Changes between Version 3 and Version 4 of SSL Certificate Management

Timestamp:

01/13/08 21:48:42 (18 years ago)

Author:

secrest@…

Comment:

--

SSL Certificate Management

@@ -111 +111 @@
 This creates directories and files that are refered to in the default openssl config file, `/usr/lib/ssl/openssl.cnf`.  (Alternatively, you could alter the config file to specify different directories and filenames.)
 
-The file, `serial`, contains the "serial number" that will go in the certificate.  It should just be a text file that contains a hexadecimal number.  Normally, you would increment that every time you renewed the certificate.  To see the serial number on the previous certificate, enter:
+The file, `serial`, contains the "serial number" that will go in the certificate.  It should just be a text file that contains a hexadecimal number.  Normally, you would increment that every time you renewed any certificate.  To see the serial number on the previous certificate, enter:
 {{{
 openssl x509 -noout -text -in mail.astro.columbia.edu-cert.pem.old
 }}}
-where `mail.astro.columbia.edu-cert.pem.old` is the old certificate file.  Include the full path if it is not in the current directory.
+where `mail.astro.columbia.edu-cert.pem.old` is the old certificate file.  Include the full path if it is not in the current directory. Note that the serial number needs to be unique among all certificates certified by that CA, not just among all certificates certified by that CA with the same Common Name (CN).
 
 When all the files are in place, run the following command:
@@ -144 +144 @@
 Path to Certificate: /etc/ldap/slapd.cert
 Path to Key File: /etc/ldap/slapd.key
-Valid: 1/10/2007 03:00:24 GMT - 1/10/2008 03:00:24 GMT
-Serial Number: 09
-Subject: DC=edu, DC=columbia, DC=astro, OU=services, CN=mars.astro.columbia.edu
+Valid: 1/14/2008 02:00:15 GMT - 1/13/2009 02:00:15 GMT
+Serial Number: 0D
+Subject: C=US, ST=New York, O=Columbia University Astrophysics Laboratory, CN=mars.astro.columbia.edu/emailAddress=security@astro.columbia.edu
 }}}
 
@@ -168 +168 @@
 Path to Certificate: /etc/ssl/certs/docs.astro.columbia.edu-cert.pem
 Path to Key File: /etc/ssl/private/docs.astro.columbia.edu.pem
-Valid: 12/28/2006 19:52:26 GMT - 12/28/2007 19:52:26 GMT
-Serial Number: 08
-Subject: DC=edu, DC=columbia, DC=astro, OU=services, CN=docs.astro.columbia.edu
+Valid: 1/14/2008 02:24:02 GMT - 1/13/2009 02:24:02 GMT
+Serial Number: 0E
+Subject: C=US, ST=New York, O=Columbia University Astrophysics Laboratory, CN=docs.astro.columbia.edu/emailAddress=security@astro.columbia.edu
 }}}