@@ -46,18 +46,20 @@ depending on your platform:
4646
4747After you are done with the installation, use the ` openssl ` command line tool to
4848proceed with generating your private RSA key:
49- ~~~
50- $ openssl genrsa -des3 -out server.key.org 2048
51- # Enter and confirm a passphrase
52- ~~~
49+
50+ ~~~
51+ $ openssl genrsa -des3 -out server.key.org 2048
52+ # Enter and confirm a passphrase
53+ ~~~
5354
5455#### Removing the passphrase
5556
5657The generated key is protected by a passphrase which needs to be removed so
5758that it can be loaded by the web server.
58- ~~~
59- $ openssl rsa -in server.key.org -out server.key
60- ~~~
59+
60+ ~~~
61+ $ openssl rsa -in server.key.org -out server.key
62+ ~~~
6163
6264Your private key used for the process is now saved in the file ` server.key `
6365
@@ -67,20 +69,21 @@ For acquiring an SSL Certificate, you need to provide your CA with a CSR
6769(Certificate Signing Request). This can also be used for creating self-signed
6870certificates. The CSR contains all the information regarding your company or
6971organization, thus prompting you to enter those:
70- ~~~
71- $ openssl req -new -key server.key -out server.csr
72- Country Name (2 letter code) [AU]:DE
73- State or Province Name (full name) [Some-State]:
74- Locality Name (eg, city) []:
75- Organization Name (eg, company) [Internet Widgits Pty Ltd]:
76- Organizational Unit Name (eg, section) []:Information Technology
77- Common Name (eg, your name or your server's hostname) []:www.example.com
78- Email Address []:
79- Please enter the following 'extra' attributes
80- to be sent with your certificate request
81- A challenge password []:
82- An optional company name []:
83- ~~~
72+
73+ ~~~
74+ $ openssl req -new -key server.key -out server.csr
75+ Country Name (2 letter code) [AU]:DE
76+ State or Province Name (full name) [Some-State]:
77+ Locality Name (eg, city) []:
78+ Organization Name (eg, company) [Internet Widgits Pty Ltd]:
79+ Organizational Unit Name (eg, section) []:Information Technology
80+ Common Name (eg, your name or your server's hostname) []:www.example.com
81+ Email Address []:
82+ Please enter the following 'extra' attributes
83+ to be sent with your certificate request
84+ A challenge password []:
85+ An optional company name []:
86+ ~~~
8487
8588The file created after this process is named ` server.csr ` .
8689
@@ -130,14 +133,15 @@ similar to this:
130133![ Firefox warning] ( https://s3-eu-west-1.amazonaws.com/cctrl-www-production/custom_assets/attachments/000/000/038/original/ffssl.png )
131134
132135You should also have a file which is a bundle of certificates which succeed each other:
133- ~~~
134- -----BEGIN CERTIFICATE-----
135- ...
136- -----END CERTIFICATE-----
137- -----BEGIN CERTIFICATE-----
138- ...
139- -----END CERTIFICATE-----
140- ~~~
136+
137+ ~~~
138+ -----BEGIN CERTIFICATE-----
139+ ...
140+ -----END CERTIFICATE-----
141+ -----BEGIN CERTIFICATE-----
142+ ...
143+ -----END CERTIFICATE-----
144+ ~~~
141145
142146Note: If you do not have a certificate bundle but a series of ` .crt ` files, you
143147have to place them in the right order starting from the intermediate
@@ -148,20 +152,22 @@ in PEM format.
148152
149153To add the SSL Add-on, simply provide the paths to the files provided by the
150154certificate authority using the respective parameters of the addon.add command.
151- ~~~
152- $ cctrlapp APP_NAME/DEP_NAME addon.add ssl.host --cert path/to/CERT_FILE --key path/to/KEY_FILE --chain path/to/CHAIN_FILE
153- ~~~
155+
156+ ~~~
157+ $ cctrlapp APP_NAME/DEP_NAME addon.add ssl.host --cert path/to/CERT_FILE --key path/to/KEY_FILE --chain path/to/CHAIN_FILE
158+ ~~~
154159
155160In order to check the status of the Add-on, you can do the following.
156- ~~~
157- $ cctrlapp APP_NAME/DEP_NAME addon ssl.host
158- Addon : ssl.host
159161
160- Settings
161- SSL_CERT_EXPIRES : 2016-01-01 10:00:00
162- SSL_DNS_DOMAIN : addonssl-depxxxxxxxx-1234567890.eu-west-1.elb.amazonaws.com
163- SSL_CERT_INCEPTS : 2013-01-01 10:00:00
164- ~~~
162+ ~~~
163+ $ cctrlapp APP_NAME/DEP_NAME addon ssl.host
164+ Addon : ssl.host
165+
166+ Settings
167+ SSL_CERT_EXPIRES : 2016-01-01 10:00:00
168+ SSL_DNS_DOMAIN : addonssl-depxxxxxxxx-1234567890.eu-west-1.elb.amazonaws.com
169+ SSL_CERT_INCEPTS : 2013-01-01 10:00:00
170+ ~~~
165171
166172### Updating your Certificate
167173
@@ -170,10 +176,11 @@ and re-adding it, providing the updated certificate. The SSL service is provided
170176for 23 minutes after removing the Add-on so that it can be updated in the
171177meantime without interrupting the service. To achieve that you have to run the
172178following commands:
173- ~~~
174- $ cctrlapp APP_NAME/DEP_NAME addon.remove ssl.host
175- $ cctrlapp APP_NAME/DEP_NAME addon.add ssl.host --cert path/to/NEW_CERT_FILE --key path/to/KEY_FILE --chain path/to/CHAIN_FILE
176- ~~~
179+
180+ ~~~
181+ $ cctrlapp APP_NAME/DEP_NAME addon.remove ssl.host
182+ $ cctrlapp APP_NAME/DEP_NAME addon.add ssl.host --cert path/to/NEW_CERT_FILE --key path/to/KEY_FILE --chain path/to/CHAIN_FILE
183+ ~~~
177184
178185Note: You need to provide the original key and chain again when updating the
179186Add-on even if those are not changed.
@@ -200,6 +207,7 @@ For PHP you can either redirect via Apache's mod_rewrite using a `.htaccess`
200207file or directly in your PHP code.
201208
202209#### .htaccess
210+
203211~~~
204212<IfModule mod_rewrite.c>
205213 RewriteEngine On
@@ -209,6 +217,7 @@ file or directly in your PHP code.
209217~~~
210218
211219#### PHP
220+
212221~~~ php
213222<?php
214223 if (!isset($_SERVER['HTTP_X_FORWARDED_PROTO']) &&
@@ -229,13 +238,15 @@ As of version 3.10, [`force_ssl`](http://api.rubyonrails.org/classes/ActionContr
229238provides this functionality. This can be added to a particular controller or to the whole application via configuration.
230239
231240#### At the Controller Level
241+
232242~~~ ruby
233243MyController < ApplicationController
234244 force_ssl
235245end
236246~~~
237247
238248#### At the Application Level
249+
239250~~~ ruby
240251# config/application.rb
241252module MyApp
0 commit comments