Install a X.509 Certificate from a Certificate Signing Request using OpenSSL

Install a X.509 Certificate from a Certificate Signing Request using OpenSSL

  1. For systems running Nodegrid OS v6.0.2 and newer, we recommend using the UI to install certificates:  Apply HTTPS certificate in Nodegrid. 
  2. For older Nodegrid OS versions, use openssl via the root shell to install certificates:

Generate a Certificate Signing Request
Note: CSRs can be generated off-box.  It is critical to retain a copy of the original private key to copy onto the Nodegrid appliance after the certificate is signed.  If it is encrypted, be sure to note the pass phrase as well.

  1. Log in Nodegrid as root:

    1. ssh root@<Nodegrid_IP>

  2. Change directory to /etc/CA:

    1. cd /etc/CA

  3. Create a RSA key:

    1. openssl genrsa -out key.pem.new 2048

  4. Create a Certificate Signing Request:

    1. openssl req -new -sha256 -key key.pem.new -out csr.pem

  5. Make sure the files have the right permissions:

    1. chmod 0640 *.new

  6. Sign the Certificate Signing Request:

    1. Send the Certificate Signing Request domain.csr to a Certificate Authority to be signed.

    2. The Certificate Authority will sign the CSR and send you a certificate in PEM format.


Install the Signed Certificate

  1. Copy the signed certificate received from the Certificate Authority to Nodegrid:

    1. scp <certificate> root@<Nodegrid_IP>:/etc/CA/cert.pem.new

  2. If the CSR was generated off-box, copy the private key to the Nodegrid:

    1. If encrypted private key, contents will show: -----BEGIN ENCRYPTED PRIVATE KEY-----

      1. scp <private key> root@<Nodegrid_IP>:/etc/CA/key-ENCR.pem.new

    2. If non-encrypted private key, contents will show: -----BEGIN PRIVATE KEY-----

      1. scp <private key> root@<Nodegrid_IP>:/etc/CA/key.pem.new

  3. Log in Nodegrid as root:

    1. ssh root@<Nodegrid_IP>

  4. Change directory to /etc/CA:

    1. cd /etc/CA

  5. Back up the original key and certificate:

    1. cp key.pem key.pem.old

    2. cp cert.pem cert.pem.old

    3. cp key_cert.pem key_cert.pem.old

  6. If the private key was encrypted, decrypt it using its pass phrase before installing:

    1. openssl rsa -in key-ENCR.pem.new -out key.pem.new

  7. Install the new key and certificate:

    1. mv key.pem.new key.pem

    2. mv cert.pem.new cert.pem

    3. cat key.pem cert.pem > key_cert.pem

  8. Make sure the files have the right permissions:

    1. chmod 0640 key_cert.pem

    2. chmod 0644 cert.pem

  9. Restart apache

    1. apachectl graceful