Stronghold keys and certificates are managed through three scripts:
genreq. These are part of the normal Stronghold distribution. Keys and certificates are stored in the directory
SSLTOP is typically
To generate a key pair and CSR for your server:
genkey, specifying the name of the host or virtual host:
genkey hostname. The
genkeyscript displays the filenames and locations of the key file and CSR file it will generate:
- Key file:
- CSR file:
- Key file:
- Press Enter. The
genkeyscript reminds you to be sure you are not overwriting an existing key pair and certificate.
- When prompted, enter a key size.It is recommended that you use the largest key size available.
- When prompted, enter random key strokes. Stop when the counter reaches zero and
genkeybeeps. This random data is used to create a unique public and private key pair.
- When prompted, enter
Yto create the key pair and CSR.
- For your CA, select Other.
- Enter the two-letter country code for your country. You must use the correct ISO country code, other abbreviations will not be recognized. Please refer to our list of country codes to find yours.
- Enter the full name of your state or territory. Please do not abbreviate.
- Enter the name of your city, town, or other locality.
- Enter the name of your organization. This is the full legal name of the organization applying for the server certificate.
- Enter the name of your unit within the specified organization. This is usually the group/department the certificate is for.
- Enter your web site’s fully-qualified domain name. (For example,
www.mydomain.com.) This is known as your site’s Common Name.
- The CSR created will look something like this:
-----BEGIN NEW CERTIFICATE REQUEST----- MIIByDCCATECAQAwgYgxCzAJBgNVBAYTAlVTMREwDwYDVQQIEwhWaX ----------------More text-------------------- U20CbzA7Ur0YBqrnQdD2PnTv/XpHtAAr+M4oez== -----END NEW CERTIFICATE REQUEST-----
- At this point you should back up your key file and CSR to a secure location. If you lose your private key or forget the password, you will not be able to install your certificate.