Having created our certificate signing request on the Ubuntu system,
the next logical step is to sign that request and,
of course,
that's going to be done through our certificate
authority running on our AlmaLinux system.
So we can ensure then that we copy it across from Ubuntu through
into our root/ca directory on our AlmaLinux system.
We're connecting as a Vagrant user.
Remember, it's the Vagrant user that I set the password for.
But again, your user account might be slightly different,
or your IP address might be slightly different,
but we're connecting into that Ubuntu system.
Once we've copied it across, the next step, of course, is going to sign it.
Again, we're using openssl and the x509 module,
and we're reading in our certificate signing request.
We're then adding in the certificate from the CA,
having the authority to do that through the CA key,
and we're creating a serial file so we can log what has been signed by our CA.
We're outputting our file as the ubuntu.crt.
We're allowing it to be used for 365 days a year.
Remember when we said very often browsers will not allow
certificates that are signed for more than 12 months.
So with this then signed,
we've got a copy across the certificate through to
the system that needs to use that.
So again, we can use scp, but no,
we are copying both the ubuntu.crt and the myca.crt.
We're copying them across then to our Ubuntu system
back into the temp directory,
and we can then move them into the correct location once that is done.
But all we're looking at here is picking up our signing request,
signing it, and returning the certificate.
So we can look at this in our demonstration by seeing how
this is done and seeing it in practice.
Now you see we're working as root on the AlmaLinux 8 system,
and I mean the root/ca directory and, of course,
we can list that out, and at the moment we've just got the cert and the key.
Again, we can go through and double‑check with the ls ‑a,
but that's all that we have at the moment.
So we're going to go through and connect in as the
Vagrant user through to 192.168.33.13.
This is the IP address of my Ubuntu system.
You can put the username and IP address that you need to use to connect
through to your Ubuntu system where the signing request is.
We had placed it in the temp directory and then we called it ubuntu.csr,
Certificate Signing Request.
We can copy that through to our current directory.
Give this a go.
Now, of course, we've got to accept the public key from the remote system,
this is just SSH,
and then authenticate with the password that we set for our user account.
So that's now copied that across and, of course,
we're able to see it in our current directory.
Clearing out my screen,
we can go into openssl and then we're working with our x509 subcommand.
We can look at signing then our request and we can
specify that file is our ubuntu.csr.
The CA is then looking at the certificate that we are going to
sign to incorporate into our final certificate,
and that's then the myca.crt.
The CAkey we can specify as myca.key.
Obviously if you gave different names,
supply the names that you gave to these files.
We can set up our serial number so we can then go through
and work out what we have been using, so we've got createserial,
and we can specify the output, ubuntu.crt.
We're just going to scroll around a little bit,
only a few more options to put in.
We've got the days, so remember, we're only keeping this for a year,
we have to renew every year, and we're setting up then the cipher,
so sha256.
Hit the big Enter key.
So, of course, we've got to authenticate through to our private key,
and that's all done now.
With that done, the final step then is to copy it back,
but we want to copy back the ubuntu.crt and the myca.crt.
We, of course,
need the certificate from the signing authority to be able to set up a
trust relationship for any client on the Ubuntu system,
as well as telling the Apache server the signing authority
for the certificate that we are using.
We can copy this then through to Vagrant,
at again the same address, so we know this now,
and we can put it into the temp directory.
Obviously,
connecting as the Vagrant user we're not going to be able to put it
into secure locations inside of the etc structure,
so we can put it here and copy them across as needed.
When we then go through and hit our big Enter key,
we don't need to accept the public key now,
we already have the SSH public key, but,
of course, we need to authenticate,
but we've copied then both of those files across.
So we're good to go as far as now having a signed
certificate back on our Ubuntu system.
The final elements are going to be configuring Apache to work with the new certificate.