Server certificate management

 

There are two options for certificate management

1. The easiest, fast and cheap one: Do not create any public or private key, nor enter any certificate chain. At first start up, Soffid Identity Provider will generate a new public/private key pair. Using this key, Soffid IdP will create a self-signed certificate and will store it on the certificate chain field.

2. The secure one:  

2.1. Create a public/private key.

2.2. Generate a PKCS#10 file. Use this file to ask for a certificate to a well known certificate authority.

2.3. After some paper work, the certificate authority will give you a valid certificate.

2.4. The certificate can be in PEM or DER format. If it's in PEM format, it will start with a line saying

------BEGIN CERTIFICATE ----
In such a case, just paste its contents on certificate chain field.
If it's in binary DER format, you can use openssl to convert it from PEM to DER:
openssl x509 -in <DER-FILE> -inform DER -out <PEM-FILE> -outform PEM
Sometimes your CA will give you a base64 encoded DER file. In such a case, convert it to PEM using:
openssl base64 -d <DEF-FILE> | openssl x509 -inform DER -out <PEM-FILE> -outform PEM