forked from linux/documentation
66 lines
1.6 KiB
Markdown
66 lines
1.6 KiB
Markdown
# Static HTTPS Certificates
|
|
|
|
For static HTTPS certificates, we use DigiCert certificates.
|
|
|
|
|
|
## Request a Certificate
|
|
|
|
First create a certificate signing request (CSR) like this, replacing the values for `FQDN`
|
|
and `ALIASES`
|
|
|
|
```
|
|
|
|
ALIASES=xyz.psi.ch
|
|
FQDN=xyz00.psi.ch
|
|
|
|
cat >$FQDN.cnf <<EOF
|
|
FQDN = $FQDN
|
|
ORGNAME = Paul Scherrer Institut (PSI)
|
|
|
|
ALTNAMES = DNS:\$FQDN $ALIASES
|
|
|
|
# --- no modifications required below ---
|
|
[ req ]
|
|
default_bits = 2048
|
|
default_md = sha256
|
|
prompt = no
|
|
encrypt_key = no
|
|
distinguished_name = dn
|
|
req_extensions = req_ext
|
|
|
|
[ dn ]
|
|
C = CH
|
|
O = \$ORGNAME
|
|
CN = \$FQDN
|
|
OU = AWI
|
|
|
|
[ req_ext ]
|
|
subjectAltName = \$ALTNAMES
|
|
|
|
EOF
|
|
|
|
/usr/bin/openssl req -new -config $FQDN.cnf -keyout $FQDN.key -out $FQDN.csr
|
|
|
|
```
|
|
|
|
Finally, [submit the CSR](https://www.digicert.com/secure/requests/products?guest_key=11dqrl7540p3t4jm4qhnvsnzjkvk).
|
|
Please note that the URL will work when accessed from PSI network (e.g. VPN).
|
|
|
|
DigiCert will send an email including instructions on how to download the certificate.
|
|
|
|
Our teams practice is to always create a new private key and to back it up encrypted in Gitea, either
|
|
- in Hiera as [EYAML](https://linux.psi.ch/admin-guide/puppet/hiera#secret-values)
|
|
- for central infrastructure hosts GPG encrypted in their [bootstrap repository](https://gitea.psi.ch/lx/bootstrap)
|
|
- for the rest in our [team secret store](https://gitea.psi.ch/lx/core-linux-secrets)
|
|
|
|
|
|
## Renew Certificate
|
|
|
|
Using the same configuration file as above, generate a new private key and CSR,
|
|
and submit the CSR as before.
|
|
|
|
|
|
## Revoke Certificate
|
|
|
|
If you would like to revoke a DigiCert certificate, please send an e-mail to pki@psi.ch
|