Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to implement a certificate on a web server (apache). The requirement is that it must work with ssl, so I need to purchase a certificate. I would like to avoid having to buy a certificate at least for now. From your experience does anybody recomend any free certificate company, who I can count on and is known to be good and reputable? I Would appreciate answers based only on experience of using such companies.

Thank you all.

share|improve this question
up vote 2 down vote accepted

Good for you, as your requirements are easy to satisfy, either with self-signed, private CA or public CA.

The most well known public CA for this it CAcert where you can sign up and issue certitificates to any domain you own, for free! (Although donations are encouraged).

If you want to "get your hands dirty" you can consider one of these options also: run a software like XCA or just use OpenSSL to create a certificate which is self-signed or signed with a private CA (there is a difference). Both of these software are cross-platform. XCA is a GUI program that is easy to use but not terribly well documented. OpenSSL, a command-line tool, has been around for ages and is well documented but not really that easy to use.

share|improve this answer
I think I will go with cacart if has a proven that it is a good provider. thank you. – redknight Jun 21 '10 at 12:07

StartSSL ( offers a free certificate that is not self-signed. I have seen elsewhere on ServerFault of people who have recommended this service in the past.

Another option, if you're just testing, is to use a self-signed certificate.

share|improve this answer
+1 self-signed. – msanford Jun 19 '10 at 5:04

Quick and easy:

Generate key pairs:

  1. openssl genrsa -out 2048

GEneate CSR:

  1. openssl req -new -key -out

Sign CSR with private key and certificate valid for 3650 days:

  1. openssl x509 -in -out -req -signkey -days 3650

In httpd.conf file, there is 'Include' parameter, which includes file for httpd-ssl.conf or something called ssl.conf -depending on your installation.

You need to copy the above three files to your apache's conf directory (somewhere you can reference them in the conf file). In httpd-ssl.conf or ssl.conf file you need to update the location as follows:

SSLCertificateFile /etc/httpd/conf/www.myexample.conf.crt

SSLCertificateKeyFile /etc/httpd/conf/

That is it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.