Self-Signed SSL Instructions for Server-Side Requests

[sickcodes]

Documentation to assist with arbitrary self-signed SSL certificates and completely valid requests.

As seen in:
#920
#632
#182

[liZe]

Thank you! We’ll merge this PR when the documentation is rewritten (see #1232).

[sickcodes]

Just adding for future reference:

Server Side Requests & Self-Signed SSL Certificates
..........

If your server is requesting data from itself, you may encounter a self-signed
certificate error, even if you have a valid certificate.

You need to add yourself as a Certificate Authority, so that your self-signed
SSL certificates can be requested.

# if you have not yet created a certificate
sudo openssl req -x509 \
    -sha256 \
    -nodes \
    -newkey rsa:4096 \
    -days 365 \
    -keyout localhost.key \
    -out localhost.crt

sudo cp localhost.crt /etc/ssl/certs/localhost.crt
sudo cp localhost.key /etc/ssl/private/localhost.key

follow the prompts about your certificate and the domain name

openssl x509 -text -noout -in localhost.crt

Add your new self-signed SSL certificate to your nginx.conf, below the line:

server_name 123.123.123.123;

ssl_certificate /etc/ssl/certs/localhost.crt;
ssl_certificate_key /etc/ssl/private/localhost.key;

The SSL certificate will be valid when accessing your website from the internet.
However, images will not render when requesting files from the same server.

You will need to add your new self-signed certificates as trusted:

sudo cp /etc/ssl/certs/localhost.crt /usr/local/share/ca-certificates/localhost.crt
sudo cp /etc/ssl/private/localhost.key /usr/local/share/ca-certificates/localhost.key

Update the certificate authority trusted certificates
sudo update-ca-certificates

Export your newly updated Certificate Authority Bundle file.

If using django, it will use the newly signed certificate authority as valid images will load properly:

sudo tee -a /etc/environment <<< 'export REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt'

reboot optional
reboot

[liZe]

For the record, the documentation has been included in this page.

[sickcodes]

For the record, the documentation has been included in this page.

Thanks mate, I forgot the copy lines, one year ago (just came to renew the self signed one)