Generating a Key
You must be root to generate a key.
First, use the cd command to change to the /etc/pki/tls/ directory. Remove the fake key and certificate that were generated during the installation with the following commands:
rm private/server.keyrm certs/server.crt
The crypto-utils package contains the genkey utility which you can use to generate keys as the name implies. To create your own private key, please ensure the crypto-utils package is installed. You can view more options by typing man genkey in your terminal. Assuming you wish to generate keys for www.example.com using the genkey utility, type in the following command in your terminal:
genkey www.example.comPlease note that the make based process is no longer shipped with RHEL 5. This will start the genkey graphical user interface. The figure below illustrates the first screen. To navigate, use the keyboard arrow and tab keys. This windows indicates where your key will be stored and prompts you to proceed or cancel the operation. To proceed to the next step, select Next and press the Return (Enter) key.
Keypair generation
Figure 23.11. Keypair generation
The next screen prompts you to choose the size of your key. As indicated, the smaller the size of your key, the faster will the response from your server be and the lesser your level of security. On selecting your preferred, key size using the arrow keys, select Next to proceed to the next step. The figure below illustrates the key size selection screen.
Choose key size
Figure 23.12. Choose key size
Selecting the next step will initiate the random bits generation process which may take some time depending on the size of your selected key. The larger the size of your key, the longer it will take to generate it.
Generating random bits
Figure 23.13. Generating random bits
On generating your key, you will be prompted to send a Certificate Request (CSR) to a Certificate Authority (CA).
Generate CSR
Figure 23.14. Generate CSR
Selecting Yes will prompt you to select the Certificate Authority you wish to send your request to. Selecting No will allow you to generate a self-signed certificate. The next step for this is illustrated in Figure 23.17, "Generating a self signed certificate for your server".
Choose Certificate Authority (CA)
Figure 23.15. Choose Certificate Authority (CA)
On Selecting your preferred option, select Next to proceed to the next step. The next screen allows you to enter the details of your certificate.
Enter details for your certificate
Figure 23.16. Enter details for your certificate
If you prefer to generate a self signed cert key pair, you should not generate a CSR. To do this, select No as your preferred option in the Generate CSR screen. This will display the figure below from which you can enter your certificate details. Entering your certificate details and pressing the return key will display the Figure 23.19, "Protecting your private key" from which you can choose to encrypt your private key or not.
Generating a self signed certificate for your server
Figure 23.17. Generating a self signed certificate for your server
On entering the details of your certificate, select Next to proceed. The figure below illustrates an example of a the next screen displayed after completing the details for a certificate to be sent to Equifax. Please note that if you are generating a self signed key, for your server, this screen is not displayed.
Begin certificate request
Figure 23.18. Begin certificate request
Pressing the return key, will display the next screen from which you can enable or disable the encryption of the private key. Use the spacebar to enable or disable this. When enabled, a [*] character will be displayed. On selecting your preferred option, select Next to proceed to the next step.
Protecting your private key
Figure 23.19. Protecting your private key
The next screen allows you to set your key passphrase. Please do not lose this passphrase as you will not be able to run the server without it. You will need to regenerate a new private or public key pair and request a new certificate from your CA as indicated. For security, the passphrase is not displayed as you type. On typing your preferred passphrase, select Next to go back to your terminal.
Set passphrase
Figure 23.20. Set passphrase
If you attempt to run genkey www.example.com on a server that already has an existing key pair for the particular hostname, an error message will be displayed as illustrated below. You need to delete your existing key file as indicated to generate a new key pair.
genkey error