Self-Signed Custom SSL

Objective

This guide explains how to use Self-Signed Custom SSL on Ruk-Com Cloud PaaS, with ordered procedures and practical verification points.

Before you begin

• Sign in with an account permitted to manage the relevant environment.
• Confirm the target environment, region and resources before saving changes.
• Create a backup or rollback plan before changing a production system.

Method for making The safest layer your application is using connection through SSL-encrypted (Secure Socket Layer) In Ruk-Com Cloud, you can use both Ruk-Com SSL and Custom SSL certificates.

All Custom SSL certificates must be requested through a Certificate Authority (CA) company. For example:Let's EnctyptIn that case, your cetificate will become a reliable cetificate. After making a request To gain trust from others and connect to your application without any problems.

However, you can request a custom certificate yourself and still get a secure connection, but the certificate will not be trusted. Make the time to open the application The application will display a warning message to the user to exit the website. Because the connection is unreliable

Most users will leave the page. Therefore, we recommend that you should not use it. self-signed-certficates for production applications, but can be used for System development/testing or personal websites that are compatible with only a small group

So let's see how to create each type of certificate and how to use it with Ruk-Com Cloud env.

Requesting a Self-Signed SSL Certificate

To request a self-signed ssl certificate, you must purchase a domain first.

When the order is completed You are ready to proceed with creating your ssl certificate with the help of various tools. In this example we will use OpenSSL, depending on your operating system. You can see the following steps.

• For Windows
• For Linux/MacOS/FreeBSD

You can also create the required files usingElastic Virtual Private Serverour

For Windows

to youDownloadLatest version of OpenSSL Extract the file and launch it by double-clicking the openssl.exe file. The files created by OpenSSL will then appear in the same folder as openssl.exe.

1. First, you need to create an SSH private key for your root certificate (used for all certificate requests). Use the following command.

genrsa -out {filename} {length}

{filename} - The name of the key file with.key at the end (for example, rootCA.key).
{length} - Length of the private key in bits (example 2048)

1. Next, create a root CA certificate file using the key provided. Use the req command with the x509 option in the command to produce a self-singed root cerificate instead of a certificate request.

req -config {config_path} -x509 -new -key {keyname} -days {days} -out {filename}

{config_path} - Part of the openssl.cnf configuration file in the directory that contains the extracted OpenSSL files (specified asC:\path\to\openssl.cnfformat)
{keyname} - The name of your root key (the name you set in the previous step Ex. rootCA.key)
{day} - Number of days the current certificate will be valid.
{filename} - The name of the cetificate which is.crt (Ex. rootCA.crt)
Set up the details required for the CA certificate by answering the questions listed.

After successfully answering all the questions, you will receive a self-signed root certificate for your own CA.

1. Now you can create your private key and self-signed certificate with your purchased Hostname. Let's start by creating the key. We'll create the key the same way we created root.

genrsa -out {filename} {length}

{filename} - The name of the key file with.key at the end (for example host.key)
{length} - Length of the private key in bits (example 2048)

Note:You should not protect your keys with a password. Otherwise, you will receive an error while adding the key to the Ruk-Com Cloud management page.

1. Next run the following command to create a certificate signing request (CSR) file.

req -config {config_path} -new -key {keyname} -out {filename}

{config_path} - Part of the openssl.cnf configuration file in the directory that contains the extracted OpenSSL files (specified asC:\path\to\openssl.cnfformat)
{keyname} - The name of your root key (the name you set in the previous step, Ex. host.key)
{filename} - Name of the output file which is.csr (Ex. host.csr)
Please answer the questions listed and use them as your information to create the certificate.

Note:The Common name variable should be the same as the domain name you want to use, otherwise your certificate will not work.

1. The final step is to create your self-signed certificate using the root CA certificate. We will use the x509 command with the following options:
2. -req - means require the format of the input file used to request the certificate.
3. -CAcreateserial - Sets the default value for creating a CA serial number file (if the file does not exist).

x509 -req -in {requestname} -CA {CA_certificate} -CAkey {CA_key} -CAcreateserial -out {filename} -days {days}

{requestname} - Name of the.csr file used as the input request (Ex. host.csr)
{CA_certificate} - Set the CA certificate that will be used to request the certificate (Ex. rootCA.crt)
{CA_key} - set of CA private keys used to request certificates (Ex. rootCA.key)
{filename} - Name of the.crt file (Ex. host.crt)
{day} - Number of days the current certificate will be valid.

After completing the steps above, you will have a self-signed SSL certificate for use in your application.

For Linux/MacOS/FreeBSD

In case you haven't installed the OpenSSL tool yet, you can install it using the appropriate command (depending on your OS package manager). You can use the command in your Terminal, for example in Ubuntu/Debian which is Linux can use the following command.

sudo apt-get install openssl

When the installation is complete OpenSSL related files will be listed in your machine's home directory.

1. First you need to create an SSH private key for your root certificate (which will be used to create all certificates). You can create it using the command below.

openssl genrsa -out {filename} {length}

{filename} - Name of the generated key.key (Ex. rootCA.key)
{length} - Length of the private key in bits (Ex. 2048)

1. Next you should create a root CA certificate using the key provided using the req command, using the x509 option to issue a self-signed root certificate in place of the certificate request.

openssl req -x509 -new -key {keyname} -days {days} -out {filename}

{keyname} - The name of your root key (the name you set in the previous step Ex. rootCA.key)
{day} - Number of days the current certificate will be valid.
{filename} - The name of the cetificate which is.crt (Ex. rootCA.crt)
Set up the details required for the CA certificate by answering the questions listed.

After successfully running the above command you will get a self-signed root certificate for your CA.

1. You can now create a private key and self-signed certificate for your purchased domain. Let's start creating the key using the same method as creating root.

openssl genrsa -out {filename} {length}

{filename} - Name of the generated key.key (Ex. host.key)
{length} - Length of the private key in bits (Ex. 2048)

Note:You should not protect your keys with a password. Otherwise, you will receive an error while adding the key to the Ruk-Com Cloud management page.

1. Next run the following command to create a certificate signing request (CSR) file.

openssl req -new -key {keyname} -out {filename}

{keyname} - The name of your root key (the name you set in the previous step, Ex. host.key)
{filename} - Name of the output file which is.csr (Ex. host.csr)
Please answer the questions listed and use them as your information to create the certificate.

Note:The Common name variable should be the same as the domain name you want to use, otherwise your certificate will not work.

1. The final step is to create your self-signed certificate using the root CA certificate. We will use the x509 command with the following options:
2. -req - means require the format of the input file used to request the certificate.
3. -CAcreateserial - Sets the default value for creating a CA serial number file (if the file does not exist).

openssl x509 -req -in {requestname} -CA {CA_certificate} -CAkey {CA_key} -CAcreateserial -out {filename} -days {days}

{requestname} - Name of the.csr file used as the input request (Ex. host.csr)
{CA_certificate} - Set the CA certificate that will be used to request the certificate (Ex. rootCA.crt)
{CA_key} - set of CA private keys used to request certificates (Ex. rootCA.key)
{filename} - Name of the.crt file (Ex. host.crt)
{day} - Number of days the current certificate will be valid.

After completing the steps above, you will have a self-signed SSL certificate for use in your application.

Elastic VPS

You can create a self-signed certificate using the Elastic VPS server. To do so:

• Create an environment with Elastic VPS inside.
• Connect to Elastic vps using your preferred method (using Public IP or via SSH Gateway).
• Access the OpenSSL shell with the relevant openssl command.
• Create a self-signed certificate by following these steps.Linux/MacOS/FreeBSD(The only difference is that all commands should be executed without the openssl word at the beginning because you are already in the OpenSSL shell.)
• Once the creation process is complete, you will need to download the created certificate file (e.g. through Configuration File Manager) to use it in the environment you want to use later.

Attach Certificates

Now follow the steps for uploading any other custom SSL.

• Adjust Environment Topology
• Domain Name and A Record Settings
• Upload Certificate to the Environment

That's it, if you enter your assigned domain name (or IP address) into your browser using the https:// protocol, you will see a message alerting you that your SSL certificate is not trusted.

When you see the notification, click on "Process anyway" to continue. (or similar button depending on your browser)

Note:For some browsers (such as Mozilla FireFox), even if you decide to continue, you need to add this page to your browser's exceptions list before you can proceed.

After that, you will be redirected to your site via an encrypted protocol.

Now you can be confident that all interactions with your applications will be carried out securely.