Using an SSL Certificate from an External Certificate Authority
If you do not have a valid certificate, you can acquire one from a certificate authority and add it to the System keychain:
Generate a Certificate Signing Request (CSR)
A CSR is a file that provides information needed to issue an SSL certificate.
1Log in to the server as root locally through Terminal or remotely via ssh.
2Enter the following commands:
$ cd /private/var/root/Library/Keychains/ $ /usr/bin/certtool r csr.txt k=certkc c
This use of the certtool tool begins an interactive process that generates a CSR in the file csr.txt and creates a keychain named certkc.
3In the New Keychain Passphrase dialog that appears, enter a password for the keychain you’re creating, enter the password a second time to verify it, and click OK.
Remember this password, because later you must supply it again.
4When “Enter key and certificate label” appears in the Terminal window, enter a one- word key, a blank space, and a
For example, you could enter your organization’s name as the key and mailservice as the certificate label.
The following output appears.
Please specify parameters for the key pair you will generate.
rRSA d DSA f FEE
Select key algorithm by letter:
5Enter r, and then press Return.
The following output appears.
Valid key sizes for RSA are 512..2048; default is 512
Enter key size in bits or CR for default:
6Enter a key size, and then press Return.
Larger key sizes are more secure, but they require more processing time on your server. Key sizes smaller than 1024 aren’t accepted by some
The following output appears.
You have selected algorithm RSA, key size (size entered above) bits. OK (y/anything)?
7Enter y, and then press Return.
The following output appears.
Enter cert/key usage (s=signing, b=signing AND encrypting):
Chapter 3 Mail Service Advanced Configuration
69
