SSLCertificate - Revision history

Scarpenter: Replaced content with "=This Content Has Moved House= This article has been moved to our new home for documentation and help content, the new Emersion Knowledge Base. We are sorry for the unti..."

2018-01-30T02:47:26Z

Replaced content with "=This Content Has Moved House= This article has been moved to our new home for documentation and help content, the new Emersion Knowledge Base. We are sorry for the unti..."

Scarpenter at 06:51, 14 June 2017

2017-06-14T06:51:56Z

Dcowan: added common certificate container formats info

2016-12-02T06:58:43Z

added common certificate container formats info

Scarpenter at 05:04, 26 February 2015

2015-02-26T05:04:47Z

Scarpenter at 04:59, 26 February 2015

2015-02-26T04:59:38Z

Scarpenter at 04:02, 26 February 2015

2015-02-26T04:02:34Z

Scarpenter: /* See Also */

2015-02-26T04:01:16Z

‎See Also

Scarpenter: /* See Also */

2015-02-26T04:00:56Z

‎See Also

Scarpenter: /* See Also */

2015-02-26T04:00:27Z

‎See Also

Scarpenter: /* SSL Certificates */

2015-02-26T03:58:51Z

‎SSL Certificates

@@ Line 1: / Line 1: @@
-{{DISPLAYTITLE: SSL Certificates}}
+=This Content Has Moved House=
-* have, or will have a Retail Service Provider Account with Emersion
+This article has been moved to our new home for documentation and help content, the new Emersion Knowledge Base.
-There are a number of ways and methods to obtain a signed SSL certificate for your website. Usually, your IT team will already have a preferred supplier and can obtain you a valid SSL certificate for you. Alternatively you can:
+We are sorry for the untidiness while we are shifting locations and we appreciate your patience during the transition to our new home.
-* purchase an [[/Emersion SSL Certificates |Emersion SSL certificate]]
+[https://resources.emersion.com/display/EKB/SSL+Certificates Take me to the Emersion Knowledge Base article]
-Regardless of who you purchase an SSL certificate from, Emersion strongly recommends that you purchase an ''Extended Validation'' (EV) certificate. Extended Validation SSL Certificates are validated to the highest degree to provide consumer confidence in the identity of the web site operator. It provides website owners with the ‘green bar’ in the address bar, to show the highest level of security for your visitors.
+[[file:new_home_sm.jpg|900px]]

← Older revision		Revision as of 06:51, 14 June 2017
Line 1:		Line 1:
		+	{{DISPLAYTITLE: SSL Certificates}}
	This article is designed for Emersion clients who:		This article is designed for Emersion clients who:

← Older revision		Revision as of 06:58, 2 December 2016
Line 13:		Line 13:

	When the SSL certificate has been delivered to you, forward it to Emersion with the Private Key. We need '''<i>both</i>''' the SSL Certificate and Private Key in order to complete the installation of the SSL Certificate on the server.		When the SSL certificate has been delivered to you, forward it to Emersion with the Private Key. We need '''<i>both</i>''' the SSL Certificate and Private Key in order to complete the installation of the SSL Certificate on the server.
		+
		+	===== Common SSL certificate / key file formats: =====
		+
		+	SSL has been around for long enough you'd think that there would be agreed upon container formats. And you're right, there are. Too many standards as it happens.
		+
		+	* '''.csr''' This is a Certificate Signing Request. Some applications can generate these for submission to certificate-authorities. The actual format is PKCS10 which is defined in RFC 2986. It includes some/all of the key details of the requested certificate such as subject, organization, state, whatnot, as well as the public key of the certificate to get signed. These get signed by the CA and a certificate is returned. The returned certificate is the public certificate (which includes the public key but not the private key), which itself can be in a couple of formats.
		+	* '''.pem''' Defined in RFC 1421, RFC 1422, RFC 1423, RFC 1424. This is a container format that may include just the public certificate (such as with Apache installs, and CA certificate files /etc/ssl/certs), or may include an entire certificate chain including public key, private key, and root certificates. Confusingly, it may also encode a CSR (e.g. as used here) as the PKCS10 format can be translated into PEM. The name is from Privacy Enhanced Mail (PEM), a failed method for secure email but the container format it used lives on, and is a base64 translation of the x509 ASN.1 keys.
		+	* '''.key''' This is a PEM formatted file containing just the private-key of a specific certificate and is merely a conventional name and not a standardized one. In Apache installs, this frequently resides in /etc/ssl/private. The rights on these files are very important, and some programs will refuse to load these certificates if they are set wrong.
		+	* '''.pkcs12''' .pfx .p12 Originally defined by RSA in the [http://www.rsa.com/rsalabs/node.asp?id=2124 Public-Key Cryptography Standards], the "12" variant was enhanced by Microsoft. This is a passworded container format that contains both public and private certificate pairs. Unlike .pem files, this container is fully encrypted. Openssl can turn this into a .pem file with both public and private keys: openssl pkcs12 -in file-to-convert.p12 -out converted-file.pem -nodes
		+
		+	A few other formats that show up from time to time:
		+
		+	* '''.der''' A way to encode ASN.1 syntax in binary, a .pem file is just a Base64 encoded .der file. OpenSSL can convert these to .pem (openssl x509 -inform der -in to-convert.der -out converted.pem). Windows sees these as Certificate files. By default, Windows will export certificates as .DER formatted files with a different extension. Like...
		+	* '''.cert, .cer, .crt''' A .pem (or rarely .der) formatted file with a different extension, one that is recognized by Windows Explorer as a certificate, which .pem is not.
		+	* '''.p7b''' Defined in RFC 2315, this is a format used by windows for certificate interchange. Java understands these natively. Unlike .pem style certificates, this format has a defined way to include certification-path certificates.
		+	* '''.crl''' A certificate revocation list. Certificate Authorities produce these as a way to de-authorize certificates before expiration. You can sometimes download them from CA websites.
		+
		+	In summary, there are four different ways to present certificates and their components:
		+
		+	* '''PEM''' Governed by RFCs, it's used preferentially by open-source software. It can have a variety of extensions (.pem, .key, .cer, .cert, more)
		+	* '''PKCS7''' An open standard used by Java and supported by Windows. Does not contain private key material.
		+	* '''PKCS12''' A private standard that provides enhanced security versus the plain-text PEM format. This can contain private key material. It's used preferentially by Windows systems, and can be freely converted to PEM format through use of openssl.
		+	* '''DER''' The parent format of PEM. It's useful to think of it as a binary version of the base64-encoded PEM file. Not routinely used by much outside of Windows.
		+
		+
		+

	= See Also =		= See Also =

@@ Line 5: / Line 5: @@
 * need to provide Emersion with a valid and signed SSL certificate for one (or both) of the above portals
-There are a number of ways and methods to obtain a signed SSL certificate for your website. Usually, your IT team will already have a preferred supplier and can obtain you a valid SSL certificate for you. Alternatively you can use a [[/SSL Certificates Using Open SSL  |common DIY method to generate a Certificate Signing Request utilising OpenSSL]].
+There are a number of ways and methods to obtain a signed SSL certificate for your website. Usually, your IT team will already have a preferred supplier and can obtain you a valid SSL certificate for you. Alternatively you can:
 Regardless of who you purchase an SSL certificate from, Emersion strongly recommends that you purchase an ''Extended Validation'' (EV) certificate. Extended Validation SSL Certificates are validated to the highest degree to provide consumer confidence in the identity of the web site operator. It provides website owners with the ‘green bar’ in the address bar, to show the highest level of security for your visitors.

@@ Line 5: / Line 5: @@
 * need to provide Emersion with a valid and signed SSL certificate for one (or both) of the above portals
-There are a number of ways and methods to obtain a signed SSL certificate for your website. Usually, your IT team will already have a preferred supplier and can obtain you a valid SSL certificate for you.
+There are a number of ways and methods to obtain a signed SSL certificate for your website. Usually, your IT team will already have a preferred supplier and can obtain you a valid SSL certificate for you. Alternatively you can use a [[/SSL Certificates Using Open SSL  |common DIY method to generate a Certificate Signing Request utilising OpenSSL]].
 Regardless of who you purchase an SSL certificate from, Emersion strongly recommends that you purchase an ''Extended Validation'' (EV) certificate. Extended Validation SSL Certificates are validated to the highest degree to provide consumer confidence in the identity of the web site operator. It provides website owners with the ‘green bar’ in the address bar, to show the highest level of security for your visitors.

@@ Line 1: / Line 1: @@
 This article is designed for Emersion clients who:
@@ Line 20: / Line 18: @@
 = See Also =
 * [[/SSL Certificates Using Open SSL  | Generate a Certificate Signing Request with OpenSSL]].
-* [[Emersion SSL Certificates| Emersion SSL Certificates]]
+* [[/Emersion SSL Certificates | Emersion SSL Certificates]]
 * [[End_User_Portal_and_Customer_Sign_Up_Portal | End User Portal and Customer Sign Up Portal]]

@@ Line 19: / Line 19: @@
 = See Also =
-* [[/SSL Certificates Using Open SSL  | Generate a Certificate Signing Request with OpenSSL]].
+* [[/SSL/Certificates Using Open SSL  | Generate a Certificate Signing Request with OpenSSL]].
-* [[/SSL Emersion SSL Certificates| Emersion SSL Certificates]]
+* [[/SSL/Emersion SSL Certificates| Emersion SSL Certificates]]
 * [[End_User_Portal_and_Customer_Sign_Up_Portal | End User Portal and Customer Sign Up Portal]]

@@ Line 13: / Line 13: @@
 * Emersion can [[/Emersion SSL Certificates|arrange an SSL Certificate for you]]. (fees apply)
 * You can use a [[/SSL Certificates Using Open SSL  |common DIY method to generate a Certificate Signing Request utilising OpenSSL]].
 When the SSL certificate has been delivered to you, forward it to Emersion with the Private Key. We need '''<i>both</i>''' the SSL Certificate and Private Key in order to complete the installation of the SSL Certificate on the server.