Forum

startssl free ssl certificate installatie

da_jojo

17 February 2011, 05:23

It took me some while to figure this out , so i thought i put it here for reference.
www.startssl.com gives free class 1 certificates so one dont have to look at this nasty certificate error screen anymore.
If you filled out all forms there you end up with a certificate and a login for the controlpanel (it uses the same certificate you made... i like to have this some day,it totally rulez)
In the controlpanel there is a certificate wizard which makes you a privatekey (choose 2048) and a server certificate.
Now here is the trick: the privatekey is encrypted , so you need to decrypt it first by using openssl . for windows this is :
(dont forget run as administrator cmd)

openssl rsa -in ssl.key -out decryptedssl.key

now you have this files : decryptedssl.key (decrypted privatekey), server.cer (the server certificate) , http://www.startssl.com/certs/ca.pem (startssl main certificate), http://www.startssl.com/certs/sub.class1.server.ca.pem (startssl sub certificate)

It is time to put this together in a working thing.
rightmousebutton and choose make new txt document. name it : server.pem
open it and keep it open.
now open the decryptedssl.key in a new notepad window. copy all and paste it into the server.pem , then press enter after the paste code and on next line ""
now open server.cer in a new notepad window and copy the contents. paste it on the next line after "" in server.pem, then type on next line : ""
now open ca.pem in a new notepad window and copy the contents. paste it after the enter/return in server.pem and type on the next line: ""
now open sub.class1.server.ca.pem in a new notepad window and copy the contents. paste it in server.pem on the next line after the ""
close and write the server.pem

in hiawatha add in config :

Binding {
        BindingID = SSL
        Port = 443
        SSLcertFile = C:\Program Files\Hiawatha\config\server.pem
        MaxKeepAlive = 30
        TimeForRequest = 3,20
        MaxRequestSize = 512
}

the server.pem should look like this:

Hiawatha version: 7.4
Operating System: Windows 7 X64

Hugo Leisink

17 February 2011, 08:40

Thanks for the reference. But I don't think the "" in the server.pem are needed.

da_jojo

18 February 2011, 02:42

indeed these "" are not needed. you are right.
what is not right is that i put the private key and then the server key and then the CA and the intermidiate CA certificate for it to work.
if i set them in the correct order (which is: private key, CA , intermediate CA, server certificate) hiawatha errors out on the private key .

in het nederlands : de volgorde van de certificaten is niet correct volgens de ssl v3 standaard, in de juiste volgorde gezet krijg ik een error op de privatekey wat op zich al apart is. dit zou zowiezo geen fout moeten geven dat het certificaat incorrect is. misschien dat je er eens naar kunt kijken alsjeblieft ?

da_jojo

18 February 2011, 02:53

maybe you can also explain how i can set the prefered cipher suite for ssl to TLS_RSA_WITH_AES_256_CBC_SHA (0x35) 256 bit encryption ?

da_jojo

18 February 2011, 03:09

after some trying out i found the correct order for hiawatha seems to be private key, server certificate,intermediate CA, CA
which ends up in this code:

now it passes all ssl tests so it should be fine then :-)
tested over here : https://www.ssllabs.com/ssldb/index.html

da_jojo

18 February 2011, 18:00

i researched some more and found that the webpage that gives one a decrypted private key is adding a linebreak instead of a cariage return. just cutting out the key part instead of ctrl-a works better. so it is not a fault of hiawatha. the order of the certificates however turn up in upside down order. it does not seem to matter much as it passes all sll test now. pretty nice score also, it got a B with default settings, which is pretty high compared to other webservers.

This topic has been closed.

Back