Apache: Create ECC CSR and Install ECC SSL Certificate

Creating an ECC CSR and installing your SSL certificate on your Apache server

Before generating an ECC CSR (Elliptic Curve Cryptography Certificate Signing Request) and ordering an ECC SSL Certificate form DigiCert, make sure that your environment is compatible with ECC SSL Certificates. For more information about Elliptic Curve Cryptography, see Elliptic Curve Cryptography ECC Explained.

Use these instructions to generate the ECC CSR and then install your ECC SSL Certificate.

  1. To create your ECC CSR, see Apache: Create Your ECC CSR (Certificate Signing Request).

  2. To install your ECC SSL Certificate, see Apache: Install Your ECC SSL Certificate.

1. Apache: Create Your ECC CSR (Certificate Signing Request)

Apache: How to Create Your ECC CSR

  1. Log into your Apache server.

  2. At the prompt, type the following command to generate an ECC private key using the OpenSSL ecparam tool to generate your .key file:

    openssl ecparam -out server.key -name prime256v1 -genkey

    Where server is the name of your server.

    Note: Recommended ECC key size is 256-bit. If greater encryption strength is required, your other private key option is secp384r1.

  3. Save (backup) the generated .key file, making sure to note its location. This private key is required later for ECC SSL Certificate installation.

  4. Next, type the following command to generate a ECC certificate signing request (CSR):

    openssl req -new -key server.key -out server.csr -sha256

    Where server is the name of your server.

  5. As you are prompted, enter the following information:

    For fields that are not required, you can enter '.' and those fields will be left blank.

    Country Name (2 letter code) [AU]: Type the two letter code for the country where your company is legally located.
    State or Province Name (full name) [Some-State]: Type the name of the state or providence where your company is legally located.
    Locality Name (eg, city) [ ]: Type the name of the city where your company is legally located.
    Organization Name (eg, company) [Internet Widgits Pty Ltd]: Type your company's legally registered name.
    Organizational Unit Name (eg, section) [ ]: Type the name of the department within your organization that you want to appear on the ECC SSL Certificate.
    Common Name (e.g. server FQDN) [ ]: Type the fully qualified domain name (i.e. www.example.com) for the site that you are securing.
    Note: If you are generating an Apache CSR for a Wildcard SSL Certificate, your common name should start with an asterisk (e.g., *.example.com).

  6. This creates your openssl.csr file.

  7. Now, open the .csr file with a text editor and copy the text of your CSR, including the -----BEGIN NEW CERTIFICATE REQUEST----- and -----END NEW CERTIFICATE REQUEST----- tags, and paste it into the DigiCert order form.

    Note: During your DigiCert SSL Certificate ordering process, when asked to Select Server Software, make sure that you select Apache. This option ensures that you receive all the required certificates for Apache certificate installation.

    -----BEGIN NEW CERTIFICATE REQUEST-----
    MIICvDCCAaQCAQAwdzELMAkGA1UEBhMCVVMxEjAQBgNVBAgTCVlvdXJTdGF0ZTER MA8GA1UEBxMIWW91ckNpdHkxCzAJBgNVBAsTAklUMRowGAYDVQQKExFZb3VyQ29t cGFueSwgSW5jLjEYMBYGA1UEAxMPd3d3LmV4YW1wbGUuY29tMIIBIjANBgkqhkiG 9w0BAQEFAAOCAQ8AMIIBCgKCAQEA379BFFxfACdXsUk2wrQka/nAlKbo+I9DAW32 +/SRxj/KtXVddscKW1obHGpMKPw4meJqOpQwJkIChYjSUQSpPKzdGpccDMf/eoF0 J7EaQ2szLv9AqdRQw2Aaek8SmocVmd3LxEOX4VvALBOMLHVrB5/vhYfGECLJbc3l RdEbdXyHDtHklRAoIVQCfjTwBWGNAD337vmHW7Q0R6FYUoa4fcJh7Rv6jHSywqwx 7pVfaDbZPuTgUhw7wksKNFxccG0xcTMr/+GrciHEuZ0chq86CBP9RIyLpp2+RMSf m6rMEYm9o65j7vEYaKEJUOJtA5MIs/ZjaXfS1LjXurLU0nCOQQIDAQABoAAwDQYJ KoZIhvcNAQEFBQADggEBAK159goyAYOpcnrQ2EvCGlizrK1kS3D8JjnAiP1NHrjB /qdTYR+/8Dr/hMcwwU5ThGAVf68eMkk6tUNwAdpZ9C904Js2z+ENEbO8GA0Fc4rw ix7vb15vSXe3shGijRGIzzHVGRoR3r7xQtIuMaDAr3xlV8jHbcvZTcpX0Kbq6H1G NLA4CXsOI4KGwu4FXfSzJEGb3gEJD8HaMP8V8er5G0owv/g/9Z/1/b0g97kAcUwk M2eDsvPhMx/pENGbnLPe4XMy7NPiEdzFnaYtUy2BDcXj3ZQEWxRWklERgg9/YcWI obf5ziuNm1Df24NBt5tpCNzfGviKT6/RYfWg3dMaKxc=
    -----END NEW CERTIFICATE REQUEST-----

    Ready to Order Your SSL Certificate

    Buy Now Learn More

  8. After you receive your ECC SSL Certificate from DigiCert, you can install it.

2. Apache: Install Your ECC SSL Certificate

If you have not yet created your ECC Certificate Signing Request (CSR) and ordered your certificate, see Apache: Create Your ECC CSR (Certificate Signing Request).

After receiving your ECC SSL Certificate, you need to install it on your Apache server and then configure the server to use the certificate to secure your website.

If you are installing an EV SSL Certificate, see EV SSL Certificate Installation :: Apache. If you have an Ubuntu server, see Ubuntu Server with Apache SSL Certificate Installation.

Apache: How to Install Your SSL Certificate

1. Copy the Certificate Files to Your Server

  1. Log into your DigiCert© Management Console.

  2. Download the DigiCert ECC Intermediate (DigiCertCA.crt) and your ECC Primary Certificate (e.g., your-domain_name.crt) files.

  3. Copy the files to the directory on your server where you keep your certificates and key files.

  4. Make the certificates readable by root only.

2. Find the Apache Config File to Edit

The location and name of the config file can vary from server to server - especially if you use a special interface to manage your server configuration.

Apache's main configuration file is typically named httpd.conf or apache2.conf. Possible locations for this file include /etc/httpd/ or /etc/apache2/. For a comprehensive listing of default installation layouts for Apache HTTPD on various operating systems and distributions, see Httpd Wiki - DistrosDefaultLayout.

Often, the SSL Certificate configuration is located in a <VirtualHost> block in a different configuration file. The configuration files may be under a directory like /etc/httpd/vhosts.d/, /etc/httpd/sites/, or in a file called httpd-ssl.conf.

One way to locate the SSL Configuration on Linux distributions is to search using grep, as shown in the example below.

Type the following command:

grep -i -r "SSLCertificateFile" /etc/httpd/

Where "/etc/httpd/" is the base directory for your Apache installation.

3. Identify the SSL <VirtualHost> Block to Configure

If you need your site to be accessible through both secure (https) and non-secure (http) connections:

You need a virtual host for each type of connection. One for port 80 and the other for port 443. Make a copy of the existing non-secure virtual host and configure it for SSL as described in step 4.

If you only need your site to be accessed securely:

Configure the existing virtual host for SSL as described in step 4.

4. Configure the <VirtualHost> Block for the SSL-Enabled Site

  1. Below is a very simple example of a virtual host configured for SSL. The parts listed in bold are the parts that must be configured for the SSL configuration and they may be spread out throughout the file:

    <VirtualHost 192.168.0.1:443>
    DocumentRoot /var/www/html2
    ServerName www.yourdomain.com
    SSLEngine on
    SSLCertificateFile /path/to/your_domain_name.crt
    SSLCertificateKeyFile /path/to/server.key
    SSLCertificateChainFile /path/to/DigiCertCA.crt
    </VirtualHost>

  2. Adjust the file names above to match your certificate files:

    • SSLCertificateFile

      This file should be your DigiCert ECC SSL Certificate file (e.g., your_domain_name.crt).

    • SSLCertificateKeyFile

      This file should be the key file generated in step 2 of the Apache: Create Your ECC CSR (Certificate Signing Request) instruction).

    • SSLCertificateChainFile

      This file should be the DigiCert ECC intermediate certificate file (DigiCertCA.crt).

      Note: If the SSLCertificateChainFile directive does not work, try using the SSLCACertificateFile directive instead.

5. Test Your Apache Config before Restarting

Because Apache will not start again if your config files have syntax errors, you should check your Apache config files for any errors before restarting.

  • Run the following command to test your config files:

    apachectl configtest

  • On some systems, you need to run this command to test your config files:

    apache2ctl configtest

6. Restart Apache

  • You can use apachectl commands to stop and start Apache with SSL support:

    apachectl stop
    apachectl start

  • If Apache does not start with SSL support, try using the apachectl startssl command instead of apachectl start.

  • If SSL support only loads with apachectl startssl, we recommend that you adjust the apache startup configuration to include SSL support in the regular apachectl start command. Otherwise, your server may require that you manually restart Apache using apachectl startssl in the event of a server reboot. This usually involves removing the <IfDefine SSL> and </IfDefine> tags that enclose your SSL configuration.

Troubleshooting

  1. If your website is publicly accessible, our SSL Certificate Tester tool can help you diagnose common problems.

  2. For help moving your certificates to additional servers or across server platforms, see our Transferring IIS SSL Certificates instructions.

Apache Server Configuration

For information about Apache server configurations that can strengthen your SSL environment, see the following pages:



Related Links

SSL Certificates

Related Links