Wednesday, October 5, 2016

Apache SSL Signing Request with Active Directory Certificate Services

Setup the DNS Address
Make sure that you have DNS configured with the correct FQDN before proceeding. 

Generate a Private Key 
Generate a Private Key
openssl genrsa 2048 > wiki.key

Generate a Request
openssl req -new -key wiki.key  -sha256 > wiki.csr
The important thing on the openssl Req is that you get your common name right. If your server has multiple DNS names, you will need to look into specifying your Subject Alternate Names. Currently not covered in this howto.

Sign the Request on The CA
Copy the Request Over to the CA
certreq -submit -attrib "CertificateTemplate: WebServer" .\wiki.csr

Move the Generated .crt file back over to the server
Place the .key and the .crt files in the apache2 directory. I recommend creating the following directory

sudo mkdir /etc/apache2/ssl && cd /etc/apache2/ssl
sudo chmod 400 *.key
cd ../sites-available
sudo vi default-ssl.conf

Change the following Lines:
SSLCertificateFile        /etc/ssl/certs/ssl-cert-snakeoil.pem
SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key

SSLCertificateFile /etc/apache2/ssl/wiki.crt

SSLCertificateKeyFile /etc/apache2/ssl/wiki.key

Restart Apache 
This varies from distro to distro, but for me its
sudo service apache2 restart

Verify it works
Navigate to your web server via FQDN. Check your thumbprints against what you have installed on the server. 
To get your sha1 thumbprint on the crt, you can use the following:
openssl x509 -noout -in /etc/apache2/ssl/wiki.crt -fingerprint -sha1

Compare the fingerprint here with the thumbprint listed when you inspect the certificate. 


  1. Nice blog post your gave for us. I heartfully thank you and i request you to add more informations like this in future.
    I have to appreciate you for your great work which you had done in your blog.i want you to add more like this.
    JAVA Training in Chennai
    JAVA Course in Chennai
    Digital Marketing Course in Chennai
    Python Training in Chennai
    Big data training in chennai
    Selenium Training in Chennai
    JAVA Training in Chennai
    JAVA Course in Chennai

    1. IEEE Final Year projects Project Centers in Chennai are consistently sought after. Final Year Students Projects take a shot at them to improve their aptitudes. IEEE Final Year project centers ground for all fragments of CSE & IT engineers hoping to assemble.Final Year Projects for CSE

      Spring Framework has already made serious inroads as an integrated technology stack for building user-facing applications. Spring Framework Corporate TRaining .

      Specifically, Spring Framework provides various tasks are geared around preparing data for further analysis and visualization. Spring Training in Chennai

      The Angular Training covers a wide range of topics including Angular Directives, Angular Services, and Angular programmability.Angular Training