SSL(8)

💖 SSL(8) — the libssl & libcrypto tea 💖

okay so bestie, grab your oat milk latte because this is the manual page for ssl — literally the whole vibe behind libssl and libcrypto. it's giving "system manager's manual" energy and we're about to get into it. ✨

---

🌸 NAME 🌸

ssl — all the deets on libssl and libcrypto, no cap.

---

🦋 DESCRIPTION 🦋

so this doc spills the tea on some of the issues that come up when you're using the OpenSSL libssl and libcrypto libraries. think of it as your lil overview of what these libraries actually do and what programs are out here using them. 💅

the libssl and libcrypto libraries implement the TLS version 1 protocol. it's most commonly used by the HTTPS protocol for encrypted web transactions — iconic behavior, honestly — like what you can do with httpd(8). and libcrypto is also out here being used by all sorts of programs like ssh(1), sshd(8), and isakmpd(8). main character libraries, fr fr. 👑

---

🎀 SERVER CERTIFICATES 🎀

the most common uses of TLS are gonna require you to generate a server certificate, which your host provides as literal evidence of its identity whenever clients make new connections. it's like showing your ID at the club but make it cryptography. 🪪

the certificates live in the /etc/ssl directory, and the keys chill in the /etc/ssl/private directory.

private keys can be encrypted using AES and a passphrase to protect their integrity in case the encrypted file gets disclosed. but — and this is the important part, bestie — encrypted server keys mean the passphrase needs to be typed in every single time the server is started. 😭 and if you're not using a passphrase, you need to be absolutely sure your key file is kept secure. like, hyper-vigilant. do not play with this one.

---

🔥 GENERATING RSA SERVER CERTIFICATES FOR WEB SERVERS 🔥

to support HTTPS transactions in httpd(8) you're gonna need to generate an RSA certificate. start by creating a private key of the desired length:

# openssl genrsa -out /etc/ssl/private/server.key 4096

or, if you want the key to be encrypted with a passphrase that you'll have to type in whenever you start servers:

# openssl genrsa -aes256 -out /etc/ssl/private/server.key 4096

💡 if you're only generating a private key to use with acme-client(1) (like, say, with a non-default key length), you may stop right here. you're done, go touch grass. 🌱

otherwise, the next step is to generate a Certificate Signing Request (CSR) — this is what you use to get a Certificate Authority (CA) to sign your certificate. do it with:

# openssl req -new -key /etc/ssl/private/server.key \
  -out /etc/ssl/private/server.csr

this server.csr file can then be handed to a Certificate Authority who will sign the key. slay. 💅

you can also sign the key yourself with:

# openssl x509 -sha256 -req -days 365 \
  -in /etc/ssl/private/server.csr \
  -signkey /etc/ssl/private/server.key \
  -out /etc/ssl/server.crt

⚠️ okay important caveat: standard web browsers do not use the common name of a subject. instead they require that subject alt names are provided. this means you gotta use -extfile server.ext when self-signing. no cap.

# this is an example server.ext file
subjectAltName=DNS:example.com,DNS:www.example.com

with /etc/ssl/server.crt and /etc/ssl/private/server.key in place, you should be able to start httpd(8) with SSL configured — enabling HTTPS transactions with your machine on port 443. the way that all comes together, honestly obsessed. 🎉

you'll most likely want to generate a self-signed certificate the way we just did, along with your certificate signing request, so you can test your server's functionality even if you're gonna have the certificate signed by another Certificate Authority. smart, right? 🧠 once your Certificate Authority returns the signed certificate to you, you can switch to using the new cert by replacing the self-signed /etc/ssl/server.crt with the certificate signed by your Certificate Authority, and then restarting httpd(8). easy peasy. ✨

---

🌈 GENERATING ECDSA SERVER CERTIFICATES 🌈

first things first — generate a private ECDSA key. the following command uses a NIST/SECG curve over a 384-bit prime field:

# openssl ecparam -name secp384r1 -genkey \
  -noout -out /etc/ssl/private/eccert.key

🚨 heads up bestie: some Certificate Authorities will only issue certificates for keys generated using prime256v1 parameters. so like, check with your CA first, iykyk.

if you're only generating a private key to use with acme-client(1), you may stop here. otherwise, the next step is to generate a Certificate Signing Request (CSR) — same deal as before, it's what you use to get a Certificate Authority to sign your certificate. run this:

# openssl req -key /etc/ssl/private/eccert.key -new \
  -out /etc/ssl/private/eccert.csr

this eccert.csr file can then be given to a CA who will sign the key. periodt. 💁‍♀️

you can also sign the key yourself with:

# openssl x509 -sha256 -req -days 365 \
  -in /etc/ssl/private/eccert.csr \
  -signkey /etc/ssl/private/eccert.key \
  -out /etc/ssl/eccert.crt

---

💜 SEE ALSO 💜

all the besties in the same friend group, obviously:

acme-client(1), openssl(1), ssh(1), ssl(3), httpd(8), isakmpd(8), rc(8), smtpd(8), sshd(8), starttls(8)

---

okay that's the whole page, bestie! this edition came straight from Debian and is dated May 30, 2024 — so like, it's fresh but also vintage, you know? go forth and TLS responsibly. 🫶🍓🧚‍♀️