lighttpd: Update SSL configs

[matthijs/servers/drsnuggles.git] / etc / lighttpd / ssl / README

diff --git a/etc/lighttpd/ssl/README b/etc/lighttpd/ssl/README
index df253633ee7a67163388a0ed1d133d8e8115a8d4..87746a5a9eaf4a0d6ec74cef5b912d58f9ba175b 100644 (file)
--- a/etc/lighttpd/ssl/README
+++ b/etc/lighttpd/ssl/README
@@ -1,6 +1,9 @@
+# Don't forget to update the key in the mail vserver for dovecot as
+# well!
+#
 # Generate key 2048 bit rsa key with out passphrase:
 
-DOMAIN=mail.stdout.nl.key
+DOMAIN=mail.stdin.nl
 sudo touch $DOMAIN.key
 sudo chmod 400 $DOMAIN.key
 sudo openssl genrsa  -out $DOMAIN.key 2048
@@ -10,12 +13,18 @@ sudo openssl req -new -key $DOMAIN.key -out $DOMAIN.csr
 
 # After receiving the .crt file from the issuer, make sure you cat the .key
 # and .crt file together into a .pem file, which lighttpd's ssl.pemfile points
-# to.
+# to. Don't forget to create the file with 400 first:
+sudo touch $DOMAIN.pem
+sudo chmod 400 $DOMAIN.pem
+sudo sh -c "cat $DOMAIN.key $DOMAIN.crt > $DOMAIN.pem"
+# Also create a full chain cert, which is used by dovecot
+sudo sh -c "cat $DOMAIN.crt ca/startssl/all.pem > $DOMAIN.crt-chain"
 
 # Optionally, you can use a config file to set attributes of the CSR (so you
 # can leave out stuff like "Location" and "State"). However, when using
-# StartSSL, al the details from the CSR will be ignored anyway, so don't
-# bother. Anyway, the file to pass to -config should like this:
+# StartSSL, al the details (including common name) from the CSR will be ignored
+# anyway, so don't bother. Anyway, the file to pass to -config should like
+# this:
 
 [ req ]
 distinguished_name     = req_distinguished_name