The Official Way
The certificate is a valid legal identification for a person/company/agency. As with any formal document you have to obtain it from an official Certificate Authority. There are many.
As a developer you have to get from them at least 2 certificates: one for your server, and one for you as a client. To get them you have to do a requisition. When you do this you'll be granted your certificate and your private key file for every certificate.
After this legal process you can install it on your apache server like this:
- First you install the certificate chain in the server. These are some certificates, publicly available from the CA (certificate authority).
- This chain, can be only one root certificate or many.
- If there are many you put them all in a file together. There are other ways but I
found this one to be better.
Then you add this lines to you apache configuration:
SSLOptions +StdEnvVars +ExportCertData
SSLCertificateFile /home/<youruser>/<yourCertFolder>/server.crt #server file
SSLCertificateKeyFile /home/<youruser>/<yourCertFolder>/server.key #server private key
SSLCertificateChainFile /home/<youruser>/<yourCertFolder>/rootCA.crt #server certificate chain
SSLCACertificateFile /home/<youruser>/<yourCertFolder>/rootCA.crt #server CA certicate file (if you're in the test process below, should be the same file above)
- Go to your browser and import the certificate chain of the CA that issued the certificates.
- Import your personal certificate to it. There are some certificate types. If you bought A1 (files) certificates you just import it to the browser. If you bought an A3 token (like an USB flashdrive but for certificates) you have to first load the driver to the browser and then it will import it automatically when you enter a SSL enabled site.
- The certificate you're using in the browser has to have the exact same certificate chain than the server is using or the server won't be able to validate it.
- After this you should see a window asking you to select you cerficate when entering the site.
Lot of stuff huh ? believe me, learning this was an harsh process.
The Test Way
But there is something you can use as a test process. You can create you own CA and emmit your own certificates locally in your server and development machine. Here's how you do it:
First install openssl in your machine if it's not already installed. Then use these scripts:
Create CA and server certificate:
echo "Create CA private key"
openssl genrsa -des3 -passout pass:123 -out ./rootCA.key 2048
echo "Remove passphrase"
openssl rsa -passin pass:123 -in ./rootCA.key -out ./rootCA.key
echo "Create CA self-signed certificate"
openssl req -config openssl.cnf -new -x509 -subj '/C=US/L=Dev/O=COMPANY/CN=CA' -days 99999 -key ./rootCA.key -out ./rootCA.crt
echo "Create private key for the server"
openssl genrsa -des3 -passout pass:123 -out ./server.key 2048
echo "Remove passphrase"
openssl rsa -passin pass:123 -in ./server.key -out ./server.key
echo "Create CSR for the server"
openssl req -config ./openssl.cnf -new -subj '/C=US/L=Dev/O=COMPANY/CN=server' -key ./server.key -out ./server.csr
echo "Create certificate for the server"
openssl ca -batch -config ./openssl.cnf -days 999 -in ./server.csr -out ./server.crt -keyfile ./rootCA.key -cert ./rootCA.crt -policy policy_anything
if [[ -z "$1" || -z "$2" ]]; then
echo "Use: issueCertificate <NAME>"
echo -e "\nCreating folder... "
echo -e "\nCreating private key... "
openssl genrsa -des3 -passout pass:123 -out ./$ARQ/$ARQ.key 2048
echo -e "\nRemoving password..."
openssl rsa -passin pass:123 -in ./$ARQ/$ARQ.key -out ./$ARQ/$ARQ.key
echo -e "\nCreating CSR... "
openssl req -config ./openssl.cnf -new -subj "$DN" -key ./$ARQ/$ARQ.key -out ./$ARQ/$ARQ.csr
echo -e "\nCreating client certificate"
openssl ca -batch -config ./openssl.cnf -days 999 -in ./$ARQ/$ARQ.csr -out ./$ARQ/$ARQ.crt -keyfile ./rootCA.key -cert ./rootCA.crt -policy policy_anything
echo -e "\nExport client to pkcs12 and import in browser"
openssl pkcs12 -export -passout pass:123 -in ./$ARQ/$ARQ.crt -inkey ./$ARQ/$ARQ.key - certfile ./rootCA.crt -out ./$ARQ/$ARQ.p12
So I guess that's all. I've has to translate some things and change some var names and constants in order to remove my company's name and this whole process is rather complex. So I appologize if I forgot something or something doesn't work. Please inform and I'll correct promptly.
Good luck. :)