SSL question

nis02:/etc/ssl/certs # openssl x509 -noout -in YaST-CA.pem -dates
notBefore=Jun 19 03:42:53 2015 GMT
notAfter=Jun 16 03:42:53 2025 GMT

I want to expire this cert today. What is the right command?

so i can delete this cert after.
linuxpersonAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Dave HoweSoftware and Hardware EngineerCommented:
you can't. the cert was issued with those dates, if you issue a new cert with the new dates, it will have no effect on the prior cert.

if you wish to *revoke* a cert, that's a different function; however, a CA cert can't be revoked (as it isn't signed by anything higher to revoke it with)
linuxpersonAuthor Commented:
I changed the hostname on the server and IP address.

what i need to do with the CA cert since these information are different from the time the CA cert was created.
Dave HoweSoftware and Hardware EngineerCommented:
ok. so what you need to issue is a new end node cert, not a new CA cert. the way it works is that the CA is a self-signed cert that never changes, and the server cert (if I recall, literally called servercert.pem) can be updated to reflect the new name and IP.  take a look at the yast screens at https://www.suse.com/documentation/sles11/book_security/data/sec_security_yast_ca_module.html and in particular, the section 17.2.4 (creating or revoking user certificates) - this can be used to issue a new user (server) certificate for your webserver, ldap etc.
Big Business Goals? Which KPIs Will Help You

The most successful MSPs rely on metrics – known as key performance indicators (KPIs) – for making informed decisions that help their businesses thrive, rather than just survive. This eBook provides an overview of the most important KPIs used by top MSPs.

Get the Guide
linuxpersonAuthor Commented:
I installed SUSE 11 SP3 and converted to template.  from the template i created a new VM called ldap01.example.com, template had CA and Server cert.  now for new VM ldap01.example.com, can i use existing CA cert and create new server cert?  

I was under impression I have recreate both CA and Server cert for this VM.
Dave HoweSoftware and Hardware EngineerCommented:
no. you keep the CA cert (which won't run out for a decade or so :D) and issue new server certs. In fact, you can use ONE CA to issue all the server certs on your network, that way you only need to import the CA into browsers and stuff once, instead of importing multiple CAs.
linuxpersonAuthor Commented:
If I am right, i keep the same CA but create a new server cert.

when i export i should be exporting the server cert right.
Dave HoweSoftware and Hardware EngineerCommented:
yes. you don't need to export the CA cert, as that doesn't change.

private key must match the server cert of course - so if a new key is generated, you should export that too.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
SSL / HTTPS

From novice to tech pro — start learning today.