Very Newbie SSL Certificate Steps Guide

[aleangelico]

I was dealing with this SSL certificate issue for a while and there is a lot of information, but sometimes confuse. This are the steps I followed:

I bought a QuickSSL certificate from here (https://ssl.theplanet.com/?SslType=QuickSSL). There are many different certificates. This is the cheapest one (50 bucks from this site but more than a hundred from GeoTrust). It only certifies that this site is the site it says, but nothing about the company or the owner. I use this for encrypting forms, so it works for me.
So:

1. Buy the certificate. You don't need to contact Futurequest yet.
2. Generate the CSR. You can do this by your own!, no need to pay. They will send you instructions of commands you have to run in a futurequest session (telnet, ssh), for example:
2.1 Create a private key: openssl genrsa -out domainname.key 1024
2.2 Create a CSR: openssl req -new -key domainname.key -out domainname.csr
2.3 Submit your CSR (is a text file you can copy an paste in a form)
3. After receiving the email from the Certificate Company, save it to a text file.
4. Now, contact Futurequest for adding (buying) the SSL service. Is the "Secure Server (your certificate)" option
4.1 Fill the form. In the second one:
Add the content of the CRT file (the text you save in step 3)
add the content of the KEY you generated in the step 2.1
If you didn't set any password, leave it blank (this is my case)
Subdomain: they offer https://secure.mydomain.com, I changed to https://www.mydomain.com. I'll explain how this work below

I don't remember exactly now but i think they ask you about the folder you will be using. I let the proposed "Secure_Server"

That's it!

HOW THIS WORKS.
Now, if I want to have a page "secure", I just copy the page to /big/dom/xmydomain/www/Secure_Server. Apache is going to look for any page you access using the https:// prefix in this folder.
The Secure_Server is not visible from the browser.
For example, in my domain :
http://www.ednahotel.com/index.html -> retrieves the /big/dom/xmydomain/www/index.html page

https://www.ednahotel.com/index.html -> retrieves the /big/dom/xmydomain/www/Secure_Server/index.html page

But the only difference for the browser is https:// instead of http://

NOTE: If you are ask for the server you are using, is the "Apache + MODSSL" option. This information is here (http://service.futurequest.net/index.php?_a=knowledgebase&_j=questiondetails&_i=557&nav=+%26gt%3B+%3Ca+href%3D%27index.php%3F_a%3Dknowledgebase%26_j% 3Dsubcat%26_i%3D42%27%3EE-commerce+%26+Secure+Certs%3C%2Fa%3E)

Thanks to hobbes, Matt and Jeff for their help!

I hope this helps
Bye
Alex

PS: I'm far from being an expert so if any information is wrong, please post the corrections.

[Matt]

There is a difference between paying for the SSL cert and actually obtaining it. In order to obtain SSL cert, you will need the CSR. The CSR might, therefore, be the first step so that you have it when you go to purchase the SSL certificate.

Another note is that you will want to make sure that the subdomain you use to generate the CSR is the one you specify for generating your SSL certificate and what you specify to FQ. I believe that this is largely auto-detected from the initial CSR, but still a good idea to keep track of.

Finally, be sure to store the password you use to generate the CSR with... you'll need it later.

-Matt

[hobbes]

The -des3 flag was left out of the csr request, so the key is probably not password protected. The secondary csr password request can also be left blank.

If you plan on sharing the files between SSL & non-SSL parts of the site, you can request FQ to overlay https over your www directory vs. creating a www/Secure_Server/ directory. Or you could create a symlink www/Secure_Server/secure/ -> ../../ allowing the use of https://www.example.com/secure/[FILE_IN_WWW]

[aleangelico]

If you plan on sharing the files between SSL & non-SSL parts of the site, you can request FQ to overlay https over your www directory vs. creating a www/Secure_Server/ directory. Or you could create a symlink www/Secure_Server/secure/ -> ../../ allowing the use of https://www.example.com/secure/[FILE_IN_WWW]

I don't understand how this works, this is for securing a page in www/ instead of copying it to Secure_Server/ ?

[hobbes]

Basically this would allow you to have a single directory structure for both your http and https files. Some may find it convenient vs. having to split the files out across www (http) and separately in Secure_Server (https). It really depends on your needs, etc. For simple sites, it shouldn't matter either way.