Knowledge Base

Creating an ECC CSR and installing your SSL certificate on your Apache server

Before generating an ECC CSR (Elliptic Curve Cryptography Certificate Signing Request) and ordering an ECC SSL Certificate from DigiCert, make sure that your environment is compatible with ECC SSL Certificates. For more information about Elliptic Curve Cryptography, see Elliptic Curve Cryptography ECC Explained.

Use these instructions to generate the ECC CSR and then install your ECC SSL Certificate.

1. To create your ECC CSR, see Apache: Create Your ECC CSR (Certificate Signing Request).

2. To install your ECC SSL Certificate, see Apache: Install Your ECC SSL Certificate.
    

Apache | Create Your ECC CSR (Certificate Signing Request)

Apache: How to Create Your ECC CSR

1. Log in to your Apache server.

2. At the prompt, type the following command to generate an ECC private key using the OpenSSL ecparam tool to generate your .key file:

   openssl ecparam -out server.key -name prime256v1 -genkey

   Where server is the name of your server.

   Note: The recommended ECC key size is 256-bit. If greater encryption strength is required, your other private key option is secp384r1.

3. Save (backup) the generated .key file, making sure to note its location. This private key is required later for ECC SSL Certificate installation.

4. Next, type the following command to generate an ECC certificate signing request (CSR):

   openssl req -new -key server.key -out server.csr -sha256

   Where server is the name of your server.

5. As you are prompted, enter the following information:

   For fields that are not required, you can enter '.' and those fields will be left blank.

   Country Name (2-letter code) [AU]: Type the two-letter code for the country where your company is legally located.
   
   State or Province Name (full name) [Some-State]: Type the name of the state or province where your company is legally located.
   
   Locality Name (eg, city) [ ]: Type the name of the city where your company is legally located.
   
   Organization Name (eg, company) [Internet Widgits Pty Ltd]: Type your company's legally registered name.
   
   Organizational Unit Name (eg, section) [ ]: Type the name of the department within your organization that you want to appear
   on the ECC SSL Certificate.
   
   Common Name (e.g. server FQDN) [ ]: Type the fully qualified domain name (i.e., www.example.com) for the site that you are securing.
   
   Note: If you are generating an Apache CSR for a Wildcard SSL Certificate, your common name should start with an asterisk (e.g., *.example.com).
   
   

6. This creates your openssl.csr file.

7. Now, open the .csr file with a text editor and copy the text of your CSR, including the -----BEGIN NEW CERTIFICATE REQUEST----- and -----END NEW CERTIFICATE REQUEST----- tags, and paste it into the DigiCert order form.

   Note: During your DigiCert SSL Certificate ordering process, when asked to select Server Software, make sure that you select Apache. This option ensures that you receive all the required certificates for Apache certificate installation.

   -----BEGIN NEW CERTIFICATE REQUEST-----
   MIICvDCCAaQCAQAwdzELMAkGA1UEBhMCVVMxEjAQBgNVBAgTCVlvdXJTdGF0ZTERMA8GA1UEBxMIWW91ckNpdHkxCzAJBgNVBAsTAklUMRowGAYDVQQKExFZb3VyQ29tcGFueSwgSW5jLjEYMBYGA1UEAxMPd3d3LmV4YW1wbGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA379BFFxfACdXsUk2wrQka/nAlKbo+I9DAW32+/SRxj/KtXVddscKW1obHGpMKPw4meJqOpQwJkIChYjSUQSpPKzdGpccDMf/eoF0J7EaQ2szLv9AqdRQw2Aaek8SmocVmd3LxEOX4VvALBOMLHVrB5/vhYfGECLJbc3lRdEbdXyHDtHklRAoIVQCfjTwBWGNAD337vmHW7Q0R6FYUoa4fcJh7Rv6jHSywqwx7pVfaDbZPuTgUhw7wksKNFxccG0xcTMr/+GrciHEuZ0chq86CBP9RIyLpp2+RMSfm6rMEYm9o65j7vEYaKEJUOJtA5MIs/ZjaXfS1LjXurLU0nCOQQIDAQABoAAwDQYJKoZIhvcNAQEFBQADggEBAK159goyAYOpcnrQ2EvCGlizrK1kS3D8JjnAiP1NHrjB/qdTYR+/8Dr/hMcwwU5ThGAVf68eMkk6tUNwAdpZ9C904Js2z+ENEbO8GA0Fc4rwix7vb15vSXe3shGijRGIzzHVGRoR3r7xQtIuMaDAr3xlV8jHbcvZTcpX0Kbq6H1GNLA4CXsOI4KGwu4FXfSzJEGb3gEJD8HaMP8V8er5G0owv/g/9Z/1/b0g97kAcUwkM2eDsvPhMx/pENGbnLPe4XMy7NPiEdzFnaYtUy2BDcXj3ZQEWxRWklERgg9/YcWIobf5ziuNm1Df24NBt5tpCNzfGviKT6/RYfWg3dMaKxc=
   -----END NEW CERTIFICATE REQUEST-----

   

8. After you receive your ECC SSL Certificate from DigiCert, you can install it.
    

Apache: Install Your ECC SSL Certificate

If you have not yet created your ECC Certificate Signing Request (CSR) and ordered your certificate, see: Apache: Create Your ECC CSR (Certificate Signing Request).

After receiving your ECC SSL Certificate, you need to install it on your Apache server and then configure the server to use the certificate to secure your website.

If you are installing an EV SSL Certificate, see EV SSL Certificate Installation: Apache. If you have an Ubuntu server, see Ubuntu Server with Apache SSL Certificate Installation.

Apache: How to Install Your SSL Certificate

1. Copy the Certificate Files to Your Server

1. Log in to your DigiCert© Management Console.

2. Download the DigiCert ECC Intermediate (DigiCertCA.crt) and your ECC Primary Certificate (e.g., your-domain_name.crt) files.

3. Copy the files to the directory on your server where you keep your certificates and key files.

4. Make the certificates readable by the root only.

2. Find the Apache Config File to Edit

The location and name of the config file can vary from server to server, especially if you use a special interface to manage your server configuration.

Apache's main configuration file is typically named httpd.conf or apache2.conf. Possible locations for this file include /etc/httpd/ or /etc/apache2/. For a comprehensive listing of default installation layouts for Apache HTTPD on various operating systems and distributions, see Httpd Wiki - DistrosDefaultLayout.

Often, the SSL Certificate configuration is located in a <VirtualHost> block in a different configuration file. The configuration files may be under a directory like /etc/httpd/vhosts.d/, /etc/httpd/sites/, or in a file called httpd-ssl.conf.

One way to locate the SSL Configuration on Linux distributions is to search using grep, as shown in the example below.

Type the following command:

Where "/etc/httpd/" is the base directory for your Apache installation.

3. Identify the SSL <VirtualHost> Block to Configure

If you need your site to be accessible through both secure (https) and non-secure (http) connections:

You need a virtual host for each type of connection. One for port 80 and the other for port 443. Make a copy of the existing non-secure virtual host and configure it for SSL as described in step 4.

If you only need your site to be accessed securely:

Configure the existing virtual host for SSL as described in step 4.

4. Configure the <VirtualHost> Block for the SSL-Enabled Site

1. Below is a very simple example of a virtual host configured for SSL. The parts listed in bold are the parts that must be configured for the SSL configuration, and they may be spread out throughout the file:

   <VirtualHost 192.168.0.1:443>
   DocumentRoot /var/www/html2
   ServerName www.yourdomain.com
   SSLEngine on
   SSLCertificateFile /path/to/your_domain_name.crt
   SSLCertificateKeyFile /path/to/server.key
   SSLCertificateChainFile /path/to/DigiCertCA.crt
   </VirtualHost>

2. Adjust the file names above to match your certificate files:

   • SSLCertificateFile

     This file should be your DigiCert ECC SSL Certificate file (e.g., your_domain_name.crt).

   • SSLCertificateKeyFile

     This file should be the key file generated in step 2 of the Apache: Create Your ECC CSR (Certificate Signing Request) instruction.

   • SSLCertificateChainFile

     This file should be the DigiCert ECC intermediate certificate file (DigiCertCA.crt).

     Note: If the SSLCertificateChainFile directive does not work, try using the SSLCACertificateFile directive instead.

5. Test Your Apache Config before Restarting

Apache will not start again if your config files have syntax errors; you should check your Apache config files for any errors before restarting.

• Run the following command to test your config files:

  apachectl configtest

• On some systems, you need to run this command to test your config files:

  apache2ctl configtest

6. Restart Apache

• You can use apachectl commands to stop and start Apache with SSL support:

  apachectl stop
  apachectl start

• If Apache does not start with SSL support, try using the apachectl startssl command instead of apachectl start.

• If SSL support only loads with apachectl startssl, we recommend that you adjust the apache startup configuration to include SSL support in the regular apachectl start command. Otherwise, your server may require that you manually restart Apache using apachectl startssl in the event of a server reboot. This usually involves removing the <IfDefine SSL> and </IfDefine> tags that enclose your SSL configuration.
   

Troubleshooting

1. If your website is publicly accessible, our SSL Certificate Tester tool can help you diagnose common problems.

2. For help moving your certificates to additional servers or across server platforms, see our Transferring IIS SSL Certificates instructions.
    

Apache Server Configuration

For information about Apache server configurations that can strengthen your SSL environment, see the following pages:

• Instructions for disabling the SSL v3 protocol.

  Apache: Disabling the SSL v3 Protocol

• Information about enabling perfect forward secrecy.

  Enabling Perfect Forward Secrecy