| 1 | | [[TranslatedPages]] |
| 2 | | = How do I enable my site to be accessed securely (via https)? = |
| 3 | | |
| 4 | | Please see ticket #407 - includes a proposal for changing this process. Until that ticket is closed, please take the following steps to add a ssl certificate and key to your web site. |
| 5 | | |
| 6 | | If you want to learn more about SSL certificates, please see our [wiki:what_is_an_ssl_certificate related FAQ]. |
| 7 | | |
| 8 | | 1. Submit a [/newticket new ticket] requesting a dedicated IP address. |
| 9 | | 1. Once you receive the IP address, login to the [https://members.mayfirst.org/cp Members Control Panel], select your DNS service, and edit the records of type "A," changing the IP address of these records to match the IP address you were assigned. |
| 10 | | 1. Generate a private key. Ideally you should take this step on a secure personal computer and then copy the key to our server, however, you can [wiki:secure_shell secure shell] into our servers and run the following commands from a terminal. If you are windows user, you can [http://www.openssl.org/related/binaries.html downloand OpenSSL for windows], linux and MacOSX users will most likely have it installed already. You can create a private key by typing: |
| 11 | | {{{ |
| 12 | | openssl genrsa -out yourdomain.org.key 2048 |
| 13 | | }}} |
| 14 | | 1. You should change the permission on the key so that it is not world readable: |
| 15 | | {{{ |
| 16 | | chmod 440 yourdomain.org.key |
| 17 | | }}} |
| 18 | | 1. Next, generate a certificate signing request: |
| 19 | | {{{ |
| 20 | | openssl req -new -key yourdomain.org.key -out yourdomain.org.csr |
| 21 | | }}} |
| 22 | | 1. You will be prompted to answer several questions. Most of the are self-explanatory. The most critical question, however, is not very intuitive: The common name. When you are asked to enter the common name be sure to enter your domain name exactly as you want people to access it. If you want people to access your site using https://www.example.org, then enter: www.example.org. If you want people to access your site using https://example.org, then enter: example.org as the common name. The certificate signing request is now in the file this command created (whatever file name you chose for `yourdomain.org.csr`) |
| 23 | | 1. Next, submit your certificate signing request to a certificate authority. They will charge you a fee and return a certificate file. At this point, you will have three files: a key, a certificate signing request, and a certificate file. |
| 24 | | 1. Keep a backup of all of these files in a safe place (safe - meaning they will not be overwritten ''and'' meaning they will not be easy accessed by others). |
| 25 | | 1. Create a directory on our server called ssl in your include directory. Make sure this directory is only readable by you: |
| 26 | | {{{ |
| 27 | | chmod 750 ssl |
| 28 | | }}} |
| 29 | | 1. Copy both your key and your certificate file into this directory |
| 30 | | 1. Go to the [https://members.mayfirst.org/cp Members Control Panel] and select the Web Config service |
| 31 | | 1. Click to add a new item. Select status enabled, choose the user that owns your existing web directory, for port choose "https" and for IP address, enter the IP addressed assigned to you in the first step. |
| 32 | | 1. Before submitting, add the following lines to the settings (be sure to edit these lines to match your directories!) |
| 33 | | {{{ |
| 34 | | # SSL Stuff |
| 35 | | SSLEngine On |
| 36 | | SSLCertificateFile /home/members/your-member-name/sites/your-domain-name/include/ssl/yourdomain.crt |
| 37 | | SSLCertificateKeyFile /home/members/your-member-name/sites/your-domain-name/include/ssl/yourdomain.key |
| 38 | | }}} |
| 39 | | |
| | 1 | Please see [wiki:faq/security/get-certificate] |
