Creating SSL certificate for use in Azure Containers

 

Audience

Staff

Overview

This document describes the steps to create a self-signed certificate for use in Azure Containers.

 

Creating the SSL Certificate Request file (CSR)

To begin this process ensure the below is true. You are logged in to the SVCTOOLS server. Ensure that "openssl" tool is installed. Creating a CRT file for Azure Containers using OpenSSL

  1. Login to the server where you will be creating the self-signed certificate
    1. SVCTOOLS
  2. If the Openssl tool is not installed follow the below steps.
    1. Copy the OpenSSL install file from the below provided location to the server (i.e. E:\Software) OR download from the provided link:
      1. \\univ.pitt.edu\svc\NetAdmin\Software_admin\OpenSSL\openssl-0.9.8h-1-setup.exe
    2. Download OpenSSL from the link provided
      1. https://sourceforge.net/projects/gnuwin32/files/openssl/0.9.8h-1/
  3. Navigate to the directory with the OpenSSL install file you copied/downloaded from step 1
  4. Run the install file "As Administrator" - Select all default settings for installing.
  5. Edit the System Variable Path to include the newly created directory. This path should identify where the OpenSSL.exe file is located as shown below:
    1. C:\Program Files (x86)\GnuWin32\bin
  6. Reboot the server in order for the path to take effect.
  7. After the reboot, login and navigate to the folder where the certificate files will be located (i.e. e:\certs)
    1. If the site/server folder doesn't exist create it
      1. E:\Certs\servernamehere\
    2. NOTE - If files already exist in the folder archive them appropriately or they will be over written. If the file need to be retained move them to a sub-folder called Archive.
  8. Open a command prompt with Administrator rights and navigate to the new folder you just created or where the certificate file will be located.
    1. E:\Cert\servernamehere\
  9. There are two way to generate the CSR from the command prompt and while in the directory where the files will be created run the below command(s):
    1. Compete automated responses:
      1. openssl req -nodes -newkey rsa:4096 -keyout E:\certs\servernamehere\servernamehere.hs.pitt.edu.key -config "C:\Program Files (x86)\GnuWin32\share\openssl.cnf" -out E:\certs\servernamehere\servernamehere.hs.pitt.edu.csr -subj "/C=US/ST=Pennsylvania/L=Pittsburgh/O=University Of Pittsburgh/OU=HSIT/CN=servernamehere.hs.pitt.edu/emailAddress=svc-itargetnetwork@pitt.edu"
    2. If you would prefer to enter the details below manually you can by running the below:
      1. openssl req -nodes -newkey rsa:4096 -keyout E:\certs\servernamehere\servernamehere.hs.pitt.edu.key -config "C:\Program Files (x86)\GnuWin32\share\openssl.cnf" -out E:\certs\servernamehere\servernamehere.hs.pitt.edu.csr
      2. Enter PEM Pass Phrase:  "this is our normal certificate password we use"
      3. Country Name: US
      4. State or Province Name: Pennsylvania
      5. Location Name: Pittsburgh
      6. Organization Name: University of Pittsburgh
      7. Organizational Unit Name: HSIT
      8. Common Name: servernamehere.hs.pitt.edu or the FQDN of the server
      9. Email Address: svc-itargetnetwork@pitt.edu
  10. The above step(s) will begin the process of creating the self-signed certificate.
  11. When the process is complete you will be returned to the command prompt and you will now see the below three files. 
    1. servernamehere.hs.pitt.edu.pk - This is your private key DO NOT give it out.
    2. servernamehere.hs.pitt.edu.crt - This is your public key and can be given to anyone who requires it.
    3. servernamehere.hs.pitt.edu.key - 
    4. servernamehere.hs.pitt.edu.csr - This is used to upload to Sectigo to obtain the real certificate

Enrolling in University Certificate Process:

  1. The next process is to use the newly create Certificate Request to Enroll for a SSL Certificate
  2. You can now go to the Pitt website to request the Incommon Certificate.
  3. Use your Web Browser and navigate to:
    1. https://cert-manager.com/customer/InCommon/ssl?action=enroll
    2. On the screen provided Type in the below E-mail address:
      1. svc-ssladmin@pitt.edu
      2. You will receive an E-mail directing you to Confirm the request.
      3. Click the GREEN "Confirm Authentication Request".
      4. This will open the main screen for managing Secitgo certificates.
    3. On the top right side you will see a GREEN "Enroll Certificate" button. Click it.
    4. The next screen present an enrollment access page requesting you to provide either the Access Code or Enrollment Account.
      1. Using the "Enroll with Access Code enter the below Code:
        1. UPitt
        2. Click "Next"
        3. You may receive a error in RED showing that your profile was not found. This can safely be ignored at this time.
    5. SSL Certificate Enrollment
      1. Certificate Profile:
        1. There are many options to chose from and the answer will depend on the type of certificate you are requesting. Most of HSIT certificates are InCommon SSL Multi Domain, but there is an option for single or wildcards.
        2. Select the proper profile
        3. The Certificate Term will be filled in for you depending on the choice you made.
        4. Click the Upload CSR button and locate the CSR you created earlier in the process.
          1. E:\certs\servernamehere\servernamehere.hs.pitt.edu.csr
          2. Once you have selected your file it will populate the CSR box with the content from the file and also show the Common Name below it.
          3. Click the GREEN "Submit" button.
          4. You should receive an E-mail confirmation that your request has been submitted and awaiting approval.
          5. The second E-mail will state that your request was approved.
          6. The final E-mail will have your certificates you can download and install.
  4. Upon receiving the certificates via the Secitgo response E-mail, download each and save them to the folder you created earlier and where the files are located.
    1. E:\certs\servernamehere
    2. In the folder you will see the four (4) files created in the first process creating the CSR request.
    3. You will also see the seven (7) files you downloaded from the Secitgo E-mail.
    4. You are now ready to complete the process by creating the PFX file.

Creating the PFX file from OpenSSL

Create the PFX file

  1. The first step in creating a PFX file is to run the below command from an administrator prompt using the above named PK & CRT files you just created.
    1. Open a command prompt with Administrator rights and navigate to the folder where the certificate file will be located.
      1. E:\certs\servernamehere
      2. RUN this command:
        1. openssl pkcs12 -export -out dev.hs.pitt.edu.pfx -inkey dev.hs.pitt.edu.key -in dev.hs.pitt.edu.crt -certfile dev.hs.pitt.edu.cer
        2. You might run in to some issues, but the process will indicate the errors when it runs. Common errors are:
          1. No certificates match private key.
  2. Action 2

 

 

Feedback and Concerns:

Our articles are continuously improving, and your feedback helps us make them even better. If you have any comments or suggestions about this article, please email hsitkb@pitt.edu or use the "Was this helpful?" section below to leave a response.

Print Article