On CentOS or RedHat Distributions

Step One: Generate the Key and Certificate Request

Warning: The following two commands overwrite files if they already exist. Be sure to make a copy of any residual files, including priv.key and com.csr before running (e.g., sudo cp /etc/pki/tls/req/example.domain.priv.key /etc/pki/tls/req/example.domain.priv.key.backup_date)

Generate the Private Key:

sudo openssl genrsa -out /etc/pki/tls/req/server.domain.com.priv.key 2048

Ex: sudo openssl genrsa -out /etc/pki/tls/req/myserver.domain.com.priv.key 2048

Generate the Certificate Signing Request (CSR):

sudo openssl req -new -key /etc/pki/tls/req/server.domain.com.priv.key -out /etc/pki/tls/req/server.domain.com.csr

Ex: sudo openssl req -new -key /etc/pki/tls/req/myserver.domain.com.priv.key -out /etc/pki/tls/req/myserver.domain.com.csr

Fill out the prompts appropriately. The most important line is the one that requests the Common Name. You need to enter the **full domain name** (or public IP address if you do not have a domain) that you want to be associated with your server.

The full list of prompts will look something like this (use generic placeholders):

Country Name (2 letter code) [XX]: (Company Country) US
State or Province Name (full name) []: (Company State) Pennsylvania
Locality Name (eg, city) [Default City]: (Company City) Pittsburgh
Organization Name (eg, company) [Default Company Ltd]: (Company Name) Example Org Inc.
Organizational Unit Name (eg, section) []: (Optional, usually leave blank)
Common Name (eg, your name or your server's hostname) []: ( Exact hostname/domain, most important field ) your-site.com
Email Address []: ( Leave Blank )

If asked for a challenge password or an optional company name, don't enter anything, just leave the fields blank.

Step Two: Ordering / Renewing an SSL Certificate

Login

Go to your Certificate Authority's login page (e.g., https://www.your-ca-provider.com/login).
Enter your account credentials (refer to your internal documentation for credentials).

Ordering New SSLs

Go to Certificates > Orders
Select "Request a Certificate"
1. Pick the appropriate certificate type (e.g., **RapidSSL Standard DV**).
Paste the contents of the CSR file
Keep "Include both your-domain and www.your-domain in the certificate" enabled.
Select 1 year. This is the default duration choice.

Under "Prove Control of your domain" > DCV verification method, pick a verification method.
1. TXT:
  1. Requires a TXT record with a randomized code to be added to the DNS records.
  2. If we are the DNS host, this is the fastest route.
  3. You will want it added to the base domain (e.g. example.com not www.example.com).
2. Email:
  1. Requires one of the email addresses listed on the administration of the domain to approve the order, via a link in the email.
  2. Clients may not be aware if the default addresses forward to them or not. If their email is listed on the domains admin records, the client can approve the ssl.
3. File:
  1. Requires the webhost to upload a file in a specific location with a randomized code.
  2. It appears that this would need the file on the domain being verified, meaning the A record would already need to be pointed. That would make this unsuitable for getting the SSL before go-live.
  3. Reference Link to CA's File Validation KB
After getting approval, install the cert.

Renewals

Go to Certificates > Expiring Certificates.
Find the row with the same common name for the site you are getting the SSL for.
Click the Renew button.
Enter the CSR from /etc/pki/tls/req/server.domain.com.csr
Double check the common name.
Keep Include both your-domain and www.your-domain in the certificate checked.
Select 1-year for How long do you need to protect your site?
Change Prove Control over your domain to the method used last year.
Add Technical Contact:
1. First Name
2. Last Name
3. Title (or leave blank)
4. Phone Number
5. E-mail address
Click the checkbox for I agree to the Certificate Services Agreement.
Review all information above to make sure it is correct.
Press Submit Certificate Request.
Select the verification method (email or ask if any of the emails are available).
1. If unable to use email, confirm the order via a TXT record.

TXT DNS Record Instructions

Place the order
Contact support via chat and notify them that you would like to verify the order with a TXT record on the DNS. (The original link to a specific CA has been removed.)
They will provide a code to add into the DNS record.
Now add the TXT code
1. If the client owns the domain and uses someone else's nameservers, then the client will need to do this.
  1. Reference your registrar's instructions for adding a TXT record. (Original link to GoDaddy KB removed.)
2. If using your own name servers for the dns host, you can do this.
  1. See your provider for the correct nameservers. But typically they are ns1.provider.tld and ns2.provider.tld
Check that the record has been added.
1. Use a DNS lookup tool (e.g., mxtoolbox.com)
Contact support again and ask them to confirm the order now. Once this is done, the order is complete.

VERIFY THAT THE NEW CERTIFICATE HAS THE WWW SUBDOMAIN!

Step Three: Incorporating the new Cert

Once the owner of the domain has confirmed the SSL Cert Request you will get an email that contains the cert, or check the portal to see if the cert has been issued / approved.

Copy the main certificate as: /etc/pki/tls/certs/server.domain.com.crt
Copy Key from /etc/pki/tls/req/server.domain.com.priv.key to /etc/pki/tls/private/server.domain.com.priv.key
- cp /etc/pki/tls/req/server.domain.com.priv.key /etc/pki/tls/private/server.domain.com.priv.key
Copy the chain certificate into /etc/pki/tls/certs/server.domain.com.chain.crt
- The chain certificate appears to be included in the zip file provided by the CA (e.g., your-domain_com_DigiCertCA.crt)

Certificates generated before 7/30/2020 should have used the following intermediate certificate:

Certificates generated after 7/30/2020 should use the following intermediate certificate instead:

Now edit following directives in /etc/httpd/conf.d/ssl.conf (replace the wildcard path with the new files):
- For existing clients with multiple sites where the ssl.conf still has wildcard, check other files in the same directory for more specific VHosts.

SSLCertificateFile /etc/pki/tls/certs/server.domain.com.crt
SSLCertificateKeyFile /etc/pki/tls/private/server.domain.com.priv.key
SSLCertificateChainFile /etc/pki/tls/certs/server.domain.com.chain.crt

/etc/httpd/conf.d/ssl.conf Example

Listen 443 https

SSLPassPhraseDialog      builtin
SSLSessionCache          shmcb:/run/httpd/sslcache(512000)
SSLSessionCacheTimeout  300

SSLRandomSeed            startup file:/dev/urandom  256
SSLHonorCipherOrder      on
SSLCompression           off
SSLCryptoDevice          builtin
SSLRandomSeed            connect builtin
SSLProtocol              all -SSLv2 -SSLv3 -TLSv1
SSLCipherSuite           ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-A$

<VirtualHost _default_:443>
  ErrorLog logs/ssl_error_log
  TransferLog logs/ssl_access_log
  LogLevel warn
  SSLEngine on
  SSLCertificateFile /etc/pki/tls/certs/server.domain.com.crt
  SSLCertificateKeyFile /etc/pki/tls/private/server.domain.com.priv.key
  SSLCertificateChainFile /etc/pki/tls/certs/server.domain.com.chain.crt
  <files>
    SSLOptions +StdEnvVars
  </files>
  <directory>
    SSLOptions +StdEnvVars
  </directory>
  CustomLog logs/ssl_request_log \
    "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
  SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
  AllowEncodedSlashes On
</VirtualHost>

Restart Apache:
```
systemctl restart httpd
```
- If you get an error on this step, you may need to:
  - ```
  yum install mod_ssl
```

Sign In

Step by Step: Ordering and Setting Up an SSL Certificate

On CentOS or RedHat Distributions

Step One: Generate the Key and Certificate Request

Step Two: Ordering / Renewing an SSL Certificate

Login

Ordering New SSLs

Renewals

Step Three: Incorporating the new Cert

Services

Community

Members

Resources

Important Information