Understanding Certs

[IT_Architect]

Apparently, I don't understand certs. To save time, I'll tell you what I THINK I know, and your can correct me where I'm wrong.

There are two pieces to the security and they must match, the public certificate and the private key. The private key is generated off the server key when you create the CSR using the information you provide to create the CSR. When you submit your csr, they can generate a cert that matches your private key without actually having it. When they send the cert back, you have both halves, and the rest of the world only sees the cert. Third parties can get the cert from the CA or your can give it to them and their browser or other program can check the validity of the certificate with the CA. The one you need to hide, is the private key.

Apache by default keeps the cert and the key in /etc/httpd/conf/ssl.crt and /etc/httpd/conf/ssl.key respectively by virtue of the DA install which places the following entries into the httpd.conf file located in /etc/httpd/conf/httpd.conf file:
SSLCertificateFile /etc/httpd/conf/ssl.crt/server.crt
SSLCertificateKeyFile /etc/httpd/conf/ssl.key/server.key

The ips.conf, in the same directory, and included by the httpd.conf, shows an IP address as well as something called Servername shared.domain, which is oddly on an IP address that is not the server's base address. It also points to a non-visible domain named /home/admin/domains/sharedip. I thought that address was available to be assigned to someone else as a private IP? I don't understand this.

I appears that the cert last made by the admin user, ends up in the in /etc/httpd/conf/ssl.crt and /etc/httpd/conf/ssl.key directories, although, one was named .tmp rather than the extension it should have.

Once the new cert works with Apache, you can copy the cert and key to the DirectAdmin area at /usr/local/directadmin/conf, chown them to root:directadmin, chmod, and modify the DirectAdmin.conf accordingly to use this copy of the files.

There is obviously something wrong with what I THINK I know. Before I ever make it to the DirectAdmin are, I have Apache problems whenever I restart Apache. BTW, to see the error on the command line, I need to restart Apache twice.) The sites don't even come up much less the SSL work.

Apparently I have some fuzzy logic that needs to be clarified. For one, what is it doing using the .93 address in the ips.conf file when the domain with the cert, and server domain, use the .90 address, and DA shows everyione sharing the .90 address, not the .93 address? (Which I cannot be sure was ever set up correctly by the DC in the first place.)

I'm sure there are other connections I'm not making, but I would think Apache wouldn't have a cow if my new cert and key matched in the /etc/httpd/conf/ssl.crt and /etc/httpd/conf/ssl.key directories, but it does.

What I need is a clear view of how this all works, and where my logic is faulty.

Thanks!

 

[nobaloney]

I presume you're asking about your server cert.

Permission and ownership are very important.

Jeff

 

[IT_Architect]

I presume you're asking about your server cert. Jeff

Exactly!

Permission and ownership are very important. Jeff

I set it to what the old one was which was root:directadmin. I'm not confident though that the now expired cert was ever set up correctly by the hosting company, so I'm likely working with a faulty model to begin with. In the ips.conf it uses the .93 address for the the shared, while the server, domain, and the IP shown as shared in the control panel is .90. The 93 address is theoretically available to be assigned as a dedicated. Be that as it may, at least it runs. When I replace the old cert with the new one, I kill Apache.

I'll keep in mind what you said about permission and ownership. I keep good backups so I can get back to where I was. I also use a thread that you started about shared certs,http://www.directadmin.com/forum/showthread.php?t=3816, quite some time ago on the subject while trying to put together a plan that works here.

I have a brand new quad core server with DA with no certs set aside for a new business. I could set up a new one on that since according to this thread, http://www.directadmin.com/forum/showthread.php?t=1741, any cert installed by admin will be setup as the shared certificate. Then I can see how it is supposed to be, hopefully, and use the same concept on this server.

If you have anything else you'd like to throw into the mix, it would be appreciated.

Thanks!

 

[nobaloney]

I'm going to let you do the testing on this one .

I'll continue to watch if you add anything to the thread.

I'm off to pick up 5 1-U servers.

Jeff