Self-signed certificates are pretty bad overall, even worse when served over the internet. You can't easily tell if the certificate you are about to exceptionally trust, is yours, or faked by your gov or ISP.
So, how do you solve this?. By creating your own CA certificate and importing it either on your system, or on your Firefox Independent CAcert list.
This will turn a self-signed tls warning into a shining green lock, which will ensure the connection to your server is not tampered. In case it gets tampered, a warning will appear on your browser and you will easily notice someone is modifying your tls handshake.
Why not using a let's encrypt certificate? Well, there is cases where the service you want to expose on the internet is merely private (ex: a nextcloud, music server, documentation) and there is not a public domain name pointing to your server, just a local DNS server or custom /etc/hosts entry.
After some background on why/when using your own CAcert is needed, let's get started !!
First, we need to create our CA signing key (used to create signed certificates by US)
Please use a strong key!!
openssl genrsa -aes256 -out AGUAKTECH.key 4096
Create pem (crt) file for your CAcert (valid for 10 years)
openssl req -x509 -new -nodes -key AGUAKTECH.key -sha256 -days 3650 -out AGUAKTECH.pem
Generate a new private key for our server/domain
openssl genrsa -out yourdomain.com.key 4096
Generete a san.cnf signing request and configure your domain information
[ req ] default_bits = 4096 prompt = no encrypy_key = no default_md = sha256 distinguished_name = dn req_extensions = req_ext [ dn ] # you can choose to use a wildcard or not #CN = *.yourdomain.com CN = yourdomain.com O = Your Domain OU = Your Domain L = Los Angeles ST = California C = EU [ req_ext ] subjectAltName = DNS: *.yourdomain.com, DNS: yourdomain.com
Now create a CSR (signing request) from the san.cnf config file created
openssl req -new -config yourdomain.com.san.cnf -nodes -key yourdomain.com.key -out yourdomain.com.csr
Given the csr generated by the issuer (us), sign the certificate to generate a crt file
# Expiration time # paranoid: 1 year max # normal: 2-3 years # stupid: 10 years openssl x509 -req -in yourdomain.com.csr -CA AGUAKTECH.pem -CAkey AGUAKTECH.key -CAcreateserial -out yourdomain.com.crt -days 365 -sha256
Certificate installation steps on firefox:
Certificate installation steps on a Debian-based Linux system (Optional)
# copy the .pem file to a .crt file in the appropiate path cp AGUAKTECH.pem /usr/local/share/ca-certificates/ # update system certificates automatically update-ca-certificates