Novell LINUX ENTERPRISE SERVER 10 - INSTALLATION AND ADMINISTRATION 11-05-2007, Руководство по установке

Страница: 788 / 982

8
Encrypting RSA private key of CA with a pass phrase
for security
It is strongly recommended to encrypt the private key of the CA with a password,
so choose
Y and enter a password.
9
Encrypting RSA private key of SERVER with a pass phrase
for security
Encrypting the server key with a password requires you to enter this password
every time you start the Web server. This makes it difficult to automatically start
the server on boot or to restart the Web server. Therefore, it is common sense to
say
N to this question. Keep in mind that your key is unprotected when not en-
crypted with a password and make sure that only authorized persons have access
to the key.
IMPORTANT: Encrypting the Server Key
If you choose to encrypt the server key with a password, increase the
value for
APACHE_TIMEOUT
in
/etc/sysconfig/apache2
. Otherwise
you do not have enough time to enter the passphrase before the attempt
to start the server is stopped unsuccessfully.
The script's result page presents a list of certificates and keys it has generated. Contrary
to what the script outputs, the files have not been generated in the local directory
conf
,
but to the correct locations under
/etc/apache2/
.
The last step is to copy the CA certificate file from
/etc/apache2/ssl.crt/ca
.crt
to a location where your users can access it in order to incorporate it into the list
of known and trusted CAs in their Web browsers. Otherwise a browser complains that
the certificate was issued by an unknown authority. The certificate is valid for one year.
IMPORTANT: Self-Signed Certificates
Only use a self-signed certificate on a Web server that is accessed by people
who know and trust you as a certificate authority. It is not recommended to
use such a certificate on a public shop, for example.
770 Installation and Administration