2

I believe I understand how OpenSSL works, and I believe I have a good game plan for setting up an SSL server on my private network, but before I go through the process of downloading and configuring all the necessary software, I wanted to post this question as a sanity check.

Please correct me if any of the following are not true:

  • OpenSSL is a compiled (probably C/C++) library that I can download onto my linux server; it will then give me command-line tools that I can call from external applications or directly at the terminal
  • The Java keytool can be used to generate CSRs and private keys that will be needed by OpenSSL
  • To obtain an SSL certificate through OpenSSL, I start by using keytool to generate the CSR, and then, somehow (probably as an argument?), pass that CSR on to OpenSSL through the command-line interface

Again, if any of these are false, please begin by correcting me!

Now then, assuming I am on the right track, I have one major concern with this method:

Although a free option, wouldn't this mean that any web browser attempting to connect to my server over HTTPS would not recognize my CA cert and throw a nasty warning message my end users?

If not, please explain why. If so, then one solution I was hoping to explore was a situation where I buy my primary SSL certificate from a commercial provider (Verisign, Trustwave, GeoTrust, whoever) and then somehow use OpenSSL to "branch off" from that cert for all of my sub-domains.

The goal here is to get several SSL certs on the cheap, but still have them be authentic and thus trusted by my end user's browsers.

Any chance this is a possibility or will I have to go through a commercial vendor?

Improve this question
1
  • You are correct in assummptions and concerns. Search for self-signed certificate and you will find troves of information. Bottom line is PKI certs are about trust and strangers don't have a simple way to trust your self-signed certificate thus they will be warned...
    – zedman9991
    Jul 2, 2012 at 13:01

1 Answer 1

Reset to default
2

Your assumption are slightly incorrect, and I'll tell why: to generate a csr, you can use either openssl or keytool.

  • if you have a Linux-based sserver like Apache, use openssl to generate the csr/private key, the certificate is then installed referencing the certificate (public key), the private key and the intermediates in the configuration file.
  • if you have a Java-based server like Tomcat, Glassfish, etc., use keytool to generate the keystore and the csr/private key, then install the certificate in the correct format.

I reckon browsing the knowledgebase of one of the CA authorities you mentioned above will give you all the details that you need.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .