-1

I need to add SSL to a Apache/Linux sever.

Do I have to generate CSR from the same server which I need to add SSL?

Also when I add SSL in Apache sever, can I omit mentioning key file like below?

<VirtualHost *:443>
    ServerName www.example.com
    SSLEngine on
    SSLCertificateFile /path/to/www.example.com.cert
    SSLCertificateChainFile /path/to/DigiCertCA.crt
</VirtualHost>
Improve this question
3
  • And no, I don't think you can omit specifying the keyfile. Why would you want to?
    – MadHatter
    Apr 22, 2014 at 10:44
  • @MadHatter I received the CRT files from client. But not the key file.
    – ChamingaD
    Apr 22, 2014 at 10:48
  • 2
    Then the certificate is unusable. You need the private keyfile that the certificate corresponds to, in order to use the certificate. End of story.
    – MadHatter
    Apr 22, 2014 at 10:50

1 Answer 1

Reset to default
3

You do not have to generate the CSR on the server where it is going to be used, but for certificates only used on a single server, it is highly recommended that you generate the keys on the server and never let it leave that host.

You will need to let Apache know where the private key can be found however.

Think of the private and public key as a set of unique English-Korean dictionaries.

The browser speaks English only - so does Apache

When the browser wants to send something to Apache in secrecy, it obtains the English-Korean dictionary (the certificate/public key) from Apache and translates the secret message to Korean.

When Apache receives the secret message, it needs the Korean-English dictionary (the private key) to translate it in order to make sense of it.

Without the private key, everything sent to the web server is pure korean and apache won't know how to respond

Improve this answer
1
  • 2
    To any Korean-speaking users: I apologize in advance, I'm not trying to imply that the Korean language is weirdly padded and prone to implementation errors - It's just cryptic from an ignorant western language perspective, that's all
    – Mathias R. Jessen
    Apr 22, 2014 at 11:23

Not the answer you're looking for? Browse other questions tagged .