0

Looking at my Centos 6.5 /etc/pki/ directory, I see the following system generated directories:

[root@vps ~]# ls /etc/pki
CA  ca-trust  java  nssdb  rpm-gpg  rsyslog  tls
[root@vps ~]# ls /etc/pki/CA
certs  crl  newcerts  private
[root@vps ~]# ls /etc/pki/ca-trust
README  extracted  source
[root@vps ~]# ls /etc/pki/tls
cert.pem  certs  misc  openssl.cnf  private
[root@vps ~]#

When creating self signed keys, I created the following three files, and have located them as shown:

  • /etc/pki/tls/private/mysite_key.pem (In /etc/httpd/conf/httpd.conf, I set SSLCertificateKeyFile to this value)
  • /etc/pki/tls/private/mysite_csr.pem (In /etc/httpd/conf/httpd.conf, I don't use this value)
  • /etc/pki/tls/certs/mysite_crt.pem (In /etc/httpd/conf/httpd.conf, I set SSLCertificateFile to this value)

Is this the "official" place to locate them when using Centos 6.5 and Apache 2.2? Note that Apache was installed via yum and not compiled. I realize it might not matter, but would like to get in the practice of locating them where most people do.

When using a CA certificate, should I locate them elsewhere?

Also, when using a CA certificate, should I not set SSLCertificateFile, but set SSLCACertificateFile to the CA certificate? (EDIT. When doing so, Apache errors out when not using SSLCertificateFile, but instead using SSLCACertificateFile)

I also have SSLCertificateChainFile which must be set to sub.class1.server.ca.pem. Where should this file be located?

Thank you

  • Why the downvote? There are multiple viable locations for Centos, and other distributions use totally different locations. I know it doesn't mater since I could set up httpd.conf however I want, but there likely is a "right" place to locate them. – user1032531 May 16 '14 at 15:16
  • I think you want to look at the update-ca-trust man page. It is ... quite comprehensive, to say the least. For future RHEL versions (from RHEL 7 on, I guess), we will have fedoraproject.org/wiki/Features/SharedSystemCertificates which already is in fedora 19/20. – natxo asenjo May 19 '14 at 18:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.