{"id":11692,"date":"2017-07-26T10:21:38","date_gmt":"2017-07-26T10:21:38","guid":{"rendered":"https:\/\/www.process.st\/templates\/ssl-certificate-renewal-checklist\/"},"modified":"2024-02-28T20:45:53","modified_gmt":"2024-02-28T20:45:53","slug":"ssl-certificate-renewal-checklist","status":"publish","type":"post","link":"https:\/\/www.process.st\/templates\/ssl-certificate-renewal-checklist\/","title":{"rendered":"SSL Certificate Renewal Checklist"},"content":{"rendered":"<section id=\"introduction\">\n<h2> Introduction: <\/h2>\n<div class=\"text-content\">\n<p>The SSL certificate renewal process is arcane, nuanced, and easy to forget or mess up. To make sure you don't make a mistake with it (and end up putting your site's security at risk), follow the steps in this checklist.<\/p>\n<p>This checklist is the exact process that Cameron, the <a href=\"https:\/\/www.process.st\" rel=\"nofollow noopener\" target=\"_blank\">Process Street<\/a> CTO, uses to renew our site's SSL certificates, including some deprecated steps (labeled) for reference.<\/p>\n<\/p><\/div>\n<\/section>\n<section id=\"generate-csr\">\n<h2> Generate CSR <\/h2>\n<div class=\"text-content\">\n<p>From the command line:<\/p>\n<pre>\nopenssl req -nodes -newkey rsa:2048 -nodes -keyout process-st-$(date +&quot;%b-%Y&quot;).key -out process-st-$(date +&quot;%b-%Y&quot;).csr -subj &quot;\/C=US\/ST=CA\/L=San Francisco\/O=Process Street\/OU=IT\/CN=*.process.st&quot;<\/pre>\n<p>This will generate two files (month and year may be different):<\/p>\n<ul>\n<li>process-st-Sep-2014.csr<\/li>\n<li>process-st-Sep-2014.key<\/li>\n<\/ul>\n<p>The .key file is the private key, DO NOT send it over any unencrypted channel (such as email or Skype).<\/p>\n<p><a href=\"https:\/\/support.comodo.com\/index.php?\/Default\/Knowledgebase\/Article\/View\/1\/19\/csr-generation-using-openssl-apache-wmod_ssl-nginx-os-x\" rel=\"nofollow noopener\" target=\"_blank\">https:\/\/support.comodo.com\/index.php?\/Default\/Knowledgebase\/Article\/View\/1\/19\/csr-generation-using-openssl-apache-wmod_ssl-nginx-os-x<\/a><\/p>\n<\/p><\/div>\n<\/section>\n<section id=\"send-csr-to-namecheap-obtain-ssl-certificate-zip\">\n<h2> Send CSR to Namecheap, obtain SSL certificate .zip <\/h2>\n<div class=\"text-content\">\n<p>Send the .csr file to Namecheap so they can generate the SSL certificate.<\/p>\n<p>They will ask for an approver email, pick admin@process.st. An email will come to that address with instructions on how to approve it (do an explicit search for admin@process.st, just in case it's auto-archived). Once that is done, cameron@process.st will receive a .zip file with the certificate.<\/p>\n<\/p><\/div>\n<\/section>\n<section id=\"update-aws-certificate\">\n<h2> Update AWS certificate <\/h2>\n<div class=\"text-content\">\n<p>Go to the Load Balancers section, select a load balancer, click &quot;Actions&quot; then &quot;Edit listeners&quot;.<\/p>\n<p>For the HTTPS listener, select Change for the SSL Certificate. Choose &quot;Upload a&nbsp;<strong>new<\/strong>&nbsp;SSL Certificate&quot;.<\/p>\n<p>Name the new certificate &quot;PositiveSSL2-MMMYYYY&quot; where MMM and YYYY are the month and year.<\/p>\n<p>In the &quot;<strong>Private Key<\/strong>&quot;&nbsp;field, put the contents of process-st-MMM-YYYY.key.<\/p>\n<p>In the &quot;<strong>Public Key Certificate<\/strong>&quot; field, put the contents of STAR_process_st.crt.<\/p>\n<p>In the &quot;<strong>Certificate Chain<\/strong>&quot; field, put the contents of process-st-MMM-YYYY-apache-bundle.crt (generated in the <strong>Update Linode certificate<\/strong>&nbsp;step).<\/p>\n<p>Remember in all these steps to have NO trailing newlines.<\/p>\n<p>Once done, click Save, then Save again to make them live.<\/p>\n<p>Do this for both load balancers.<\/p>\n<p><a href=\"http:\/\/docs.aws.amazon.com\/ElasticLoadBalancing\/latest\/DeveloperGuide\/US_UpdatingLoadBalancerSSL.html\" rel=\"nofollow noopener\" target=\"_blank\">http:\/\/docs.aws.amazon.com\/ElasticLoadBalancing\/latest\/DeveloperGuide\/US_UpdatingLoadBalancerSSL.html<\/a><\/p>\n<\/p><\/div>\n<\/section>\n<section id=\"deprecated-update-linode-certificate\">\n<h2> Deprecated: Update Linode certificate <\/h2>\n<div class=\"text-content\">\n<p><strong>This step is no longer necessary as we don't use Linode anymore.<\/strong><\/p>\n<p>Since our Linode uses Apache, we need 3 things:<\/p>\n<ol>\n<li>The process-st-MMM-YYYY.key generated earlier.<\/li>\n<li>The STAR_process_st.crt file from the .zip file sent from Comodo\/Namecheap.<\/li>\n<li>A newly generated file called process-st-MMM-YYYY-apache-bundle.crt.<\/li>\n<\/ol>\n<p>To generate this bundle, run the following command in the shell:<\/p>\n<pre>cat COMODORSADomainValidationSecureServerCA.crt COMODORSAAddTrustCA.crt AddTrustExternalCARoot.crt &gt; process-st-$(date +&quot;%b-%Y&quot;)-apache-bundle.crt<\/pre>\n<p>Upload these 3 files to the Linode site. REMEMBER to use SFTP or SCP, or else the private key could be compromised!<\/p>\n<p>After uploading them, place the .key file in the \/etc\/ssl\/private and place the .crt files in \/etc\/ssl\/certs.<\/p>\n<p>Next, open up \/etc\/apache2\/sites-available\/default-ssl.conf and update the lines:<\/p>\n<pre>SSLCertificateFile \/etc\/ssl\/certs\/STAR_process_st.crt\nSSLCertificateKeyFile \/etc\/ssl\/private\/process-st-MMM-YYYY.key\nSSLCertificateChainFile \/etc\/ssl\/certs\/process-st-MMM-YYYY-apache-bundle.crt<\/pre>\n<p>Then restart Apache. Donezo.<\/p>\n<\/p><\/div>\n<\/section>\n<section id=\"deprecated-update-nginx-certificate-for-front-street-app\">\n<h2> Deprecated: Update nginx certificate for Front Street app <\/h2>\n<div class=\"text-content\">\n<p><strong>This step is no longer necessary as the ELB will handle SSL.<\/strong><\/p>\n<p>Certificates are located in these directories:<\/p>\n<ul>\n<li>\n<p>\/etc\/pki\/tls\/certs\/process.st-MMM-YYYY-nginx-bundle.crt<\/p>\n<\/li>\n<li>\n<p>\/etc\/pki\/tls\/private\/process-st-MMM-YYYY.key<\/p>\n<\/li>\n<\/ul>\n<p>Add the new .key file (be sure to copy with scp!) you generated before to private directory.<\/p>\n<p>To create the bundle, you need to run the following command:<\/p>\n<pre>\ncat STAR_process_st.crt COMODORSADomainValidationSecureServerCA.crt COMODORSAAddTrustCA.crt AddTrustExternalCARoot.crt &gt; process-st-$(date +&quot;%b-%Y&quot;)-nginx-bundle.crt<\/pre>\n<p>Once the bundle is created, copy it to the directory above.<\/p>\n<p>Also be sure to update \/etc\/nginx\/nginx.conf so that the keys...<\/p>\n<ul>\n<li>ssl_certificate&nbsp;<\/li>\n<li>ssl_certificate_key<\/li>\n<\/ul>\n<p>...point to the correct MMM-YYYY values (i.e. Sep-2014).<\/p>\n<p><a href=\"https:\/\/support.comodo.com\/index.php?\/Default\/Knowledgebase\/Article\/View\/789\/37\/certificate-installation-nginx\" rel=\"nofollow noopener\" target=\"_blank\">https:\/\/support.comodo.com\/index.php?\/Default\/Knowledgebase\/Article\/View\/789\/37\/certificate-installation-nginx<\/a><\/p>\n<\/p><\/div>\n<\/section>\n<section id=\"deprecatedupdate-java-keystore-for-process-street-app\">\n<h2> Deprecated:&nbsp;Update Java Keystore for Process Street app <\/h2>\n<div class=\"text-content\">\n<p><strong>This step is no longer necessary as the ELB will handle SSL.<\/strong><\/p>\n<h5>Generate p12 certificate<\/h5>\n<pre>\nopenssl pkcs12 -export -in STAR_process_st.crt -inkey process-st-MMM-YYYY.key &gt; process-st-$(date +&quot;%b-%Y&quot;).p12<\/pre>\n<p>It will ask for a password. Set it to: abcdef.<\/p>\n<h5>Generate Java Keystore using the p12 certificate<\/h5>\n<pre>\nkeytool -importkeystore -srckeystore process-st-MMM-YYYY.p12 -destkeystore process.st.jks -srcstoretype pkcs12<\/pre>\n<p>It will ask for a password. Use the same one as you used in the previous step. In the end you will enter the same password 3 times (2 times for the .jks password, 1 time for p12 password).<\/p>\n<h5>Import all certificates in the trust chain<\/h5>\n<pre>\nkeytool -import -trustcacerts -alias AddTrustExternalCARoot -file AddTrustExternalCARoot.crt -keystore process.st.jks\n\nkeytool -import -trustcacerts -alias COMODORSAAddTrustCA -file COMODORSAAddTrustCA.crt -keystore process.st.jks  \n\nkeytool -import -trustcacerts -alias COMODORSADomainValidationSecureServerCA -file COMODORSADomainValidationSecureServerCA.crt -keystore process.st.jks<\/pre>\n<p><a href=\"http:\/\/blog.jgc.org\/2011\/06\/importing-existing-ssl-keycertificate.html\" rel=\"nofollow noopener\" target=\"_blank\">http:\/\/blog.jgc.org\/2011\/06\/importing-existing-ssl-keycertificate.html<\/a><\/p>\n<p><a href=\"https:\/\/support.comodo.com\/index.php?_m=knowledgebase&amp;_a=viewarticle&amp;kbarticleid=1204\" rel=\"nofollow noopener\" target=\"_blank\">https:\/\/support.comodo.com\/index.php?_m=knowledgebase&amp;_a=viewarticle&amp;kbarticleid=1204<\/a><\/p>\n<\/p><\/div>\n<\/section>\n<section id=\"sources\">\n<h2> Sources: <\/h2>\n<div class=\"text-content\">\n<ul>\n<li><a href=\"https:\/\/support.comodo.com\" rel=\"nofollow noopener\" target=\"_blank\">Comodo<\/a> - <a href=\"https:\/\/support.comodo.com\/index.php?\/comodo\/Knowledgebase\/Article\/View\/1\/19\/csr-generation-using-openssl-apache-wmod_ssl-nginx-os-x\" rel=\"nofollow noopener\" target=\"_blank\">CSR Generation: Using OpenSSL (Apache w\/mod_ssl, NGINX, OS X)<\/a><\/li>\n<li><a href=\"http:\/\/docs.aws.amazon.com\/\" rel=\"nofollow noopener\" target=\"_blank\">Amazon<\/a> - <a href=\"http:\/\/docs.aws.amazon.com\/elasticloadbalancing\/latest\/classic\/elb-update-ssl-cert.html\" rel=\"nofollow noopener\" target=\"_blank\">Replace the SSL Certificate for Your Classic Load Balancer<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\" rel=\"nofollow noopener\" target=\"_blank\">Process Street<\/a> - <a href=\"https:\/\/www.process.st\/agile-processes\/\" rel=\"nofollow noopener\" target=\"_blank\">The 11 Agile Processes We Use to Run an Efficient Software Team<\/a><\/li>\n<\/ul>\n<\/p><\/div>\n<\/section>\n<section id=\"related-checklists\">\n<h2> Related checklists: <\/h2>\n<div class=\"text-content\">\n<ul>\n<li><a href=\"https:\/\/www.process.st\/templates\/daily-standup-meeting-checklist\/\" rel=\"nofollow\">Daily Standup Meeting Checklist<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/sprint-turnover-process\" rel=\"nofollow\">Sprint Turnover Process<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/sprint-retrospective-process\/\" rel=\"nofollow\">Sprint Retrospective Process<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/sprint-estimation-process\/\" rel=\"nofollow\">Sprint Estimation Process<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/sprint-planning\/\" rel=\"nofollow\">Sprint Planning Process<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/scrum-project-management\/\" rel=\"nofollow\">Scrum Project Management<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/git-workflow\/\" rel=\"nofollow\">Git Workflow<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/user-story-template\/\" rel=\"nofollow\">User Story Template<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/software-deployment\/\" rel=\"nofollow\">Software Deployment<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/software-testing-tutorial\/\" rel=\"nofollow\">Software Testing Tutorial<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/software-debugging-process\/\" rel=\"nofollow\">Software Debugging Process<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/github-pull-request-procedure\/\" rel=\"nofollow\">GitHub Pull Request Procedure<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/pull-request-review-failed-procedure\/\" rel=\"nofollow\">Pull Request Review Failed Procedure<\/a><\/li>\n<\/ul><\/div>\n<\/section>\n","protected":false},"excerpt":{"rendered":"<p>Introduction: The SSL certificate renewal process is arcane, nuanced, and easy to forget or mess up. To make sure you don't make a mistake with it (and end up putting your site's security at risk), follow the steps in this checklist. This checklist is the exact process that Cameron, the Process Street CTO, uses to [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"ep_exclude_from_search":false,"cover_icon_emoji":"","cover_icon_url":"","tasks_count":"9","template_description":"Schedule this checklist tutorial so it notifies you when it's time to renew your SSL certificate.","template_id":"pdo8bPLgTNcyz91ldv5E1Q","task_0":"Introduction:","task_slug_0":"introduction","task_1":"Generate CSR","task_slug_1":"generate-csr","task_2":"Send CSR to Namecheap, obtain SSL certificate .zip","task_slug_2":"send-csr-to-namecheap-obtain-ssl-certificate-zip","task_3":"Update AWS certificate","task_slug_3":"update-aws-certificate","task_4":"Deprecated: Update Linode certificate","task_slug_4":"deprecated-update-linode-certificate","task_5":"Deprecated: Update nginx certificate for Front Street app","task_slug_5":"deprecated-update-nginx-certificate-for-front-street-app","task_6":"Deprecated:\u00a0Update Java Keystore for Process Street app","task_slug_6":"deprecatedupdate-java-keystore-for-process-street-app","task_7":"Sources:","task_slug_7":"sources","task_8":"Related checklists:","task_slug_8":"related-checklists","task_9":"","task_slug_9":"","task_10":"","task_slug_10":"","task_11":"","task_slug_11":"","task_12":"","task_slug_12":"","task_13":"","task_slug_13":"","task_14":"","task_slug_14":"","task_15":"","task_slug_15":"","task_16":"","task_slug_16":"","task_17":"","task_slug_17":"","task_18":"","task_slug_18":"","task_19":"","task_slug_19":"","task_20":"","task_slug_20":"","task_21":"","task_slug_21":"","task_22":"","task_slug_22":"","task_23":"","task_slug_23":"","task_24":"","task_slug_24":"","task_25":"","task_slug_25":"","task_26":"","task_slug_26":"","task_27":"","task_slug_27":"","task_28":"","task_slug_28":"","task_29":"","task_slug_29":"","task_30":"","task_slug_30":"","task_31":"","task_slug_31":"","task_32":"","task_slug_32":"","task_33":"","task_slug_33":"","task_34":"","task_slug_34":"","task_35":"","task_slug_35":"","task_36":"","task_slug_36":"","task_37":"","task_slug_37":"","task_38":"","task_slug_38":"","task_39":"","task_slug_39":"","task_40":"","task_slug_40":"","task_41":"","task_slug_41":"","task_42":"","task_slug_42":"","task_43":"","task_slug_43":"","task_44":"","task_slug_44":"","task_45":"","task_slug_45":"","task_46":"","task_slug_46":"","task_47":"","task_slug_47":"","task_48":"","task_slug_48":"","task_49":"","task_slug_49":"","task_50":"","task_slug_50":"","task_51":"","task_slug_51":"","task_52":"","task_slug_52":"","task_53":"","task_slug_53":"","task_54":"","task_slug_54":"","task_55":"","task_slug_55":"","task_56":"","task_slug_56":"","task_57":"","task_slug_57":"","task_58":"","task_slug_58":"","task_59":"","task_slug_59":"","task_60":"","task_slug_60":"","task_61":"","task_slug_61":"","task_62":"","task_slug_62":"","task_63":"","task_slug_63":"","task_64":"","task_slug_64":"","task_65":"","task_slug_65":"","task_66":"","task_slug_66":"","task_67":"","task_slug_67":"","task_68":"","task_slug_68":"","task_69":"","task_slug_69":"","task_70":"","task_slug_70":"","task_71":"","task_slug_71":"","task_72":"","task_slug_72":"","task_73":"","task_slug_73":"","task_74":"","task_slug_74":"","task_75":"","task_slug_75":"","task_76":"","task_slug_76":"","task_77":"","task_slug_77":"","task_78":"","task_slug_78":"","task_79":"","task_slug_79":"","task_80":"","task_slug_80":"","task_81":"","task_slug_81":"","task_82":"","task_slug_82":"","task_83":"","task_slug_83":"","task_84":"","task_slug_84":"","task_85":"","task_slug_85":"","task_86":"","task_slug_86":"","task_87":"","task_slug_87":"","task_88":"","task_slug_88":"","task_89":"","task_slug_89":"","task_90":"","task_slug_90":"","task_91":"","task_slug_91":"","task_92":"","task_slug_92":"","task_93":"","task_slug_93":"","task_94":"","task_slug_94":"","task_95":"","task_slug_95":"","task_96":"","task_slug_96":"","task_97":"","task_slug_97":"","task_98":"","task_slug_98":"","task_99":"","task_slug_99":"","footnotes":""},"categories":[7,1],"tags":[],"class_list":["post-11692","post","type-post","status-publish","format-standard","hentry","category-miscellaneous","category-uncategorized"],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/posts\/11692","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/comments?post=11692"}],"version-history":[{"count":0,"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/posts\/11692\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/media?parent=11692"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/categories?post=11692"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/tags?post=11692"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}