sudo su
mkdir /opt/CA
mkdir /opt/CA/newcerts
mkdir /opt/CA/private
mkdir /opt/CA/certs
mkdir /opt/CA/reqs

cd /opt/CA

echo "01" > serial
touch database.txt

cp /user/lib/ssl/openssl.cnf /opt/CA/caconfig.cnf

nano caconfig.cnf

# Change these parameters in the Text Editor
• Set dir to /opt/CA
• Set database to $dir/database.txt
• Verify that new_certs_dir to $dir/newcerts
• Verify that certs is set to $dir/certs
• Find the section [ policy_match ] and set the following options
• Set countryName, stateOrProvinceName, and organizationName to optional. These options allow
the CA to sign certificates with any of the identity information in those fields set to anything. The
default restrictions will only allow signatures on certificates that match the country code, state, and
organization.
#SAVE
#Exit

export OPENSSL_CONF=/opt/CA/caconfig.cnf

openssl req -x509 -newkey rsa:2048 -out cacert.pem -outform PEM -days 60

#Organization name and Common Name enter username_CA



mv privkey.pem /opt/CA/private/

cp cacert.pem /opt/CA/




# Log in to Client
openssl req -new -newkey rsa:2048 -nodes -keyout clientkey.key -out clientreq.csr

#Organization name username_Client 
#Common name set to IP address of Client
#Leave password and company name blank

mv clientkey.key /etc/ssl/private/
scp clientreq.csr username@serverip:/home/username/

#log in to server

mv clientreq.csr /opt/CA/reqs

openssl ca -out /opt/CA/certs/192.168.122.188.pem –config /opt/CA/caconfig.cnf -infiles
/opt/CA/reqs/clientreq.cs

sudo su
ls /opt/CA/certs
#get new cert name
scp /opt/CA/certs/newcert username@clientip:/home/username/
scp /opt/CA/cacert.pem username@clientip:/home/username/
# login to client

sudo cp newcert /etc/ssl/certs/
sudo cp cacert.pem /etc/ssl/certs/

sudo a2enmod ssl

sudo nano sudo a2enmod ssl

#append this to end of the document
<VirtualHost *:443>
DocumentRoot /var/www/html/
<Directory />
Options Indexes FollowSymLinks MultiViews
AllowOverride None
</Directory>
<Directory /var/www/html/>
Options Indexes FollowSymLinks MultiViews
AllowOverride None
Order allow,deny
allow from all
</Directory>
SSLEngine on
SSLCertificateFile /etc/ssl/certs/192.168.122.188.pem #THIS NEEDS TO BE CHANGED TO MATCH
SSLCertificateKeyFile /etc/ssl/private/clientkey.key
SSLCertificateChainFile /etc/ssl/certs/cacert.pem
</VirtualHost>

#save exit

service apache2 restart 


sudo cp /etc/ssl/certs/cacert.pem /var/www/html/


#login to Server VM
#open Firefox

1. Connect to your web server using your browser over a normal HTTP connection to get the
certificate (e.g. http://192.168.122.188/cacert.pem). If it displays the certificate contents in the
window, right-click on the page and click ‘Save Page As’ to download it to a location on your
computer.
2. Navigate to Edit->Preferences->Advanced->Encryption->View Certificates
3. Make sure the Authorities tab is selected and then click Import...
4. Find the cacert.pem file you just downloaded and click Open
5. Check the box that says “Trust this CA to identify websites.” and then click OK


You should now be able to visit your website using HTTPS and not receive any certificate errors.

