Re: Installation instructions

Jonathan -

        The snakeoil.crt certificate is designed only for limited
testing; the mod_ssl docs and Apache docs recommend that this
certificate not be used in any sort of production or even
pseudo-production environment.

On Sat, 01 Feb 2003, Jonathan S. Shapiro wrote:

> On Sat, 2003-02-01 at 10:47, John Berninger wrote:
> 
> > > 2. The instructions fail to make clear that I am actually configuring
> > > SSL for my entire apache server -- not just for current....
> >         Erp.  Good point - I'll drop that into the issues database.
> 
> More info on this:
> 
> It turns out that (at least on RH7.3) installing mod_ssl automatically
> installs server.crt and server.key files. It is *not* necessary to
> generate a new cert/key pair at all.  All that is needed is to instruct
> the person doing the install to copy
> 
> 	/etc/httpd/conf/ssl.crt/snakeoil-ca-rsa.crt
> 
> to their RHNS-CA-CERT file. I have confirmed that this works (the hard
> way).
> 
> While I am thinking about it, it is probably a good idea to localize the
> client-side configuration changes as much as possible in case the poor
> user wants to revert. Given this, it might be better to tell the user to
> stick the new ca cert file in /etc/sysconfig/rhn/, name it something
> like MY-RHNS-CA_CERT file, and change the appropriate path in the
> up2date configuration file. A minor tweak, but it's easier to understand
> what happened umpteen months later when the poor user has long forgotten
> that they tweaked any of this.
> 
> 
> shap
> 
> 
> 
> _______________________________________________
> Current-server mailing list
> [email protected]
> http://lists.dulug.duke.edu/mailman/listinfo/current-server

-- 
Thank you,
John Berninger

Systems Administrator		[email protected]
Department of Mathematics	Box 8205, Harrelson Hall
NC State University		Raleigh, NC 27695
Phone:  (919)515-6315		Fax:	(919)515-3798

GPG Key ID: A8C1D45C
        Fingerprint: B1BB 90CB 5314 3113 CF22  66AE 822D 42A8 A8C1 D45C
--