SSL Certificate Configuration on CentOS 7

 

To configure SSL certificates on CentOS 7, you typically need to install and configure the OpenSSL package, generate or obtain SSL certificates, and then configure the web server (such as Apache or Nginx) to use these certificates. Here's a general overview of the steps involved:

Install OpenSSL:

If OpenSSL is not already installed, you can install it using the package manager (yum or dnf) on CentOS 7:

sudo yum install openssl

Generate SSL Certificate:

You can generate a self-signed SSL certificate for testing purposes using the OpenSSL req command. Replace example.com with your domain name:

sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/example.com.key -out /etc/ssl/certs/example.com.crt

This command generates a self-signed SSL certificate (example.com.crt) and its corresponding private key (example.com.key) and stores them in the specified directories.

Configure Web Server:

a. Apache: Edit the Apache configuration file (/etc/httpd/conf.d/ssl.conf) to specify the SSL certificate and key file paths:

SSLCertificateFile /etc/ssl/certs/example.com.crt

SSLCertificateKeyFile /etc/ssl/private/example.com.key

Then, restart Apache to apply the changes:

sudo systemctl restart httpd

Nginx: Edit the Nginx configuration file (/etc/nginx/nginx.conf or /etc/nginx/conf.d/default.conf) to specify the SSL certificate and key file paths:

ssl_certificate /etc/ssl/certs/example.com.crt;

ssl_certificate_key /etc/ssl/private/example.com.key;

Then, restart Nginx to apply the changes:

sudo systemctl restart nginx

Verify SSL Configuration:

After configuring SSL, you can verify the setup using a web browser by accessing your website using the https:// protocol. You should see a padlock icon indicating that the connection is secure.

Renewal and Maintenance:

If you're using a self-signed certificate, remember to renew it before it expires. For production environments, consider obtaining SSL certificates from a trusted Certificate Authority (CA) and configuring certificate renewal mechanisms as necessary.

Remember to replace example.com with your actual domain name and adjust file paths as needed based on your server configuration. Additionally, ensure that the SSL configuration complies with best practices for security and performance.