Technically at the moment there isn\u2019t anything really wrong with the SHA-1 hash function, but it is now quite old and is starting to show potential cracks. Hence the reason that the security industry is advising to move to something better. In this case SHA-256.<\/p>\n
1. Generate a SSL Key File<\/strong><\/p>\n Firstly you will need to generate a key \u00a0file. The example below will generate a 2048 bit key file with a SHA-256 signature.<\/p>\n If you want extra security you could increase the bit lengths.<\/p>\n ** Please note that both these examples will not add a password to the key file. To do that you will need to add -des3 to the command.<\/p>\n 2. Create a Certificate Signing Request (CSR)<\/strong><\/p>\n This step will create the actually request file that you will submit to the Certificate Authority (CA) of your choice.<\/p>\n You can check that your Certificate Signing Request (CSR) has the correct signature by running the following.<\/p>\n It should display the following if the signature is correct.<\/p>\n 3.\u00a0Install\u00a0the Certificate (CRT)<\/strong><\/p>\n This step is very dependant of the software you use and I won\u2019t really cover. All I will say is that these certificates are supported by a multitude of software, including Apache HTTPD and NGINX.<\/p>\n 4. Test your installed Certificate<\/strong><\/p>\n This step is extremely important and will show you any security problems with your SSL configuration.<\/p>\n Qualys have a free hosted service that tests the SSL configuration of Internet facing web servers for SSL issues. The sites tested are rated from A to F, and a report is generated. This report is really useful for tuning your SSL configuration.<\/p>\n\n
openssl genrsa -out key_name<\/var>.key 2048 <\/code><\/pre>\n<\/blockquote>\n\n
openssl genrsa -out key_name.key 4096<\/code><\/pre>\n<\/blockquote>\n\n
openssl req -out CSR.csr -key key_name.key -new -sha256<\/code><\/pre>\n<\/blockquote>\n\n
openssl req -in CSR.csr -noout -text<\/code><\/pre>\n<\/blockquote>\n\n
Signature Algorithm: sha256WithRSAEncryption<\/code><\/pre>\n<\/blockquote>\n