RPi-Monitor: Build a multi-sites SSL certificate to improve user experience

This post comes in addition to my previous post: RPi-Monitor: Security and authentication with a reverse proxy.
You may notice that your browser do not trust the certificate we generate consider it as insecure. In this post we will see how to create our own certificate and certificate authority. We will also see own to configure our browser to trust our certificate authority and consider the associated certificates as secure.


Thanks to this actions, we will then move from https :-( to https :-) and remove the security warning.


Note: Certificate generation has been extracted from a very interesting doc found in http://zepala.free.fr/?q=book/export/html/49.

Create a multi-sites certificate
To create the certificates we will need to execute numerous commands. These commands have been gathered into scripts that can be download from RPi-Monitor repository on Github

Downloads make_ca.sh, make_cert.sh, openssl.cnf from Github directly on you RPi:

    wget http://goo.gl/amRwq -O make_ca.sh
    chmod +x make_ca.sh
    wget http://goo.gl/ERmln -O make_cert.sh
    chmod +x make_cert.sh
    wget http://goo.gl/PCSkE -O openssl.cnf

Customize openssl.cnf and update the fields related to identity and network.

Execute make_ca.sh and answer to the questions to create the CA ROOT

Execute the following command and choose server then answer to the questions to create the certificate.

    make_cert.sh RPi-Experiences

Install the certificate on server
Copy certificates for nginx and shellinabox:

    sudo cp sslcert/private/RPi-Experiences-key.pem \
    sslcert/public/RPi-Experiences-cert.pem \
    /etc/ssl/localcerts/
    sudo sh -c "cat sslcert/private/RPi-Experiences-key.pem \
    sslcert/public/RPi-Experiences-cert.pem > \
    /var/lib/shellinabox/certificate.pem"

Copy the cacert.pem and certificate.p12 into RPi-Monitor web root:

    sudo cp sslcert/public/cacert.pem \
    /usr/share/rpimonitor/web/
    sudo cp sslcert/public/RPi-Experiences-bundle.p12 \
    /usr/share/rpimonitor/web/certificate.p12

Restart nginx and shellinabox

    sudo service nginx restart
    sudo service shellinabox restart