<p>How do I create a self signed SSL certificate for an Apache Server to use while testing a web app?</p>

[{'answer_id': 18038, 'author': 'tgmdbm', 'author_id': 1851, 'author_profile': 'https://Stackoverflow.com/users/1851', 'pm_score': -1, 'selected': False, 'text': '<p>Use OpenSSL (<a href="http://www.openssl.org/" rel="nofollow noreferrer">http://www.openssl.org/</a>)</p>\n\n<p>Here\'s a tutorial: <a href="http://novosial.org/openssl/self-signed/" rel="nofollow noreferrer">http://novosial.org/openssl/self-signed/</a></p>\n\n<p>Here is the good tutorial to start with: <a href="http://www.akadia.com/services/ssh_test_certificate.html" rel="nofollow noreferrer">SSH localhost</a>.</p>\n'}, {'answer_id': 18055, 'author': 'alexmcchessers', 'author_id': 998, 'author_profile': 'https://Stackoverflow.com/users/998', 'pm_score': 0, 'selected': False, 'text': '<p>Various tools exist that can generate SSLs.  Try <a href="http://www.openssl.org/" rel="nofollow noreferrer">OpenSSL</a> for example.  Alternatively, there\'s one in the <a href="http://www.microsoft.com/downloads/details.aspx?FamilyID=56fc92ee-a71a-4c73-b628-ade629c89499&amp;DisplayLang=en" rel="nofollow noreferrer">IIS 6 resource kit</a>, if you\'re on Windows. </p>\n'}, {'answer_id': 18062, 'author': 'Christian Hagelid', 'author_id': 202, 'author_profile': 'https://Stackoverflow.com/users/202', 'pm_score': 6, 'selected': True, 'text': '<blockquote>\n  <p><strong>How do I create a self-signed SSL\n  Certificate for testing purposes?</strong></p>\n</blockquote>\n\n<p>from <a href="http://httpd.apache.org/docs/2.0/ssl/ssl_faq.html#selfcert" rel="noreferrer" title="How do I create a self-signed SSL Certificate for testing purposes?">http://httpd.apache.org/docs/2.0/ssl/ssl_faq.html#selfcert</a>:</p>\n\n<ol>\n<li><p>Make sure OpenSSL is installed and in your PATH.</p></li>\n<li><p>Run the following command, to create server.key and server.crt\nfiles:</p>\n\n<pre><code>openssl req -new -x509 -nodes -out server.crt -keyout server.key\n</code></pre>\n\n<p>These can be used as follows in your httpd.conf file:</p>\n\n<pre><code>SSLCertificateFile    /path/to/this/server.crt\nSSLCertificateKeyFile /path/to/this/server.key\n</code></pre></li>\n<li><p>It is important that you are aware that this server.key does not have any passphrase. To add a passphrase to the key, you should run the following command, and enter &amp; verify the passphrase as requested.</p>\n\n<pre><code>openssl rsa -des3 -in server.key -out server.key.new\nmv server.key.new server.key\n</code></pre>\n\n<p>Please backup the server.key file, and the passphrase you entered,\nin a secure location.</p></li>\n</ol>\n'}, {'answer_id': 57600107, 'author': 'Francisco Luz', 'author_id': 859837, 'author_profile': 'https://Stackoverflow.com/users/859837', 'pm_score': 0, 'selected': False, 'text': '<blockquote>\n  <p><strong>WARNING:</strong> This is totally useless for purposes other than local testing.</p>\n</blockquote>\n\n<p>Replace MYDOMAIN with your local domain. Works with localhost too.</p>\n\n<p>In some folder create MYDOMAIN.conf file. Add the following content into it:</p>\n\n<pre><code>[ req ]\nprompt              = no  \ndefault_bits        = 2048  \ndefault_keyfile     = MYDOMAIN.pem  \ndistinguished_name  = subject  \nreq_extensions      = req_ext  \nx509_extensions     = x509_ext  \nstring_mask         = utf8only\n\n# The Subject DN can be formed using X501 or RFC 4514 (see RFC 4519 for a description).\n#   Its sort of a mashup. For example, RFC 4514 does not provide emailAddress.\n[ subject ]\ncountryName     = KE \nstateOrProvinceName = Nairobi \nlocalityName            = Nairobi\norganizationName         = Localhost\n\n\n# Use a friendly name here because its presented to the user. The server\'s DNS\n#   names are placed in Subject Alternate Names. Plus, DNS names here is deprecated\n#   by both IETF and CA/Browser Forums. If you place a DNS name here, then you \n#   must include the DNS name in the SAN too (otherwise, Chrome and others that\n#   strictly follow the CA/Browser Baseline Requirements will fail).\ncommonName          = Localhost dev cert  \nemailAddress            =edwin@gmail.com\n\n# Section x509_ext is used when generating a self-signed certificate. I.e., openssl req -x509 ...\n[ x509_ext ]\n\nsubjectKeyIdentifier        = hash  \nauthorityKeyIdentifier  = keyid,issuer\n\n# You only need digitalSignature below. *If* you don\'t allow\n#   RSA Key transport (i.e., you use ephemeral cipher suites), then\n#   omit keyEncipherment because that\'s key transport.\nbasicConstraints        = CA:FALSE  \nkeyUsage            = digitalSignature, keyEncipherment  \nsubjectAltName      = @alternate_names  \nnsComment           = "OpenSSL Generated Certificate"\n\n# RFC 5280, Section 4.2.1.12 makes EKU optional\n#   CA/Browser Baseline Requirements, Appendix (B)(3)(G) makes me confused\n#   In either case, you probably only need serverAuth.\n# extendedKeyUsage  = serverAuth, clientAuth\n\n# Section req_ext is used when generating a certificate signing request. I.e., openssl req ...\n[ req_ext ]\n\nsubjectKeyIdentifier        = hash\n\nbasicConstraints        = CA:FALSE  \nkeyUsage            = digitalSignature, keyEncipherment  \nsubjectAltName          = @alternate_names  \nnsComment           = "OpenSSL Generated Certificate"\n\n# RFC 5280, Section 4.2.1.12 makes EKU optional\n#   CA/Browser Baseline Requirements, Appendix (B)(3)(G) makes me confused\n#   In either case, you probably only need serverAuth.\n# extendedKeyUsage  = serverAuth, clientAuth\n\n[ alternate_names ]\n\nDNS.1       = MYDOMAIN\n\n# Add these if you need them. But usually you don\'t want them or\n#   need them in production. You may need them for development.\n# DNS.5       = localhost\n# DNS.6       = localhost.localdomain\nDNS.7       = 127.0.0.1\n\n# IPv6 localhost\n# DNS.8     = ::1\n</code></pre>\n\n<p>Generate the certificate files:</p>\n\n<pre><code>$ sudo openssl req -config MYDOMAIN.conf -new -x509 -sha256 -newkey rsa:2048 -nodes -keyout MYDOMAIN.key -days 1024 -out MYDOMAIN.crt\n$ sudo openssl pkcs12 -export -out MYDOMAIN.pfx -inkey MYDOMAIN.key -in MYDOMAIN.crt\n$ sudo chown -R $USER *\n</code></pre>\n\n<p>Make your local machine trust your certificate:</p>\n\n<pre><code># Install the cert utils\n$ sudo apt-get install libnss3-tools\n\n# Trust the certificate for SSL\n$ pk12util -d sql:$HOME/.pki/nssdb -i MYDOMAIN.pfx\n\n# Trust self-signed server certificate\n$ certutil -d sql:$HOME/.pki/nssdb -A -t "P,," -n \'dev cert\' -i MYDOMAIN.crt\n</code></pre>\n\n<p>Edit <code>/etc/apache2/sites-available/default-ssl.conf</code> and make sure these two directives are pointing to the files .crt and .key you have just created ( un-comment it if needed ):</p>\n\n<pre><code>SSLCertificateFile     /path/to/MYDOMAIN.crt\nSSLCertificateKeyFile  /path/to/MYDOMAIN.key\n</code></pre>\n\n<p>Apply configuration and re-start apache:</p>\n\n<pre><code># If you are not using the default configuration ( /etc/apache2/sites-available/default-ssl.conf ),\n# then replace "default-ssl" for whatever conf file name you\'ve chosen\n# ( DO NOT include the .conf bit ).\n$ sudo a2ensite default-ssl\n\n$ sudo service apache2 restart\n</code></pre>\n\n<p>Visit <a href="https://MYDOMAIN" rel="nofollow noreferrer">https://MYDOMAIN</a> on your browser. Firefox will warn you that the certificate is self-signed and, therefore, say it is invalid. You will have to add an exception.</p>\n\n<p>Source:</p>\n\n<ul>\n<li>Most of it I got from <a href="https://medium.com/@workockmoses/how-to-setup-https-for-local-development-on-ubuntu-with-self-signed-certificate-f97834064fd" rel="nofollow noreferrer">3dw1n_m0535</a>;</li>\n<li>If you run into trouble, read the README file at <code>/usr/share/doc/apache2/README.Debian.gz</code></li>\n</ul>\n'}]
['https://Stackoverflow.com/questions/18034', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/1310/']