdEnvVars
        &lt;/Directory&gt;
        BrowserMatch "MSIE [2-6]" \
                        nokeepalive ssl-unclean-shutdown \
                        downgrade-1.0 force-response-1.0
        BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
    &lt;/VirtualHost&gt;
&lt;/IfModule&gt;
</pre>

Save and exit the file when you are finished.

## Step Four — Activate the SSL Virtual Host

Now that we have configured our SSL-enabled virtual host, we need to enable it.

We can do this by typing:

    sudo a2ensite default-ssl.conf

We then need to restart Apache to load our new virtual host file:

    sudo service apache2 restart

This should enable your new virtual host, which will serve encrypted content using the SSL certificate you created.

## Step Five — Test your Setup

Now that you have everything prepared, you can test your configuration by visiting your server's domain name or public IP address after specifying the `https://` protocol, like this:

<pre>
https://<span class="highlight">server_domain_name_or_IP</span>
</pre>

You will get a warning that your browser cannot verify the identity of your server because it has not been signed by one of the certificate authorities that it trusts.

![apache ssl warning](https://assets.digitalocean.com/articles/ssl_apache_1404/ssl_warning.png)

This is expected since we have self-signed our certificate.  While our certificate will not validate our server for our users because it has had no interaction with a trusted certificate authority, it will still be able to encrypt communication.

Since this is expected, you can hit the "Proceed anyway" button or whatever similar option you have in your browser.

You will now be taken to content in the `DocumentRoot` that you configured for your SSL virtual host.  This time your traffic is encrypted.  You can check this by clicking on the lock icon in the menu bar:

![apache ssl encrypted](https://assets.digitalocean.com/articles/ssl_apache_1404/encrypted.png)

You can see in the middle green section that the connection is encrypted.

## Conclusion

You should now have SSL enabled on your website.  This will help to secure communication between visitors and your site, but it *will* warn each user that the browser cannot verify the validity of the certificate.

If you are planning on launching a public site and need SSL, you will be better off purchasing an SSL certificate from a trusted certificate authority.

If you want to learn more about [how to configure Apache](https://digitalocean.com/community/articles/how-to-configure-the-apache-web-server-on-an-ubuntu-or-debian-vps), click here.  Check out this link for more ideas on how to [secure your Linux server](https://digitalocean.com/community/articles/an-introduction-to-securing-your-linux-vps).

<div class="author">By Justin Ellingwood</div>


The Apache web server is the most popular way to serve content on the web.  If you need to communicate with your site visitors over a secured connection, setting up a TLS or SSL certificate will enable you to encrypt traffic.  In this guide, we'll discuss how to create a self-signed SSL certificate on Ubuntu 14.04 and use it with Apache to encrypt traffic.

How To Create a SSL Certificate on Apache for Ubuntu 14.04

How To Create a Self-Signed SSL Certificate for Apache

Debian

### Introduction

This tutorial walks you through the setup and configuration of an Apache server secured with an SSL certificate. By the end of the tutorial, you will have a server accessible via HTTPS.

SSL is based on the mathematical intractability of resolving a large integer into its also-large prime factors. Using this, we can encrypt information using a private-public key pair. Certificate authorities can issue SSL certificates that verify the authenticity of such a secured connection, and on the same note, a self-signed certificate can be produced without third-party support.

In this tutorial, we will generate a self-signed certificate, make the necessary configurations, and test the results. Self-signed certificates are great for testing, but will result in browser errors for your users, so they're not recommended for production.

If you'd like to obtain a paid certificate instead, please see [this tutorial](https://www.digitalocean.com/community/tutorials/how-to-install-an-ssl-certificate-from-a-commercial-certificate-authority).

## Prerequisites

To follow this tutorial, you will need:

- One fresh Debian 8 Droplet
- A sudo non-root user, which you can set up by following Steps 2 and 3 of [this tutorial](https://www.digitalocean.com/community/tutorials/initial-server-setup-with-debian-8)
- OpenSSL installed and updated (should be installed by default)

```command
sudo apt-get update
sudo apt-get upgrade openssl
```

You may want a second computer with OpenSSL installed, for testing purposes:

- Another Linux Droplet
- Or, a Unix-based local system (Mac, Ubuntu, Debian, etc.)

## Step 1 — Install Apache

In this step, we will use a built-in *package installer* called `apt-get`. It simplifies package management drastically and facilitates a clean installation.

In the link specified in the prerequisites, you should have updated `apt-get` and installed the `sudo` package, as unlike other Linux distributions, Debian 8 does not come with `sudo` installed.

Apache will be our HTTPS server. To install it, run the following:

```command
sudo apt-get install apache2
```

## Step 2 — Enable the SSL Module

In this section, we will enable SSL on our server.

First, enable the Apache SSL module.

```command
sudo a2enmod ssl
```

The default Apache website comes with a useful template for enabling SSL, so we will activate the default website now.

```command
sudo a2ensite default-ssl
```

Restart Apache to put these changes into effect.

```command
sudo service apache2 reload
```

## Step 3 — Create a Self-Signed SSL Certificate

First, let's create a new directory where we can store the private key and certificate.

```command
sudo mkdir /etc/apache2/ssl
```

Next, we will request a new certificate and sign it.

First, generate a new certificate and a private key to protect it.

- The `days` flag specifies how long the certificate should remain valid. With this example, the certificate will last for one year
- The `keyout` flag specifies the path to our generated key
- The `out` flag specifies the path to our generated certificate

```command
sudo openssl req -x509 -nodes -days <^>365<^> -newkey rsa:2048 -keyout /etc/apache2/ssl/<^>apache.key<^> -out /etc/apache2/ssl/<^>apache.crt<^>
```

Invoking this command will result in a series of prompts.

- **Common Name**: Specify your server's IP address or hostname. This field matters, since your certificate needs to match the domain (or IP address) for your website
- Fill out all other fields at your own discretion.

Example answers are shown in <^>red<^> below.

```
[secondary_label Interactive]
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
——-
Country Name (2 letter code) [AU]:<^>US<^>
State or Province Name (full name) [Some-State]:<^>New York<^>
Locality Name (eg, city) []:<^>NYC<^>
Organization Name (eg, company) [Internet Widgits Pty Ltd]:<^>DigitalOcean<^>
Organizational Unit Name (eg, section) []:<^>SSL Certificate Test<^>
Common Name (e.g. server FQDN or YOUR name) []:<^>example.com<^>               
Email Address []:<^>test@example.com<^>
```

Set the file permissions to protect your private key and certificate.

```command
sudo chmod 600 /etc/apache2/ssl/*
```

For more information on the three-digit permissions code, see the tutorial on [Linux permissions](https://www.digitalocean.com/community/tutorials/linux-permissions-basics-and-how-to-use-umask-on-a-vps).

Your certificate and the private key that protects it are now ready for Apache to use.

## Step 4 — Configure Apache to Use SSL

In this section, we will configure the default Apache virtual host to use the SSL key and certificate. After making this change, our server will begin serving HTTPS instead of HTTP requests for the default site.

Open the server configuration file using `nano` or your favorite text editor.

```command
sudo nano /etc/apache2/sites-enabled/default-ssl.conf
```

Locate the section that begins with `<VirtualHost _default_:443>` and make the following changes.

- Add a line with your server name directy below the `ServerAdmin` email line. This can be your domain name or IP address:

```
[label /etc/apache2/sites-enabled/default]
ServerAdmin webmaster@localhost
ServerName <^>example.com<^>:443
```

- Find the following two lines, and update the paths to match the locations of the certificate and key we generated earlier. If you purchased a certificate or generated your certificate elsewhere, make sure the paths here match the actual locations of your certificate and key:

```
[label /etc/apache2/sites-enabled/default]
 SSLCertificateFile <^>/etc/apache2/ssl/apache.crt<^>
 SSLCertificateKeyFile <^>/etc/apache2/ssl/apache.key<^>
```

Once these changes have been made, check that your virtual host configuration file matches the following.

```
[label /etc/apache2/sites-enabled/default-ssl]
<IfModule mod_ssl.c>
	<VirtualHost _default_:443>
		ServerAdmin webmaster@localhost
		ServerName <^>example.com:443<^>
		DocumentRoot /var/www/html
		
		. . .
		SSLEngine on
		
		. . .
		
		SSLCertificateFile <^>/etc/apache2/ssl/apache.crt<^>
		SSLCertificateKeyFile <^>/etc/apache2/ssl/apache.key<^>
```

Save and exit the file.

Restart Apache to apply the changes.

```command
sudo service apache2 reload
```

To learn more about configuring Apache virtual hosts in general, see [this article](https://www.digitalocean.com/community/tutorials/how-to-set-up-apache-virtual-hosts-on-ubuntu-14-04-lts).

## Step 5 — Test Apache with SSL

In this section, we will test your SSL connection from the command line.

You can run this test from either (1) your local Unix-based system, (2) another Droplet, or (3) the same Droplet. If you run it from an external system you'll confirm that your site is reachable over the public Internet.

Open a connection via the HTTPS 443 port.

```command
openssl s_client -connect <^>your_server_ip<^>:443
```

Scroll to the middle of the output (after the key), and you should find the following:

```
[secondary_label Output]
—-
SSL handshake has read 3999 bytes and written 444 bytes
—-

. . .

SSL-Session:

. . .
```

Of course, the numbers are variable, but this is success. Congratulations!

Press `CTRL+C` to exit.

You can also visit your site in a web browser, using HTTPS in the URL (`https://example.com`). Your browser will warn you that the certificate is self-signed. You should be able to view the certificate and confirm that the details match what you entered in Step 3.

## Conclusion

This concludes our tutorial, leaving you with a working Apache server, configured securely with an SSL certificate. For more information on working with OpenSSL, see [the OpenSSL Essentials article](https://www.digitalocean.com/community/tutorials/openssl-essentials-working-with-ssl-certificates-private-keys-and-csrs).

This tutorial walks you through the setup and configuration of an Apache server secured with an SSL certificate. By the end of the tutorial, you will have a server accessible via HTTPS.

In this tutorial, we will generate a self-signed certificate, make the necessary configurations, and test the results.

How To Create a SSL Certificate on Apache for Debian 8

12.04

<span class="warning"><p></p>

<div name="status-deprecated" data-unique="status-deprecated"></div><h2 id="status-deprecated"><strong>Status:</strong> Deprecated</h2>

<p>This article covers a version of Ubuntu that is no longer supported.  If you currently operate a server running Ubuntu 12.04, we highly recommend upgrading or migrating to a supported version of Ubuntu:</p>

<ul>
<li><a href="https://www.digitalocean.com/community/tutorials/how-to-upgrade-ubuntu-12-04-lts-to-ubuntu-14-04-lts">Upgrade to Ubuntu 14.04</a>.</li>
<li><a href="https://www.digitalocean.com/community/tutorials/how-to-upgrade-to-ubuntu-16-04-lts">Upgrade from Ubuntu 14.04 to Ubuntu 16.04</a></li>
<li><a href="https://www.digitalocean.com/community/tutorials/how-to-migrate-linux-servers-part-1-system-preparation">Migrate the server data to a supported version</a></li>
</ul>

<p><strong>Reason:</strong>
<a href="https://lists.ubuntu.com/archives/ubuntu-announce/2017-March/000218.html">Ubuntu 12.04 reached end of life (EOL) on April 28, 2017</a> and no longer receives security patches or updates.  This guide is no longer maintained.</p>

<p><strong>See Instead:</strong><br>
This guide might still be useful as a reference, but may not work on other Ubuntu releases.  If available, we strongly recommend using a guide written for the version of Ubuntu you are using.   You can use the search functionality at the top of the page to find a more recent version.<br></p></span><h3>What the <span class="highlight">Red </span> Means</h3>

<p>The lines that the user needs to enter or customize will be in <span class="highlight">red</span> in this tutorial! The rest should mostly be copy-and-pastable.</p>

<h3>About SSL Certificates</h3>

<p>A SSL certificate is a way to encrypt a site's information and create a more secure connection. Additionally, the certificate can show the virtual private server's identification information to site visitors. Certificate Authorities can issue SSL certificates that verify the server's details while a self-signed certificate has  no 3rd party corroboration.</p> 

<h2>Set Up</h2>
<p>The steps in this tutorial require the user to have root privileges on the VPS. You can see how to set that up <a href="https://www.digitalocean.com/community/articles/initial-server-setup-with-ubuntu-12-04">here </a> in steps 3 and 4.</p> 

<p>Additionally, you need to have apache already installed and running on your virtual server.  If this is not the case, you can download it with this command:</p>

<pre>sudo apt-get install apache2</pre>

<h2>Step One—Activate the SSL Module</h2>

<p>The next step is to enable SSL on the droplet.</p> 

<pre>sudo a2enmod ssl</pre>

<p>Follow up by restarting Apache.</p>
 
<pre>sudo service apache2 restart</pre>

<h2>Step Two—Create a New Directory</h2>

<p>We need to create a new directory where we will store the server key and certificate</p>

<pre>sudo mkdir /etc/apache2/ssl </pre>

<h2>Step Three—Create a Self Signed SSL Certificate</h2> 

<p>When we request a new certificate,  we can specify how long the certificate should remain valid by changing the 365 to the number of days we prefer. As it stands this certificate will expire after one year.</p> 
                                                      
<pre>sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/apache2/ssl/apache.key -out /etc/apache2/ssl/apache.crt</pre>

<p>With this command, we will be both creating the self-signed SSL certificate and the server key that protects it, and placing both of them into the new directory.</p>

<p>This command will prompt terminal to display a lists of fields that need to be filled in.</p>

<p>The most important line is "Common Name". Enter your official domain name here or, if you don't have one yet, your site's IP address.</p> 

<pre>You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:<span class="highlight">US</span>
State or Province Name (full name) [Some-State]:<span class="highlight">New York</span>
Locality Name (eg, city) []:<span class="highlight">NYC</span>
Organization Name (eg, company) [Internet Widgits Pty Ltd]:<span class="highlight">Awesome Inc</span>
Organizational Unit Name (eg, section) []:<span class="highlight">Dept of Merriment</span>
Common Name (e.g. server FQDN or YOUR name) []:<span class="highlight">example.com      </span>            
Email Address []:<span class="highlight">webmaster@awesomeinc.com</span></pre>


<h2>Step Four—Set Up the Certificate</h2>

<p>Now we have all of the required components of the finished certificate.The next thing to do is to set up the virtual hosts to display 
the new certificate. 
Open up the SSL config file:</p>

<pre> nano /etc/apache2/sites-available/default-ssl</pre>

<p>Within the section that begins with &ltVirtualHost _default_:443>, quickly make the following changes.
Add a line with your server name right below the Server Admin email:</p>

<pre> ServerName example.com:443</pre>

<p>Replace example.com with your DNS approved domain name or server 
IP address (it should be the same as the common name on the 
certificate).
Find the following three lines, and make sure that they match the 
extensions below:</p>
 
<pre>SSLEngine on
SSLCertificateFile /etc/apache2/ssl/apache.crt
SSLCertificateKeyFile /etc/apache2/ssl/apache.key</pre>

<p>Save and Exit out of the file.</p>

<h2>Step Five—Activate the New Virtual Host</h2>

<p>Before the website that will come on the 443 port can be activated, we need to enable that Virtual Host:</p>

<pre>sudo a2ensite default-ssl</pre>

<p>You are all set. Restarting your Apache server will reload it with all of your changes in place.</p> 

<pre>sudo service apache2 reload</pre>

<p>In your browser, type https://youraddress, and you will be able to see the new certificate.</p> 

<h2>See More</h2>

<p>Once you have setup your SSL certificate on the site, you can <a href="https://www.digitalocean.com/community/articles/how-to-set-up-vsftpd-on-ubuntu-12-04">Install an FTP server</a> if you haven't done so yet.</p> 

<div class="author">By Etel Sverdlov</div>

This tutorial explains how to create a self-signed SSL certificate, how to add it to your server, and how to configure the SSL file to display the certificate to the world. A SSL certificate is a way to encrypt a site's information and create a more secure connection. Certificate Authorities can issue SSL certificates that verify the server's details while a self-signed certificate has no 3rd party corroboration. This tutorial is written for Apache on an Ubuntu server.


How To Create a SSL Certificate on Apache for Ubuntu 12.04

CentOS

<span class="warning"><p></p>

<h2><strong>Status:</strong> Deprecated</h2>

<p>This article covers a version of CentOS that is no longer supported. If you are currently operating a server running CentOS 6, we highly recommend upgrading or migrating to a supported version of CentOS.</p>

<p><strong>Reason:</strong>
<a href="https://wiki.centos.org/About/Product">CentOS 6 reached end of life (EOL) on November 30th, 2020</a> and no longer receives security patches or updates. For this reason, this guide is no longer maintained.</p>

<p><strong>See Instead:</strong><br>
This guide might still be useful as a reference, but may not work on other CentOS releases. If available, we strongly recommend using a guide written for the version of CentOS you are using.</p>
<p>The following DigitalOcean tutorial may be of interest, as it outlines how to create an SSL certificate for Apache on a CentOS 7 server:
<br>
<ul>
<li><a href="https://www.digitalocean.com/community/tutorials/how-to-create-an-ssl-certificate-on-apache-for-centos-7">How To Create an SSL Certificate on Apache for CentOS 7</a></li>
</ul><br></p></span>

<h3> About Self-Signed Certificates</h3>

<p>A SSL certificate is a way to encrypt a site's information and create a more secure connection. Additionally, the certificate can show the virtual private  server's identification information to site visitors. Certificate Authorities can issue SSL certificates that verify the virtual server's details while a self-signed certificate has  no 3rd party corroboration.</p>

<h2>Step One—Install Mod SSL</h2>

<p>In order to set up the self signed certificate, we first have to be sure that Apache and Mod SSL are installed on our VPS. You can install both with one command:</p> 

<pre>yum install mod_ssl</pre>

<h2>Step Two—Create a New Directory</h2>

<p>Next, we need to create a new directory where we will store the server key and certificate</p>

<pre>mkdir /etc/httpd/ssl </pre>

<h2>Step Three—Create a Self Signed Certificate</h2> 

<p>When we request a new certificate,  we can specify how long the certificate should remain valid by changing the 365 to the number of days we prefer. As it stands this certificate will expire after one year.</p> 

<pre>openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/httpd/ssl/apache.key -out /etc/httpd/ssl/apache.crt</pre>

<p>With this command, we will be both creating the self-signed SSL certificate and the server key that protects it, and placing both of them into the new directory.</p>

<p>This command will prompt terminal to display a lists of fields that need to be filled in.</p>

<p>The most important line is "Common Name". Enter your official domain name here or, if you don't have one yet, your site's IP address.</p> 

<pre>You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:US
State or Province Name (full name) [Some-State]:New York
Locality Name (eg, city) []:NYC
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Awesome Inc
Organizational Unit Name (eg, section) []:Dept of Merriment
Common Name (e.g. server FQDN or YOUR name) []:example.com                  
Email Address []:webmaster@awesomeinc.com</pre>

<h2>Step Four—Set Up the Certificate</h2>

<p>Now we have all of the required components of the finished certificate.The next thing to do is to set up the virtual hosts to display the new certificate.</p> 

<p>Open up the SSL config file:</p>

<pre> vi /etc/httpd/conf.d/ssl.conf</pre>

<p>Find the section that begins with &ltVirtualHost _default_:443> and make some quick changes.</p>

<p>Uncomment the DocumentRoot and ServerName line and replace example.com with your DNS approved domain name or server IP address (it should be the same as the common name on the certificate):</p>

<pre> ServerName example.com:443</pre> 

<p>Find the following three lines, and make sure that they match the extensions below:</p> 

<pre>SSLEngine on
SSLCertificateFile /etc/httpd/ssl/apache.crt
SSLCertificateKeyFile /etc/httpd/ssl/apache.key </pre>

<p>Your virtual host is now all set up! Save and Exit out of the file.</p>

<h2>Step Five—Restart Apache</h2>

<p>You are done. Restarting the Apache server will reload it with all of your changes in place.</p> 

<pre> /etc/init.d/httpd restart</pre>

<p>In your browser, type https://youraddress to view the new certificate.</p> 

<div class="author">By Etel Sverdlov</div>

This tutorial explains how to create a self-signed SSL certificate, how to add it to your server, and how to configure the SSL file to display the certificate to the world. A SSL certificate is a way to encrypt a site's information and create a more secure connection. Certificate Authorities can issue SSL certificates that verify the server's details while a self-signed certificate has no 3rd party corroboration. This tutorial is written for Apache on a Centos server.

How To Create a SSL Certificate on Apache for CentOS 6

### Background Information
---

A SSL certificate is a way to encrypt a site's information and create a more secure connection. While Certificate authorities can issue SSL certificates that verify the server's details, a self-signed certificate has no third party corroboration. This tutorial explains how to create a self-signed SSL certificate, add it to your VPS, and configure the SSL file to display the certificate to the world. 

## 1) Install Apache
---

If Apache is not already running on your server, these is an Apache httpd package readily available for aptitude under the name **apache2**. 

Run the following command to install:

     sudo apt-get install apache2
	
To test that the package was properly installed, enter your VPS IP address into your browser. If the installation was successful, the browser shall display the following:

	It works!

	This is the default web page for this server.
	The web server software is running but no content 
	has been added, yet.
	
## 2) Configure httpd
---
We need to configure httpd in order to support SSL. It is available in the httpd installation as a part of the apache2-common package.

Use the following commands to enable SSL:

     sudo a2ensite default-ssl
     sudo a2enmod ssl

This time, as stated, let’s restart Apache2:

     sudo service apache2 restart


To test that the module was properly installed, we are going to type our IP address into the browser as before; however, this time we will use **https://**. Follow this with your IP address in your browser. 

The first time you access the page, the browser will warn you that the certificate of the site is not trusted. You can proceed and you will get to the same page as before:

	It works!

	This is the default web page for this server.
	The web server software is running but no content has been added, 	
	yet.

## 3) Generate a Self-Signed Certificate
---

To use a self-signed certificate, the package **ssl-cert** must be installed.

I wanted to configure my own self-signed certificate for the server and to store it in /etc/apache2/ssl. To do so, run the following commands:

	sudo mkdir /etc/apache2/ssl

When we request a new certificate,  we can specify how long the certificate should remain valid by changing the 365 to the number of days we prefer. As it stands this certificate will expire after one year. 

	sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/apache2/ssl/apache.key -out /etc/apache2/ssl/apache.crt

With this command, we will be both creating the self-signed SSL certificate and the server key that protects it, and placing both of them into the new directory.

This command will prompt terminal to display a lists of fields that need to be filled in.

The most important line is "Common Name". Enter your official domain name here or, if you don't have one yet, your site's IP address. 

	<pre>You are about to be asked to enter information that will be incorporated
	into your certificate request.
	What you are about to enter is what is called a Distinguished Name or a DN.
	There are quite a few fields but you can leave some blank
	For some fields there will be a default value,
	If you enter '.', the field will be left blank.
	-----
	Country Name (2 letter code) [AU]:<span class="highlight">US</span>
	State or Province Name (full name) [Some-State]:<span class="highlight">New York</span>
	Locality Name (eg, city) []:<span class="highlight">NYC</span>
	Organization Name (eg, company) [Internet Widgits Pty Ltd]:<span class="highlight">Awesome Inc</span>
	Organizational Unit Name (eg, section) []:<span class="highlight">Dept of Merriment</span>
	Common Name (e.g. server FQDN or YOUR name) []:<span class="highlight">example.com      </span>            
	Email Address []:<span class="highlight">webmaster@awesomeinc.com</span></pre><br/>

## 4) Set Up the Certificate
---

Now we have all of the required components of the finished certificate.The next thing to do is to set up the virtual hosts to display the new certificate. 

Open up the SSL config file:

	nano /etc/apache2/sites-available/default-ssl

Within the section that begins with &ltVirtualHost _default_:443>, quickly make the following changes.

Add a line with your server name right below the Server Admin email:

	ServerName example.com:443

Replace example.com with your DNS approved domain name or server IP address (it should be the same as the common name on the certificate).

Find the following three lines, and make sure that they match the extensions below: 

     SSLEngine on
     SSLCertificateFile /etc/apache2/ssl/apache.crt
     SSLCertificateKeyFile /etc/apache2/ssl/apache.key

Save and Exit out of the file.

## 5) Activate the New Virtual Host
---

Before the website that will come on the 443 port can be activated, we need to enable that Virtual Host:

	sudo a2ensite default

You are all set. Restarting your Apache server will reload it with all of your changes in place. 

	sudo service apache2 reload

In your browser, type https://youraddress, and you will be able to see the new certificate. 

## See More
---
Once you have setup your SSL certificate on the site, you can <a href="https://www.digitalocean.com/community/articles/how-to-set-up-vsftpd-on-ubuntu-12-04">Install an FTP server</a> if you haven't done so yet. 

<div class="author">By Adam LaGreca</div>

A SSL certificate is a way to encrypt a site's information and create a more secure connection. While Certificate authorities can issue SSL certificates that verify the server's details, a self-signed certificate has no third party corroboration. This tutorial explains how to create a self-signed SSL certificate, add it to your VPS, and configure the SSL file to display the certificate to the world. 

How To Create a SSL Certificate on Apache for Debian 7

AI PhD Student @ UC Berkeley

Sign up for Infrastructure as a Newsletter.

Working on improving health and education, reducing inequality, and spurring economic growth? DigitalOcean would like to help.

Working on improving health and education, reducing inequality, and spurring economic growth? We'd like to help.

Get paid to write technical tutorials and select a tech-focused charity to receive a matching donation.

You get paid; we donate to tech nonprofits.

DigitalOcean makes it simple to launch in the cloud and scale up as you grow – whether you’re running one virtual machine or ten thousand.