6

In an environment where a handful of Apache servers are running a bunch of sites using SSL certificates for HTTPS, where should these certificates be placed? In Debian or Ubuntu, should all relevant files be put in /etc/apache2/ssl? Or is there some other location better suited for this? What security concerns should be addressed when choosing locations for these files for multiple websites on the same server?

3 Answers 3

9

FWIW, I use Debian.

I place all private keys in /etc/ssl/private which has permission mode 0700. I place all certificates in /etc/ssl/certs which has permission mode 0755. The owner/group for both is root:root.

3

Basically, your SSL key files should be readable only by a root user (you should issue two commands on them: sudo chown root:root /path/to/your/keyfile.key and sudo chmod 600 /path/to/your/keyfile.key). Your certificate files can be world-readable. And it's always a good idea to keep your keys and certificates outside your web-accessible document tree, /etc/apache/ssl should work well.

1

The following best practices for placing SSL certificates have usually worked well for me:

  1. /usr/share/ca-certificates/domainname/ - Put the public *.crt files obtained from the CA authority here
  2. /etc/ssl/certs - Create symbolic links to the files placed in the /usr/share/ca-certificates/domainname/ directory
  3. /etc/ssl/private/private.key - The private key is directly placed into this directory
  4. /opt/ssl/csr/domainname/domain.csr - I place the original CSR in this directory for my future refeference.

If you are planning to use the SSL certificates for services such as Dovecot and Postfix you will also need the *.pem files. You can put those converted *.pem files in /opt/ssl/csr/domainname/*.pem and create a softlink to them into the /etc/ssl/certs directory.

1
  • The *.crt file should instead be placed into /usr/local/share/ca-certificates/domainname/. The symbolic link does usually not need to be created manually, at least on Debian you can just run update-ca-certificates and it will create it.
    – jlh
    Jun 27, 2017 at 6:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .