Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

    SSLEngine on
    SSLCertificateFile /etc/httpd/conf/login.domain.com.crt
    SSLCertificateKeyFile /etc/httpd/conf/login.domain.com.key
    SSLCipherSuite ALL:-ADH:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP

share|improve this question

2 Answers 2

up vote 3 down vote accepted

crt and key files represent both parts of a certificate, key being the private key to the certificate and crt being the signed certificate.

It's only one of the ways to generate certs, another way would be having both inside a pem file or another in a p12 container.

You have several ways to generate those files, if you want to self-sign the certificate you can just issue this commands

openssl genrsa 1024 > host.key
chmod 400 host.key
openssl req -new -x509 -nodes -sha1 -days 365 -key host.key > host.cert

With a self-signed certificate however your browsers will warn you that the certificate is not "trusted" because it haven't been signed by a certification authority that is in the trust list of your browser, although it's a good way to get started.

From there onwards you can either generate your own chain of trust by making your CA or buy a certificate from a company like Verisign or Thawte.

share|improve this answer
    
after running "openssl genrsa 1024 > host.key" I got this in terminal: "e is 65537 (0x10001) " is it an error? –  Mohammad Ali Akbari Jan 19 '11 at 10:18
1  
Yes, this means that openssl can't write the random seed to the default file it uses which is defined by openssl.cnf, by default in CentOS/RHEL this file is in /etc/pki/tls/openssl.cnf. Try executing the same commands as root in this case and see how it goes. –  lynxman Jan 19 '11 at 10:29
    
I try it as root, but I got "e is 65537 (0x10001)" again –  Mohammad Ali Akbari Jan 19 '11 at 10:37
1  
Do you have SELinux activated on your machine? Check /var/log/messages to see why openssl can't write the file –  lynxman Jan 19 '11 at 10:38
    
I check /var/log/messages before and after run this command, nothing! –  Mohammad Ali Akbari Jan 19 '11 at 14:53

These are the public (.crt) and private (.key) parts of an SSL certificate. See this question for a plethora of relevant information, e.g. if you want to generate a cert yourself, or buy one.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.