Sysadmin/SSL Certificates

We use StartCom's StartSSL for our certificates.

1. Generate a key and a CSR: (we use -batch because StartSSL ignores everything but the public key in the CSR)
   openssl genrsa -out secret.key 2048
openssl req -batch -new -key CNAME.sugarlabs.org.key -out CNAME.sugarlabs.org.csr
2. Log into the StartSSL control panel.
3. If you need to reconfirm access to the Sugar Labs domain (which is required every 30 days), do the following:
   1. Go to "Validation Wizard"
   2. Select **Type**: "Domain Name Validation"
   3. Choose the validation email for which you have access to. These all go to a RT queue, so you'll need RT permissions to receive these emails.
   4. Retrieve the authentication code from RT and enter it into the StartSSL site.
4. Go to "Certificate Wizard"
5. Select "Web Server" as the certificate type
6. Skip "Generate Private Key", we already generated one on our own hardware.
7. Paste in your CSR into the textarea.
8. Select "sugarlabs.org" as the domain
9. Enter the subdomain for which you are requesting access

Your certificate will either be granted instantly, or sometime over the next three hours. You'll get an email notification when that happens, and will be able to retrieve the certificate from *Tool box > Retrieve Certificate*.

Use the SSL validator to verify the new certificate and web server configuration (NOTE: the validator doesn't seem to support SNI).