While on the server confirm these values have been updaed in /etc/ssh/ssl.conf . SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP:!kEDH:!aNULL SSLHonorCipherOrder on
To check the end date on a cert openssl x509 -enddate -noout -in star_binghamton_edu.crt To see all the data regarding the cert file openssl x509 -in star_binghamton_edu.crt -text To see what Firefox reports on a cert for a secure page... On the Menu Bar (No menu bar ...right button to the right of the URL box...Check Menu Bar ) Click Tools Click Page Info or Ctrl i Click the Security | Padlock icon Click the [View Certificate] button]
sftp new certs to server. cd /etc/ httpd|apache2 /ssl mkdir OLDCERTS mv * OLDCERTS sftp new certs to this location from centoshome:/root/Downloads/NEWCERTS chmod 000 DigiCertCA.crt star_binghamton_edu* In /etc/httpd/conf.d/ssl.conf | /etc/apache2/sites-available/default-ssl.conf . SSLCertificateFile /etc/httpd/ssl/star_binghamton_edu.crt SSLCertificateKeyFile /etc/httpd/ssl/star_binghamton_edu.key SSLCertificateChainFile /etc/httpd/ssl/DigiCertCA.crt Some servers require the cc CERTS be left in place, that set is not due for update till 2022. SSLCertificateFile "/etc/apache2/ssl/cc_binghamton_edu.crt" SSLCertificateKeyFile "/etc/apache2/ssl/cc_binghamton_edu.key" SSLCertificateChainFile "/etc/apache2/ssl/cc_binghamton_edu.ca-bundle" Once in place restart the web server service. Check configuration was correctly updated. /usr/sbin/apachectl -T Now ... systemctl stop httpd; systemctl start httpd; systemctl status httpd systemctl stop apache2; systemctl start apache2; systemctl status apache2
tomcat is tomcat...what I changed in 2 locations.... If Applicable in /usr/share/tomcat/conf/server.xml SSLCertificateFile="/etc/httpd/ssl/star_binghamton_edu.crt" SSLCertificateKeyFile="/etc/httpd/ssl/star_binghamton_edu.key" SSLCertificateChainFile="/etc/httpd/ssl/DigiCertCA.crt" -OR- SSLCertificateFile="/etc/pki/tls/certs/star_binghamton_edu.crt" SSLCertificateKeyFile="/etc/pki/tls/private/server.key" SSLCertificateChainFile="/etc/pki/tls/certs/DigiCertCA.crt" systemctl stop tomcat; systemctl start tomcat; systemctl status tomcat
SAS - Documented on The system, very non-standard locastiaons and uses so mods might be necessary! Appears to use the same CERTS might need name changes (I recommend we use the name as delivered) I didn't do these on SAS!!!! server.crt -- star_binghamton_edu.crt server.key -- star_binghamton_edu.key DigiCertCA.crt -- DigiCertCA.crt /opt/sasinside/sashome/SASSecurityCertificateFramework/1.1/cacerts/DigiCertCA.crt /opt/thirdparty/0.certs/DigiCertCA.crt /opt/thirdparty/0.certs/server.key /opt/thirdparty/certs/DigiCertCA.crt /opt/thirdparty/certs/server.key /opt/sasinside/sasconfig/Lev1/Web/WebServer/old.ssl/DigiCertCA.crt /opt/sasinside/sasconfig/Lev1/CERTS/DigiCertCA.crt /opt/sasinside/sasconfig/Lev1/CERTS/STAR/start_binghamton_edu.key /opt/sasinside/sasconfig/Lev1/CERTS/STAR/start_binghamton_edu.crt /opt/docs/CertsKeys/DigiCertCA.crt /opt/docs/CertsKeys/star_binghamton_edu.crt /opt/docs/CertsKeys/server.key /opt/sasinside/sasconfig/Lev1/Web/WebServer/BUCERTS/DigiCertCA.crt /opt/sasinside/sasconfig/Lev1/Web/WebServer/BUCERTS/busas.binghamton.edu.crt /opt/sasinside/sasconfig/Lev1/Web/WebServer/BUCERTS/busas.binghamton.edu.key /opt/sasinside/sasconfig/Lev1/Web/WebServer/ssl/DigiCertCA.crt /opt/sasinside/sasconfig/Lev1/Web/WebServer/ssl/busas.binghamton.edu.crt /opt/sasinside/sasconfig/Lev1/Web/WebServer/ssl/busas.binghamton.edu.key