Novell IFOLDER 3 - ADMINISTRATION, Manual

Page: 134 / 148

134 Novell iFolder 3.x Administration Guide
no
vd
ocx (
E
NU)
01
F
ebr
ua
ry
200
6
YaST contains modules for the basic management of X.509 certificates. This mainly involves the
creation of CAs, sub-CAs, and their certificates. For more information about how to manage and
update certificates, see
Managing X.509 Certification (http://www.novell.com/documentation/
sles10/sles_admin/data/cha_yast_ca.html) in the SUSE Linux Enterprise Server 10 Installation and
Administration Guide (http://www.novell.com/documentation/sles10/sles_admin/data/
bookinfo_book_sles_admin.html) .
C.2 Generating a Self-Signed SSL Certificate for
Testing Purposes
If desired, you can use OpenSSL to create a self-signed SSL certificate to test your configuration.
Because the certificate is not from a trusted certificate authority, users receive a warning when
connecting to the server that the originator of the certificate cannot be verified. However, the traffic
between the server and the client is encrypted at the same level of security that an official certificate
generates.
WARNING: The self-signed certificate works correctly for testing purposes but should not be used
in an operational deployment, especially when connections cross public communications networks
such as the Internet.
1 Make sure you have a valid DNS name registered to a valid IP address on your network.
For a cluster solution, this should be the highly available DNS name and IP address of the
cluster.
2 Create a private key (
.key
file). At a terminal console, enter
openssl genrsa -out filename .key 1024
Replace filename with the name you want to use for the key.
3 Create a certificate-signing request (
.csr
file), using the private key (
filename .key
) you
created in Step 2 .
3a At a terminal console, enter
openssl req -new -key filename .key -out filename .csr
3b When prompted, enter the following information:
• Locality
• Common name (domain name)
iFolder 3. x requires accurate information for the common name of your Apache 2
server. For example, if you enter ifolder3.example.com, this common name should be
a valid DNS name that is registered to a valid IP address on your network.
• Organization
• Other information
4 Generate the self-signed certificate (
.cert
file), using the private key ( filename .key) you
created in Step 2 and the certificate-signing request ( filename .csr) you created in Step 3 . At a
terminal console, enter
openssl x509 -req -days 30 -in filename .csr -signkey filename .key
-out filename .cert