SSL certificates are very cheap these days. If fact, certain Certificate Authorities will issue you a SSL certificate for free. You just have to fill out the application form.
There are, however, certain cases where you want to quickly issue a self-signed certificate. For instance, when you are testing a server, or running your own personal e-mail server. If that situation applies to you, read on.
Ubuntu comes pre-installed with a package called
ssl-cert, which creates a private key and self-signed certificate in these locations:
So, if you are just looking for a self-signed certificate, you don’t need to do anything else! But, if that’s still not enough for you, read on.
To create your own, custom SSL certificate you have to use OpenSSL, which typically comes pre-installed on Ubuntu. You can verify with:
$ openssl version
OpenSSL 1.0.1f 6 Jan 2014
Running this command will generate a private key, and a self-signed certificate valid for 365 days:
$ openssl req -x509 -days 365 -newkey rsa:2048 -nodes -keyout personal.key -out personal.pem
Country Name (2 letter code) [AU]:US State or Province Name (full name) [Some-State]:California Locality Name (eg, city) :San Francisco Organization Name (eg, company) [Internet Widgits Pty Ltd]:Example Inc Organizational Unit Name (eg, section) :IT Common Name (e.g. server FQDN or YOUR name) :www.example.com Email Address :firstname.lastname@example.org
The generated private key is not encrypted, so make sure that only root has read access:
$ chown root:root personal.key && chmod 640 personal.key
That’s it! You can now copy
/etc/ssl/certs/ respectively, and use them in your configuration files.