Apple 10.6 Server User Manual


  Open as PDF
of 197
 
Chapter 4 Enhancing Security 65
Creating a Self-Signed Certicate
A self-signed certicate is generated at server setup. Although it is available for use,
you may want to customize the information in the certicate, so you would create a
new self-signed certicate. This is especially important if you plan on having a CA sign
your certicate.
When you create a self-signed certicate, Certicate Manager creates a private–public
key pair in the System keychain with the key size specied (512 - 2048 bits). It then
creates the corresponding self-signed certicate.
If you’re using a self-signed certicate, consider using an intermediate trust for it and
import the certicate into the System keychain on all client computers (if you have
control of the computers). For more information about using intermediate trust,
see “About Intermediate Trust” on page 61.
To create a self-signed certicate:
1 In Server Admin, select the server that has services that support SSL.
2 Click Certicates.
3 Click the Add (+) button and choose Create a Certicate Identity.
Certicate Assistant launches, populated with information needed to generate the
certicate.
4 If you override the defaults, choose “Let me override defaults” and follow the onscreen
instructions.
5 When nished, click Continue.
6 Conrm the certicate creation by clicking Continue.
The Certicate Assistant generates a key pair and certicate. Certicate Manager
encrypts the les with a random passphrase, puts the passphrase in the System
keychain, and puts the resulting PEM les in /etc/certicates/.
Requesting a Certicate from a Certicate Authority
Certicate Manager helps you create a CSR to send to your designated CA.
You need a certicate for the CA to sign. You can use the one that was generated at
server setup, but more likely you will want to generate one that has all the details
the CA requires before signing. If you need to generate a certicate before getting it
signed, see “Creating a Self-Signed Certicate” on page 65.
To request a signed certicate:
1 In Server Admin, select the server that has services that support SSL.
2 Click Certicates.
3 Select the certicate you want signed.
 previous next