Administration Guide › SSL and the Secure Proxy Server › Keys and Server Certificates Management

Keys and Server Certificates Management

The SPS fully supports the Secure Sockets Layer (SSL) protocol. SSL provides secure communication between client and server, enabling mutual authentication (using certificates) and private encrypted messages (using keys).

The SPS uses the OpenSSL cryptography toolkit, which implements the SSL v2/v3 and Transport Layer Security (TLS v1) network protocols and related cryptography standards required by these protocols. The OpenSSL toolkit includes the openssl command line tool for generating keys and certificates. The openssl executable image and supporting libraries are located in the <install dir>\SSL\bin folder or corresponding UNIX directory.

Note: To enable SSL on Solaris, you must have patch 127127-11 installed on the same system as the Secure Proxy Server.

To run the openssl command line tool, connect to the appropriate folder or directory. Open a command line Window or UNIX shell. Use the following syntax as a guideline for entering openssl commands:

openssl command [ command_opts ] [ command_args ]

The openssl tool provides a large number of commands (command in the synopsis above); each one can include numerous options and arguments (command_opts and command_args in the synopsis). You can find complete documentation for openssl at the following URL:

http://www.openssl.org/docs/apps/openssl.html

Important! When you issue the openssl command for any propose be sure to specify a valid path to the openssl configuration file (openssl.conf) using the -config parameter in the command line.

The commands you are most likely to use to perform fundamental SSL tasks are as follows:

• Generating a private key
• Generating a Certificate Signing Request (CSR)
• Generating a certificate by self signing the CSR
• Having a certificate signed by a Certificate Authority (CA)
• Installing a signed certificate
• Decrypting an RSA key
• Encrypting an RSA key
• Changing the password of an RSA key

Before you proceed, review the following important information about private keys and server certificates:

• The server certificate and private key work together. You must use the server certificate with the corresponding private key.
• The server certificate should be digitally signed by a Certificate Authority (CA) or self-signed with your own private key (recommended for sites intended exclusively for internal use).
• The SSLCertificateFile and SSLCertificateKeyFile directives in the SSL.conf file must point to the corresponding certificate and key files.
• If you are using Apache’s virtual host feature, each virtual host you want to secure must have its own private key and server certificate.