SSL certificate renewal notes 2008 Edit

Created 4/23/2008, updated 5 weeks ago

My previous SSL certificate was a RapidSSL-issued certificate, and the cheapest reseller I could find at time of renewal (late April 2008) was ServerTastic (a 5-year renewal for $50, or $10 per year).

The basic process for renewal is:

Go to servertastic
Go through the checkout process
Receive email with link to page where you submit your CSR (Certificate Signing Request)
Generate the CSR and paste it into the web page from the previous step
Receive another email requesting approval to generate a new certificate
Install the new certificate

Generating the CSR

Instructions for how to do this appear here, and for Apache with mod_ssl specifically here.

cd path/to/ssl/certs/and/keys

# move old CSR out the way
mv wincent.dev.csr.rapidssl wincent.dev.csr.rapidssl.2007

# create a new CSR
openssl req -new -key server.key -out wincent.dev.csr.rapidssl.2008

# review the new CSR, comparing it against the previous one for correctness
openssl req -noout -text -in wincent.dev.csr.rapidssl.2008
openssl req -noout -text -in wincent.dev.csr.rapidssl.2007

Here is how I answered the questions during CSR generation:

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:AU
State or Province Name (full name) [Berkshire]:South Australia
Locality Name (eg, city) [Newbury]:Rundle Mall
Organization Name (eg, company) [My Company Ltd]:wincent.dev
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:wincent.dev
Email Address []:example@example.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

Installing the new certificate

Apache

RapidSSL provides installation instructions for Apache running mod_ssl.

# move old certificate backup out of the way
mv wincent.dev.crt.rapidssl wincent.dev.crt.rapidssl.2007

# put the new certificate where Apache expects to find it
cp wincent.dev.crt.rapidssl.2008 wincent.dev.crt

# go live with the new certificate
apachectl configtest
apachectl graceful

Visting a secure URL confirms that the new certificate is valid until 23 May 2013.

Sendmail

cd /etc/pki/tls/certs

# move old backup out the way
mv sendmail.pem.rapidssl sendmail.pem.rapidssl.2007

# install new certificate
cp /path/to/wincent.dev.crt.rapidssl.2008 sendmail.pem.rapidssl.2008
cp sendmail.pem.rapidssl.2008 sendmail.pem

# go live with the new certificate
service sendmail restart

I first did some elementary testing from Mail.app using the "Connection Inspector" window. I then followed this up with a telnet-style test:

openssl s_client -starttls pop -connect wincent.dev:25

Cyrus

cd /etc/pki/cyrus-imapd

# make backup
cp cyrus-imapd.pem cyrus-imapd.pem.rapidssl.2007

# install new certificate, ensuring correct permissions
cp /etc/pki/tls/certs/sendmail.pem.rapidssl.2008 cyrus-imapd.pem.rapidssl.2008
chown cyrus:mail cyrus-imapd.pem.rapidssl.200*
cp cyrus-imapd.pem.rapidssl.2008 cyrus-imapd.pem

# go live with the new certificate
service cyrus-imapd restart

Again, I tested using Mail.app and also did the following tests in the Terminal:

# test secure IMAP
openssl s_client -connect wincent.dev:993

# test secure POP
openssl s_client -connect wincent.dev:995

SSL certificate renewal notes 2008Edit