You may want to create a self-signed SSL certificate for a Cloud Platform application in one of the following cases:

• You want to test your application with SSL before purchasing the final certificate
• You want to test a new subdomain on an application with a SSL certificate that doesn’t cover the new subdomain
• Your application requires IPv6 but not SSL

Creating SSL certificates¶

To create a self-signed SSL certificate, you will need both a root certificate and a site certificate.

Create a root certificate¶

To create a root certificate:

1. Create a private key for your root certificate. Connect to your environment with SSH

2. To ensure that you are in a writable directory (such as /mnt/tmp/), use a command similar to the following:

   copy

   openssl genpkey -algorithm RSA -out ca.key.pem -pkeyopt rsa_keygen_bits:2048

3. Next, enter a command similar to the following example to self-sign the certificate:

   copy

   openssl req -new -x509 -key ca.key.pem -out ca.cert.pem -days 365 -sha256

4. The following result (or something similar to it) will be displayed. Enter the values that are appropriate to your site, system, and location.

   copy

   You are about to be asked to enter information that will be
   incorporated into your certificate request.
   What you are about to enter is what is called a Distinguished Name or a
   DN.
   There are quite a few fields but you can leave some blank
   For some fields there will be a default value,
   If you enter '.', the field will be left blank.
   -----
   Country Name (2 letter code) [AU]:US
   State or Province Name (full name) [Some-State]:Oregon
   Locality Name (eg, city) []:Portland
   Organization Name (eg, company) [Internet Widgits Pty Ltd]: My Name (Root CA)
   Organizational Unit Name (eg, section) []:
   Common Name (e.g. server FQDN or YOUR name) []:www.mysite.com
   Email Address []:[email protected]

The root certificate is created in the same directory, with the name ca.cert.pem; its key is created with the name ca.key.pem.

Create the site certificate¶

Next, use the following procedure to create the site certificate.

1. Create the private key with the following command:

   copy

   openssl genpkey -algorithm RSA -out site-key.pem -pkeyopt rsa_keygen_bits:2048

2. Use the following command to generate the certificate signing request (CSR):

   copy

   openssl req -new -key site-key.pem -out site-csr.csr -sha256

3. You will be presented with similar text as when you created the root certificate. Use the same values as you did for the root certificate except for the Organization Name*. For the Organization Name, use a different value, such as My Name (Site CA).

   The following questions will also be displayed:

   copy

   Please enter the following 'extra' attributes
   to be sent with your certificate request
   A challenge password []:
   An optional company name []:

   Note

   Skip A challenge password by pressing the Enter key.

4. Enter a command similar to this example this to sign the CSR with the root key and output in PEM format with the .pem extension:

   copy

   openssl x509 -req -in site-csr.csr -CA ca.cert.pem -CAkey ca.key.pem -CAcreateserial -out site-crt.pem -days 365 -sha256

The site certificate CSR is created in the same directory, with the name site-csr.csr; the site certificate key is created with the name site-crt.pem, and its key is created with the name site-key.pem.

Install your certificates¶

Next, install the root certificate and site certificate, as described in Installing an SSL certificate not based on an Acquia-generated CSR, and then complete the appropriate steps for your application:

• If your application requires IPv6, select Install legacy SSL certificate while installing the certificate, and review Legacy/ELB certificates for information about configuring your DNS settings.
• If your application doesn’t require IPv6, use the Standard installation method outlined in Standard certificates.

Next step¶

A code change is required to route traffic to https to leverage your new SSL certificate. For more information, see Redirecting all HTTP traffic to HTTPS.