How to proceed SSL certificate renewal yearly

Jephe Wu - http://linuxtechres.blogspot.com

Updated on 26th May 2011

Objective: How to check and send CSR file to CA for SSL certificate renewal and install the updated SSL certificate on web server.
Environment: Apache SSL website, Linux server

Steps:

1. Prepare CSR file for SSL certificate renewal

If there's no existing CSR file, you can generate like this:

openssl req -new -key server.key -out server.csr

then view content of CSR file like this:

openssl req -noout -text -in server.csr

2.make sure the existing/generated CSR file matches with private key file as well as cert file, also the CN should be correct domain name

 openssl req -noout -modulus -in server.csr | openssl md5
 openssl rsa -noout -modulus -in server.key | openssl md5
 openssl x509 -notout -modulus -in server.crt | openssl md5


In addition, you can use 'stat server.key' or 'stat server.crt' command check the acces time to match the apache startup time(ps -efH) on Linux so that you can be sure which server.key or server.crt file is correct.

3. submit CSR file to CA for renewal

4. verify the CRT file from CA
 openssl x509 -noout -modulus -in server.crt | openssl md5

online check: http://www.sslshopper.com/certificate-decoder.html

5. Install it on the Linux Apache server and restart Apache
ps -efH to check the parent ID of Apache, then use 'kill -USR1 parent_pid' to re-read the new configuration so that apache will use new certificate file.

Note: what if you received a chain certificate also? Such as GeoTrust SSL CA issued certificate, it's parent CA is GeoTrust Global CA. Some IE browser doesn't have root CA buildin for GeoTrust SSL CA, Firewall 4.0 should have it.

What you need to do is to put the following into Apache ssl configuration file:

SSLCertificateChainFile /etc/httpd/conf/ssl.crt/intermediate_ca.crt

then run 'kill -USR1 parentid' to re-read configuration file.

6. verification after installing new cert
a. command line
on the server, use command 'openssl s_client -showcerts -connect jephe.domain.com:443' to check if the output is giving new cert

b. browser check
use IE or firefox to access website to check if the new certficate is put in the place(new expiry date)

c. online tools check
http://www.sslshopper.com/ssl-checker.html




References:

a. http://httpd.apache.org/docs/2.2/ssl/ssl_faq.html
b. www.sslshopper.com 
c. http://www.mozilla.org/projects/security/pki/nss/tools/ssltap.html

How to check openssl renegotiation and weak cipher vulnerability

Jephe Wu - http://linuxtechres.blogspot.com
Environment: Apache httpd server with openssl
Objective: check renegotiation and weak cipher vulnerability and patch them


Steps:
1. How to check if a website supports openssl renegotiation and weak cipher?
method 1: openssl s_client command
use openssl command that comes with CentOS 5.5:

openssl s_client -connect jephe.domain.com:443
it will show 'secure renegotiation is NOT supported or supported' message

use openssl ciphers to know all the ciphers on the client Linux PC, then you can use the following commands to check specific cipher support on server:
openssl s_client -connect jephe.domain.com:443 -cipher LOW:EXP  - check if it suports low or exp ciphers, for what are the low or exp ciphers, see  http://www.openssl.org/docs/apps/ciphers.html#
                                                                 
openssl s_client -connect jephe.domain.com:443 -cipher EXP-RC4-MD5 - check specific cipher

openssl s_client -connect jephe.domain.com:443 -cihper MEDIUM


method 2: use public ssl database report
https://www.ssllabs.com/ssldb/index.htm


method3: use downloaded tool
download sslciphercheck from http://www.woany.co.uk/downloads/
then use sslciphercheck -h jephe.domain.com to check all supported ciphpers



2. How to patch it
For renegotiation vulnerability, you can upgrade to openssl 1.0a version.
For weak cipher, you can use the  following ciphersuite configuration in Apache

SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:!LOW:!SSLv2:!EXP:!eNULL

You can disable RC4 also, so it becomes:



SSLCipherSuite ALL:!ADH:!EXPORT56:!RC4:+HIGH:+MEDIUM:!LOW:!SSLv2:!EXP:!eNULL


note:

1. you can list all ciphers the current openssl supports on the server:


/usr/local/ssl/bin/openssl ciphers | sed -e 's#:#\n#g' | sort

3. References
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3555
redhat knowledge base: https://access.redhat.com/kb/docs/DOC-20491