Installation d’un certificat SSL Gandi avec une configuration via ISPConfig.

Installation d’un certificat SSL Gandi avec une configuration via ISPConfig.
Distribution de travail : Ubuntu 14.04.4 LTS
Nom de domaine : 5pectre.info
/!\ Les fichiers générés ne sont que des exemples /!\
1/ Répertoire de travail :

[~] ➔ mkdir SSL
[~] ➔ cd SSL
[~/SSL] ➔

2/ Génération de la ‘Demande de Signature de Certificat‘ / ‘Certificate Signing Request‘ (CSR) :
Chiffrement : SHA2
Clé RSA : 2048
Common Name : 5pectre.info = Nom de domaine à protégé

[~/SSL] ➔ openssl req -nodes -newkey rsa:2048 -sha256 -keyout 5pectre.info.key -out 5pectre.info.csr
Generating a 2048 bit RSA private key
..............+++
...........................................+++
writing new private key to '5pectre.info.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:FR
State or Province Name (full name) [Some-State]:Meurthe-et-Moselle
Locality Name (eg, city) []:Mexy
Organization Name (eg, company) [Internet Widgits Pty Ltd]:5pectre
Organizational Unit Name (eg, section) []: (ne rien mettre)
Common Name (e.g. server FQDN or YOUR name) []:5pectre.info
Email Address []:lesanglierdesardennes@gmail.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []: (ne rien mettre)
An optional company name []: (ne rien mettre)

3/ Vérification :

[~/SSL] ➔ ls -l
total 8
-rw-rw-r-- 1 sam sam 1062 oct 20 15:47 5pectre.info.csr
-rw-rw-r-- 1 sam sam 1704 oct 20 15:47 5pectre.info.key

[~/SSL] ➔ cat ./5pectre.info.csr
-----BEGIN CERTIFICATE REQUEST-----
MIIC2DCCAcACAQAwgZIxCzAJBgNVBAYTAkZSMRswGQYDVQQIDBJNZXVydGhlLWV0
LU1vc2VsbGUxDTALBgNVBAcMBE1leHkxEDAOBgNVBAoMBzVwZWN0cmUxFTATBgNV
ZGVubmVzQGdtYWlsLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
AOyFlVGq6HVBsWVx78TsYYtCBYEuEZC/iaN1ao/NouHKEjoY9CSvZhijJRx5rIj7
avB7VRj5aXufoCFWFpEb81qWoA/JiTE0Fm5rHN/kuvvhkKUXZ+yaTmQq10/KtV+c
zuTTlAf481jMCZ8lFSZfqHU6hXF8SfLlx2Ne4zIGW31vTledI1y4sjzk7k6rrrfx
bJKNjIa3JtbHmSueVmoMbGD+9eiS4AkzXNJVvAUZeE8RKHf1eqksXGtB87jl51OD
2cE1KOxZUe9sovQUB9AygmIznAIaknESgvWBeodHqb6z6n1ZZD8ULESlLt9u3sRv
yDGKR7PPova/hgVZ9C/MHk37xTWERJbFsd1fKoXzz2onIJyhuyrnJit9QQkROPpq
tU4GtDDgCzgZZSio
-----END CERTIFICATE REQUEST-----

[~/SSL] ➔ cat ./5pectre.info.key
-----BEGIN PRIVATE KEY-----
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDshZVRquh1QbFl
ce/E7GGLQgWBLhGQv4mjdWqPzaLhyhI6GPQkr2YYoyUceayI+2rwe1UY+Wl7n6Ah
VhaRG/NalqAPyYkxNBZuaxzf5Lr74ZClF2fsmk5kKtdPyrVfnM7k05QH+PNYzAmf
nlZqDGxg/vXokuAJM1zSVbwFGXhPESh39XqpLFxrQfO45edTgwvYyXhccxdwJAdk
lWpKM7hT4+lJnH+my07ccQVzRBbO/Hwi5004DUUTELaglvX+8aS98KhRd79sWHID
u6s0n5jTAgMBAAECggEBAJeJmrqhWqBNv5+0WR99J532Zdp3Lq/j2AaPYv/Ri4tI
UVdBx6J9cldUp6FP35hAJSsAiewfWFLpWcoiAwFjvA4NNW4H/Ms2iSyjmfNk89wP
kAIGNgJkdtc8j4jC4mPo7rGzUUOuYBNDXuLE+oEEhsTdAsRMEoD6cT4cfEn/wrxg
cCPu1RDC7HEKZ+rwj6yYpmMO6LECgYEA89CNWxp4KAajsUiiJO5cGXUdbK5tzYmr
gH5LIkX6hQgmwPS8FbTY8xM2pSDKkPq8U1j26nsDdVV2ucfiFhiyKTngMJseJT2e
asnFsFNgesMCgYAl9EI+pj/wOhvTkrH2JvS/QrptROlkBfcgV8JPfaBTEUMFRrTa
KJJGjI8m1bDW39+Kn8PJ3nWCyfP92djaiUxDrgPVO59mHdvgUO7tIVdt7jMguoUY
g6mGA27e7gcpvo8/Y1L952YqnhdAdxTjbppxtb4UpLISb7WUP6yUwU7mAQKBgQCJ
NANYET0syQ+05DrarYgGi3FTh5Ui5SYt2ORPFTI1SrEERLTTQkIUB+voYNudWnxA
KvA6SOguSEn2u9SF2UrOxSvOYYS44jBQ19r3rvPMIQKBgHozH+ysrCHRdCg0uhhZ
wymBHZSBcCO66PG3Ljsv1HFa5JckVG4b29Vt1R3j0GDW912tW9vTtRB/x68AgMZP
A5eaVIZcls23QzQ/HhQab8zxvZY7ce0hSyORUSqh5XgUBQromO/8Yj0W240g3eJ3
VbsJQhV+aTwQ/jHUCAnzg6jB
-----END PRIVATE KEY-----

4/ A partir du formulaire CSR :
https://www.gandi.net/ssl/create/csr
– Copier le contenu du fichier ‘.csr‘ dans la zone de texte ‘CSR‘.
Domaine (CN) principal : 5pectre.info
Logiciel utilisé : Apache/ModSSL
Puis [Valider].
– Accepter les ‘Conditions particulières de vente des certificats SSL‘ puis [Valider].
5/ Attendre la création des certificats :
https://www.gandi.net/admin/orders

Transaction :
- Commande : Certificat SSL - Création d'un certificat SSL
  Etat : En attente ou en validation de paiement.
- Commande : Certificat SSL - Création d'un certificat SSL
  État : En cours
	Afficher les étapes : https://www.gandi.net/admin/ssl/steps/XXXXXX
	- Étape 1 : Validation du contact
	- Étape 2 : Validation des droits sur les domaines
	le méthode de ‘Domain Control Validation‘ (DCV) :  Méthode DNS (performed automatically) soit : Validation par Record DNS
	La validation se fait automatiquement.
	Un enregistrement de type ‘CNAME‘ va être ajouté à la zone DNS du nom de domaine.
- Étape 3 : Validation finale et attribution du certificat

Délai d’attente : 1 heure 30
6/ Téléchargement des certificats :
A la page d’information du SSL du nom de domaine ‘5pectre.info‘ :
https://www.gandi.net/admin/ssl/XXXXXX/details
– ‘Certificat intermédiaire standard‘ / ‘Intermediate Certificate‘ au format ‘PEM’ :

[~/SSL] ➔ wget https://www.gandi.net/static/CAs/GandiStandardSSLCA2.pem

➜  SSL cat GandiStandardSSLCA2.pem
-----BEGIN CERTIFICATE-----
MIIF6TCCA9GgAwIBAgIQBeTcO5Q4qzuFl8umoZhQ4zANBgkqhkiG9w0BAQwFADCB
iDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0pl
cnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV
BAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTQw
OTEyMDAwMDAwWhcNMjQwOTExMjM1OTU5WjBfMQswCQYDVQQGEwJGUjEOMAwGA1UE
CBMFUGFyaXMxDjAMBgNVBAcTBVBhcmlzMQ4wDAYDVQQKEwVHYW5kaTEgMB4GA1UE
AxMXR2FuZGkgU3RhbmRhcmQgU1NMIENBIDIwggEiMA0GCSqGSIb3DQEBAQUAA4IB
DwAwggEKAoIBAQCUBC2meZV0/9UAPPWu2JSxKXzAjwsLibmCg5duNyj1ohrP0pIL
m6jTh5RzhBCf3DXLwi2SrCG5yzv8QMHBgyHwv/j2nPqcghDA0I5O5Q1MsJFckLSk
QFEW2uSEEi0FXKEfFxkkUap66uEHG4aNAXLy59SDIzme4OFMH2sio7QQZrDtgpbX
bmq08j+1QvzdirWrui0dOnWbMdw+naxb00ENbLAb9Tr1eeohovj0M1JLJC0epJmx
bUi8uBL+cnB89/sCdfSN3tbawKAyGlLfOGsuRTg/PwSWAP2h9KK71RfWJ3wbWFmV
XooS/ZyrgT5SKEhRhWvzkbKGPym1bgNi7tYFAgMBAAGjggF1MIIBcTAfBgNVHSME
GDAWgBRTeb9aqitKz1SA4dibwJ3ysgNmyzAdBgNVHQ4EFgQUs5Cn2MmvTs1hPJ98
rV1/Qf1pMOowDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYD
VR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMCIGA1UdIAQbMBkwDQYLKwYBBAGy
MQECAhowCAYGZ4EMAQIBMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNl
cnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNy
bDB2BggrBgEFBQcBAQRqMGgwPwYIKwYBBQUHMAKGM2h0dHA6Ly9jcnQudXNlcnRy
dXN0LmNvbS9VU0VSVHJ1c3RSU0FBZGRUcnVzdENBLmNydDAlBggrBgEFBQcwAYYZ
aHR0cDovL29jc3AudXNlcnRydXN0LmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAWGf9
crJq13xhlhl+2UNG0SZ9yFP6ZrBrLafTqlb3OojQO3LJUP33WbKqaPWMcwO7lWUX
zi8c3ZgTopHJ7qFAbjyY1lzzsiI8Le4bpOHeICQW8owRc5E69vrOJAKHypPstLbI
FhfFcvwnQPYT/pOmnVHvPCvYd1ebjGU6NSU2t7WKY28HJ5OxYI2A25bUeo8tqxyI
yW5+1mUfr13KFj8oRtygNeX56eXVlogMT8a3d2dIhCe2H7Bo26y/d7CQuKLJHDJd
ArolQ4FCR7vY4Y8MDEZf7kYzawMUgtN+zY+vkNaOJH1AQrRqahfGlZfh8jjNp+20
J0CT33KpuMZmYzc4ZCIwojvxuch7yPspOqsactIGEk72gtQjbz7Dk+XYtsDe3CMW
1hMwt6CaDixVBgBwAc/qOR2A24j3pSC4W/0xJmmPLQphgzpHphNULB7j7UTKvGof
KA5R2d4On3XNDgOVyvnFqSot/kGkoUeuDcL5OWYzSlvhhChZbH2UF3bkRYKtcCD9
0m9jqNf6oDP6N8v3smWe2lBvP+Sn845dWDKXcCMu5/3EFZucJ48y7RetWIExKREa
m9T8bJUox04FB6b9HbwZ4ui3uRGKLXASUoWNjDNKD/yZkuBjcNqllEdjB+dYxzFf
BT02Vf6Dsuimrdfp5gJ0iHRc2jTbkNJtUQoj1iM=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIFdzCCBF+gAwIBAgIQE+oocFv07O0MNmMJgGFDNjANBgkqhkiG9w0BAQwFADBv
MQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFk
ZFRydXN0IEV4dGVybmFsIFRUUCBOZXR3b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBF
eHRlcm5hbCBDQSBSb290MB4XDTAwMDUzMDEwNDgzOFoXDTIwMDUzMDEwNDgzOFow
gYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtK
ZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYD
VQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIICIjAN
BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAgBJlFzYOw9sIs9CsVw127c0n00yt
UINh4qogTQktZAnczomfzD2p7PbPwdzx07HWezcoEStH2jnGvDoZtF+mvX2do2NC
tnbyqTsrkfjib9DsFiCQCT7i6HTJGLSR1GJk23+jBvGIGGqQIjy8/hPwhxR79uQf
jtTkUcYRZ0YIUcuGFFQ/vDP+fmyc/xadGL1RjjWmp2bIcmfbIWax1Jt4A8BQOujM
8Ny8nkz+rwWWNR9XWrf/zvk9tyy29lTdyOcSOk2uTIq3XJq0tyA9yn8iNK5+O2hm
AUTnAU5GU5szYPeUvlM3kHND8zLDU+/bqv50TmnHa4xgk97Exwzf4TKuzJM7UXiV
Z4vuPVb+DNBpDxsP8yUmazNt925H+nND5X4OpWaxKXwyhGNVicQNwZNUMBkTrNN9
N6frXTpsNVzbQdcS2qlJC9/YgIoJk2KOtWbPJYjNhLixP6Q5D9kCnusSTJV882sF
qV4Wg8y4Z+LoE53MW4LTTLPtW//e5XOsIzstAL81VXQJSdhJWBp/kjbmUZIO8yZ9
HE0XvMnsQybQv0FfQKlERPSZ51eHnlAfV1SoPv10Yy+xUGUJ5lhCLkMaTLTwJUdZ
+gQek9QmRkpQgbLevni3/GcV4clXhB4PY9bpYrrWX1Uu6lzGKAgEJTm4Diup8kyX
HAc/DVL17e8vgg8CAwEAAaOB9DCB8TAfBgNVHSMEGDAWgBStvZh6NLQm9/rEJlTv
A73gJMtUGjAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/
BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wEQYDVR0gBAowCDAGBgRVHSAAMEQGA1Ud
HwQ9MDswOaA3oDWGM2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9BZGRUcnVzdEV4
dGVybmFsQ0FSb290LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0
dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggEBAJNl9jeD
lQ9ew4IcH9Z35zyKwKoJ8OkLJvHgwmp1ocd5yblSYMgpEg7wrQPWCcR23+WmgZWn
RtqCV6mVksW2jwMibDN3wXsyF24HzloUQToFJBv2FAY7qCUkDrvMKnXduXBBP3zQ
YzYhBx9G/2CkkeFnvN4ffhkUyWNnkepnB2u0j4vAbkN9w6GAbLIevFOFfdyQoaS8
Le9Gclc1Bb+7RrtubTeZtv8jkpHGbkD4jylW6l/VXxRTrPBPYer3IsynVgviuDQf
Jtl7GQVoP7o81DgGotPmjw7jtHFtQELFhLRAlSv0ZaBIefYdgWOWnU914Ph85I6p
0fKtirOMxyHNwu8=
-----END CERTIFICATE-----

– Certificat ‘Cross Signed Comodo‘ au format ‘pem’ :
https://wiki.gandi.net/fr/ssl/intermediate#certificat_cross_signed_comodo
Ouvrir :

USERTrustRSAAddTrustCA.pem

Ajouter :

7/ Création des certificats chaînés :

[~/SSL] ➔ cat GandiStandardSSLCA2.pem USERTrustRSAAddTrustCA.pem > 5pectre.info.csr.chained.crt

8/ A partir de l’interface Gandi SSL :
https://www.gandi.net/admin/ssl/XXXXXX/details
Télécharger le certificat ‘certificate-XXXXXX.crt‘, ici :
https://www.gandi.net/admin/ssl/XXXXXX/download
Soit : certificate-.crt
10/ Renommage du certificat .crt :

[~/SSL] ➔ mv certificate-359406.crt 5pectre.info.crt

➜  SSL cat 5pectre.info.crt
-----BEGIN CERTIFICATE-----
MIIE8zCCA9ugAwIBAgIQdNDws6NIkdGlEXSkD08SEzANBgkqhkiG9w0BAQsFADBf
MQswCQYDVQQGEwJGUjEOMAwGA1UECBMFUGFyaXMxDjAMBgNVBAcTBVBhcmlzMQ4w
DAYDVQQKEwVHYW5kaTEgMB4GA1UEAxMXR2FuZGkgU3RhbmRhcmQgU1NMIENBIDIw
HhcNMTYxMDIwMDAwMDAwWhcNMTcxMDIwMjM1OTU5WjBXMSEwHwYDVQQLExhEb21h
TDEVMBMGA1UEAxMMNXBlY3RyZS5pbmZvMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
MIIBCgKCAQEA7IWVUarodUGxZXHvxOxhi0IFgS4RkL+Jo3Vqj82i4coSOhj0JK9m
GKMlHHmsiPtq8HtVGPlpe5+gIVYWkRvzWpagD8mJMTQWbmsc3+S6++GQpRdn7JpO
ZCrXT8q1X5zO5NOUB/jzWMwJnyUVJl+odTqFcXxJ8uXHY17jMgZbfW9OV50jXLiy
POTuTquut/Fsko2Mhrcm1seZK55WagxsYP716JLgCTNc0lW8BRl4TxEod/V6qSxc
a0HzuOXnU4ML2Ml4XHMXcCQHZJVqSjO4U+PpSZx/pstO3HEFc0QWzvx8IudNOA1F
MEEGA1UdHwQ6MDgwNqA0oDKGMGh0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9HYW5k
aVN0YW5kYXJkU1NMQ0EyLmNybDBzBggrBgEFBQcBAQRnMGUwPAYIKwYBBQUHMAKG
dDAlBggrBgEFBQcwAYYZaHR0cDovL29jc3AudXNlcnRydXN0LmNvbTApBgNVHREE
IjAgggw1cGVjdHJlLmluZm+CEHd3dy41cGVjdHJlLmluZm8wDQYJKoZIhvcNAQEL
BQADggEBAFyDMloNdpYPQvuqxmQJhzsC5Q1hFu9eC24BCCvr9KlfwTLkgSBl20py
1yMFhmr7/tjLE8Gww34h4tzGGCnQiFJjNwHWPX6ZxISxItu/wqprl2EdElI/17iW
Ks7iOiAsTaKQJpwU+B3dp/ruEcfRkTCyESFSY8prRL1BhNOQ5HODDGY8Reip3Asz
B6+nacXEGlerLI3yyK2Db2hXwio5FjWIMppKHyBOlLzBmd1GQlB7bFNNwx1DpSMo
+1YhdJQjxHsu1dOajBOjHd2C1ofCBJw=
-----END CERTIFICATE-----

9/ Résumé des fichiers générés :

[~/SSL] ➔ ls -l
total 28
-rw-rw-r-- 1 sam sam 1777 oct 20 16:43 5pectre.info.crt
-rw-rw-r-- 1 sam sam 1062 oct 20 15:47 5pectre.info.csr
-rw-rw-r-- 1 sam sam 6022 oct 20 16:46 5pectre.info.csr.chained.crt
-rw-rw-r-- 1 sam sam 1704 oct 20 15:47 5pectre.info.key
-rw-rw-r-- 1 sam sam 4066 oct 13 12:04 GandiStandardSSLCA2.pem
-rw-rw-r-- 1 sam sam 1956 oct 20 16:41 USERTrustRSAAddTrustCA.pem

Soit :
5pectre.info.key : Ficher clé généré
5pectre.info.csr : Fichier .csr généré
GandiStandardSSLCA2.pem : Certificat intermédiare
USERTrustRSAAddTrustCA.pem : Cross-Signed de Comodo
5pectre.info.csr.chained.crt : Concaténation de GandiStandardSSLCA2.pem et de USERTrustRSAAddTrustCA.pem
5pectre.info.crt : Fichier anciennement ‘certificate-XXXXXX.crt‘
10/ Configuration via ISPConfig.

- [Site]
- [Sites web]
- Sélectionner le site web
- [Domain]
  SSL : v
  [Enregistrer]
- [SSL]
  Pays : France
  Localité : Mexy
  Organisation : 5pectre
  Unité d'organisation : (ne rien mettre)
  Pays : France
  Domain SSL : 5pectre.info
  Clé SSL : 5pectre.info.key
  Requête SSL :
  Certificat SSL : 5pectre.info.crt
  SSL Bundle : 5pectre.info.csr.chained.crt
- Action SSL : Enregistrer le certificat
- [Enregistrer]

Attendre quelques minutes.
11/ Vérification :
https://www.digicert.com/help/

12/ Vérification sur le site web :
http://5pectre.info/ et https://5pectre.info/

13/ Liens :
https://memodugeek.info/lets-encrypt-et-ssl/

Installation d’un certificat SSL Gandi avec une configuration via ISPConfig.

Articles récents