I am looking for a way to generate SSL certificates on an external Linux server, but can't figure out the best way.
When a user registers on a website (on a web server), I want the web server to send a message to another server where the SSL certificate and key will be generated for the user. The web server must send the
username of the user to the external server. I know that it is better for security to generate SSL certs on a separate machine, and not on the web server.
The web server is also a Linux system and will use PHP, so maybe PHP should send this message to the 'ssl-generation-server'? I was thinking using a
BASH script, and a curl command like this because it is the easiest I can come up with:
exec("curl http://ssl-gen-server/generate.php > /dev/null 2>&1 &");
I don't want the PHP call on the web server to wait for the answer from
generate.php, so I will redirect it, so that it would be asynchronous.
After the SSL and key have been generated, they should be sent back to the web server so that they can be presented to the user. But the problem here is: how can the 'ssl-gen-server' contact the web server and inform about the SSL cert?
Is it better to automate SSH logins from the web server to the SSL-gen server, and run commands there?
I know that PHP has
openssl_csr_new, but maybe it is better to generate certificates with the actual