4

I recently got a mail from my hosting server that the SSL certificate for one of my Wordpress website is about to expire in 5 days.

It says the certificate needs to be renewed; this can be done using the 'genkey' program. I'm not sure how to do that. I didn't use self-signed certificate rather bought from GeoTrust Inc.

They do have a renew option but I'm not sure how to use that in my server. How can I make use of 'genkey' program? I'm using RHEL 5 OS.

Kenny Rasschaert
  • 9,045
  • 3
  • 42
  • 58
harithahv
  • 43
  • 1
  • 2
  • 4

1 Answers1

4

You need to generate a Certificate Signing Request (CSR) and submit it to GeoTrust. They will sign the CSR and give you a certificate. This certificate will be associated with a private key that will be created when you generate the CSR. Your web server will require both the cert and the private key to function.

Here are some docs on certificates:

http://www.openssl.org/docs/HOWTO/certificates.txt

That's using openssl, which you should already have installed on CentOS5.

Note that the command they give is a bit outdated; certificate signing authorities like GeoTrust are now requiring 2048-bit keys. So, your command will be:

$ openssl req -new -key privkey.pem -out cert.csr -newkey rsa:2048

You can change the names of cert.csr (which is the CSR) and privkey.pem (which is the private key) to something more appropriate, e.g., www.example.com-csr.pem and www.example.com-key.pem.

The important part of the CSR will be the Subject of the signing request. This should match the name of the web site (e.g., www.example.com) or be a wildcard (*.example.com). Make sure this matches correctly or your site will generate SSL warnings.

GeoTrust should have more instructions on what they require for CSRs. Note that the resulting CSR is a text file; I imagine you will copy-and-past the contents of the file into some form at the certificate signing authority.

When you install the certificate and key, there will likely also be a intermediate certificate authority bundle provided by GeoTrust. As said, GeoTrust will have instructions on how to arrange these files for most common web servers.

cjc
  • 24,916
  • 3
  • 51
  • 70
  • 1
    Note that the CSR is mostly used by the CA to extract a public key. The rest of the information tends to be there as an indication for them: they'll replace any attribute and RDN in the Subject DN as they wish (as they should indeed do, since they're the certificate issuer). Whether your get the name right in the CSR shouldn't matter too much, but you must get the host name right in whatever forms you fill when doing the application. – Bruno Jan 30 '12 at 09:52