Generar nuestro propio certificado SSL

Para generar un certificado valido (ejemplo web):

openssl req -nodes -new -keyout web.key -out web.csr

keopx@prueba:/etc/apache2$ openssl req -nodes -new -keyout web.key -out web.csr
Generating a 1024 bit RSA private key
...............................................++++++
........................................................++++++
writing new private key to 'web.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:ES
State or Province Name (full name) [Some-State]:Provincia
Locality Name (eg, city) []:Localidad
Organization Name (eg, company) [Internet Widgits Pty Ltd]:nombre_empresa
Organizational Unit Name (eg, section) []:Sistemas
Common Name (eg, YOUR name) []:www.web.com
Email Address []:tu_usuario@web.com
-----
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

** Recordar que password y company name se han dejar en blanco.

Clave Privada

cat web.key

-----BEGIN RSA PRIVATE KEY-----
MIICWwIBAAKBgQDa3jXaOMmjiNchcTNPIB56R8N2V+5HUosWcDh8xxHYP5K6XQ52
k+MvtIVg4K89/OhziyhaipgCkenEMmIrtoTT9fTGiQv0X93KjJwH/lvVUKdzBlVB
hDWr405CCReeCEmA8vrUy7MTn718E7lKbqtyyJaW+YbimP0HogbK87gVAQIDAQAB
AoGAU46aCKG9eU14tC+/YunkONLE8J1JPrlomDxnlFt7mI9MuRFlwCddiIzmjsG4
pXW0WMg7s7VNq02BbYG+sOmRc5VoBzj8G38yB8SpDj6QZgItkkYJMc9zKtMBf6IO
nhY+FgRSUGvBWhLxn2oS3CC/oX9DwvdWvg8cHcD1G575oQECQQD5r4uWJqbR8UDw
sQY4pyda6/qmLyWvMglok4vqcnXkjWOdngTL0woRstRHO5guY2eg7TSEX6wPtlQv
BSkPsEcpAkEA4GcnDDyOEBkTtgVqjMozj5+DJLpZTFkbw/xfZj6saF45jHJ/EK2Y
oi5R5UUHywb8uApHC6qIx/RYs9jH88ZSGQJAMZDpsusFXtP3wlBCHekA5QnHfkoJ
vxe9ymbP9cC3KqHuzpFZ/mRssUrA3Us1ULAnGEk+jbC4ZX4ahCMQHa8u0QJAU9I0
I7360siLNFKRmkVtPRi4Q9/Xu00NsgdzGx4OCG4p0OxzyicN/IaQ0LMYVh4mCBjO
sOzias460/MFvWk3AQJAfHsGbeltCyEhXkDxCKVQFmRVtsEZJARb+97u7rlqiIhS
QVNUNqy7T6LXByoTOwbcG595k+6aqGjAq8oeyj96Yw==
-----END RSA PRIVATE KEY-----

Certificado de envío

En caso de tener que enviar a una entidad certificadora (ej.: Verisign) les mandaremos este fichero:

cat web.csr

-----BEGIN CERTIFICATE REQUEST-----
MIIB3jCCAUcCAQAwgZ0xCzAJBgNVBAYTAkVTMRAwDgYDVQQIEwdCaXprYWlhMQ8w
DQYDVQQHEwZCaWxiYW8xGTAXBgNVBAoTEEJpbGJvbWF0aWNhIFMuQS4xETAPBgNV
BAsTCFNpc3RlbWFzMRQwEgYDVQQDEwt3d3cubWluZC5lczEnMCUGCSqGSIb3DQEJ
ARYYcmVnaWd1cmVuQGJpbGJvbWF0aWNhLmVzMIGfMA0GCSqGSIb3DQEBAQUAA4GN
ADCBiQKBgQDa3jXaOMmjiNchcTNPIB56R8N2V+5HUosWcDh8xxHYP5K6XQ52k+Mv
tIVg4K89/OhziyhaipgCkenEMmIrtoTT9fTGiQv0X93KjJwH/lvVUKdzBlVBhDWr
405CCReeCEmA8vrUy7MTn718E7lKbqtyyJaW+YbimP0HogbK87gVAQIDAQABoAAw
DQYJKoZIhvcNAQEFBQADgYEAOQTnrUZ9VMyrHC+Tf2DC0pn6z1YSOpMjn5y7anvE
CAdzL7C6CqLr21LNDmiSEov4Pq4oeyqPOYsbMsevp0x7JmvWwiQXkQnfJqR8zr5H
E+pBSHHp1+Ydwx9T8/MAr3LtQhub7EkKpgEkpfmou43AwkMtshstB/c7JzZ0CQL/
Lu4=
-----END CERTIFICATE REQUEST-----

Entidad certificadora

En caso de tener una central certificadora como puede ser Verisign, a la central certificadora le enviamos el web.csr para que no devuelva en fichero en texto plano web.crt (certificado).

cat web.crt

-----BEGIN CERTIFICATE-----
MIIE9jCCBF+gAwIBAgIQPQS2i9mi7QtNotD8uahBDTANBgkqhkiG9w0BAQUFADCB
ujEfMB0GA1UEChMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazEXMBUGA1UECxMOVmVy
aVNpZ24sIEluYy4xMzAxBgNVBAsTKlZlcmlTaWduIEludGVybmF0aW9uYWwgU2Vy
dmVyIENBIC0gQ2xhc3MgMzFJMEcGA1UECxNAd3d3LnZlcmlzaWduLmNvbS9DUFMg
SW5jb3JwLmJ5IFJlZi4gTElBQklMSVRZIExURC4oYyk5NyBWZXJpU2lnbjAeFw0w
NzA2MDQwMDAwMDBaFw0wODA2MDQyMzU5NTlaMIIBBjELMAkGA1UEBhMCRVMxDzAN
BgNVBAgTBk1hZHJpZDEPMA0GA1UEBxQGTWFkcmlkMSUwIwYDVQQKFBxIaWdoIFRl
Y2ggSG90ZWxzIEFORCBSZXNvcnRzMREwDwYDVQQLFAhTaXN0ZW1hczEyMDAGA1UE
CxMpVGVybXMgb2YgdXNlIGF0IHd3dy52ZXJpc2lnbi5lcy9ycGEgKGMpMDUxIjAg
BgNVBAsTGUF1dGhlbnRpY2F0ZWQgYnkgVmVyaVNpZ24xJzAlBgNVBAsTHk1lbWJl
ciwgVmVyaVNpZ24gVHJ1c3QgTmV0d29yazEaMBgGA1UEAxQRd3d3Lmh0aG90ZWxl
cy5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAL6R3vYaeb2r70/m3ffP
YZnyBmRoEfZXWQtICQRd6EqIGbtIu9Ftflcw5e+5KKgHqTp7d5VX07mTN9aV2rEs
bgBaSKEH9NpeaMaUGxLdI/A9oO7RWPs+gC4YIozfo6Zp4R7H7A8YohtDdzDVigCj
1xgu7NqpvXk2rIRPoB1f69gvAgMBAAGjggGsMIIBqDAJBgNVHRMEAjAAMAsGA1Ud
DwQEAwIFoDBDBgNVHSAEPDA6MDgGC2CGSAGG+EUBBxcDMCkwJwYIKwYBBQUHAgEW
G2h0dHBzOi8vd3d3LnZlcmlzaWduLmVzL3JwYTA8BgNVHR8ENTAzMDGgL6Athito
dHRwOi8vU1ZSSW50bC1jcmwudmVyaXNpZ24uY29tL1NWUkludGwuY3JsMCgGA1Ud
JQQhMB8GCCsGAQUFBwMBBggrBgEFBQcDAgYJYIZIAYb4QgQBMHEGCCsGAQUFBwEB
BGUwYzAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AudmVyaXNpZ24uY29tMDsGCCsG
AQUFBzAChi9odHRwOi8vU1ZSSW50bC1haWEudmVyaXNpZ24uY29tL1NWUkludGwt
YWlhLmNlcjBuBggrBgEFBQcBDARiMGChXqBcMFowWDBWFglpbWFnZS9naWYwITAf
MAcGBSsOAwIaBBRLa7kolgYMu9BSOJsprEsHiyEFGDAmFiRodHRwOi8vbG9nby52
ZXJpc2lnbi5jb20vdnNsb2dvMS5naWYwDQYJKoZIhvcNAQEFBQADgYEAB3n9wQMS
erbvDAUyFyPqqGOVeSATrXcNU2IMcmZobWhi284wwT96eS5K2H0r3eGGGUOsfgyh
gsJIw2Hj90l1eQwnNg0L0XZQU2tLy/x6+ZYuIX4yJq9De2p9SK9BOZuXHcjFYOA/
CaQ3KkqTjeX7ozOn9BLqvFxtuwzxt8qNOPA=
-----END CERTIFICATE-----

Auto certificarse

En este caso no tener una entidad certificadora (la mayoría de casos), nos auto certificaremos.

openssl x509 -in web.csr -out web.crt -req -signkey web.key -days 365

keopx@prueba:/etc/apache2$ openssl x509 -in web.csr -out web.crt -req -signkey web.key -days 365
Signature ok
subject=/C=ES/ST=Provincia/L=Localidad/O=nombre_empresa./OU=Sistemas/CN=www.web.com/emailAddress=tu_usuario@web.com
Getting Private key

cat web.crt

-----BEGIN CERTIFICATE-----
MIICszCCAhwCCQCGFBuLiz/tCjANBgkqhkiG9w0BAQUFADCBnTELMAkGA1UEBhMC
RVMxEDAOBgNVBAgTB0JpemthaWExDzANBgNVBAcTBkJpbGJhbzEZMBcGA1UEChMQ
QmlsYm9tYXRpY2EgUy5BLjERMA8GA1UECxMIU2lzdGVtYXMxFDASBgNVBAMTC3d3
dy5taW5kLmVzMScwJQYJKoZIhvcNAQkBFhhyZWdpZ3VyZW5AYmlsYm9tYXRpY2Eu
ZXMwHhcNMDkwOTE2MDk1NjU4WhcNMTAwOTE2MDk1NjU4WjCBnTELMAkGA1UEBhMC
RVMxEDAOBgNVBAgTB0JpemthaWExDzANBgNVBAcTBkJpbGJhbzEZMBcGA1UEChMQ
QmlsYm9tYXRpY2EgUy5BLjERMA8GA1UECxMIU2lzdGVtYXMxFDASBgNVBAMTC3d3
dy5taW5kLmVzMScwJQYJKoZIhvcNAQkBFhhyZWdpZ3VyZW5AYmlsYm9tYXRpY2Eu
ZXMwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANreNdo4yaOI1yFxM08gHnpH
w3ZX7kdSixZwOHzHEdg/krpdDnaT4y+0hWDgrz386HOLKFqKmAKR6cQyYiu2hNP1
9MaJC/Rf3cqMnAf+W9VQp3MGVUGENavjTkIJF54ISYDy+tTLsxOfvXwTuUpuq3LI
lpb5huKY/QeiBsrzuBUBAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAHgPnvRvflNon
f+ZxPi+G/foTrrhFgsKZbxza7if1lZgNzBarC+p4wISjxqMfjz5xbuMV6c4dKWv1
KvqsXTbUtqVV4ATsNWHCYCxS9j+rBI0n9ADJTLF4Y2B7cUwdEL1xLDjgbSh5nlNG
ylI6XAuDZGQyqRJZlEPFyGBb0Cq6bdg=
-----END CERTIFICATE-----

Instalar certificado en el servidor

Copias los ficheros web.crt y web.key a la ruta correspondiente:

sudo mv web.crt /etc/ssl/certs/web.crt
sudo mv web.key /etc/ssl/private/web.key

Esto dependerá del tipo servidor, una vez instalado procedemos a reiniciar. Se reinicia el servidor y están operativas. ** Las rutas y forma de instalar dependerán del tipo del server.

Otras opciones

Vamos a ver otras posibilidades Ver datos de un certificado:

openssl req -in web.csr -noout -text

Certificado con RSA de 2048 bits

openssl req -nodes -new -keyout web.key -out web.csr -newkey rsa:2048