With the recent federal government shutdown, it’s quite apparent their IT administrators still renew SSL certificates manually since many government websites went offline after the certs expired. Politics aside, since having secured connection and valid certificates are important these days, it should be a point for administrators to start automating the process. At the very least, have a project or plan in place to anticipate the shutdown and go through all of the important websites for possible cert renewals, 1-2 months in advance. As an Enterprise administrator, it’s also essential to have alerts or calendar reminders to renew an expiring cert. However, the best solution is to setup an automated job.
This is where tools out there like getssl and certbot can help. For this website, getssl is used to automate the SSL renewal process. The key processes are as follows:
Ensure Apache web server is setup. Since getssl relies on obtaining the proper “ACME” code from the target website to confirm the correct URL host, a regular port 80 HTTP connection must be made available first.
Per getssl documentation, run the inital setup to create the proper folders and files in $HOME/.getssl
getssl -c yourdomain.com
Edit the getssl.cfg in $HOME/.getssl/yourdomain.com folder with the correct directory for Apache web server’s doc-root and configuration files. Note, package installed Apache HTTPD uses /etc/apache2 as the default config directory.
When getssl is all setup, create a crontab to run getssl twice every month, for timely renewal (within 30 days). Be sure to restart Apache HTTPD to make sure the web server reloads the latest cert files.
0 9 1,15 * * $HOME/getssl/getssl -u -a > $HOME/getssl/getssl.out.txt 2>&1
I’ve described a way to install a self-signing SSL certificate using OpenSSL for testing purposes. When connecting to a web server using a web browser client, it is straight forward to add the “fake” certificate (just follow the instructions on the browser screen). However, in a Java application, it’s a little bit more work.
The procedure is the following:
- Obtain the SSL certificate from the website administrator. Alternatively, use the browser:
- Browse the URL, for example: https://www.testmachine.com
- When the security window popup appears, just click ‘continue’.
- The browser has an option to view the certificate. With Internet Explorer 7, next to the Address Bar there’s a “Certificate Error” button. Press that and view certificate. With Firefox, click on the yellow lock at the bottom of the screen.
- Go to the Details tab.
- Click on “Copy to File”. In Firefox, click on the “Export” button.
- Save the file as “website.cert”
- Copy the Cert file to where the Java client is going to be executed.
- Go to the JRE (Java Run Time) library under lib/security, for example: /usr/local/jdk_1.4.3/jre/lib/security/
- The certs are stored in a file called “cacerts”.
- Run the keytool app to import the “website.cert” file that was exported earlier from a web browser:
keytool -import -alias websiteAlias -keystore cacerts -file website.cert
- Enter the default password: changeit
- Check the content of the new “cacerts” file using:
keytool -list -keystore cacerts
- Test it. If it’s a web container (i.e. Tomcat), restart the JVM.
Webapper site has a short Java client test code, and a quick procedure to compile/run a client to test it.