First, make sure OpenSSL is installed on the server. Check for that in whm, under Software, Install An RPM.
Now, ssh into your server, and navigate to /usr/local/apache/conf/ssl.key (cd /usr/local/apache/conf/ssl.key )
Next, you will generate a private key. You can do it in either of two ways: encrypted or unencrypted. I create mine without a password, and have experienced no issues.
ENCRYPTED: Type the following command to generate a private key that is file encrypted: openssl genrsa -des3 -out domainname.key 1024
UNENCRYPTED: openssl genrsa -out domainname.key 1024
Note: remember to replace "domainname" with the domain of the site that will be specific to the ssl certificate.
Next, Type the following command to create a CSR with the RSA private key: openssl req -new -key domainname.key -out domainname.csr
When creating this csr you will be prompted for questions:
* Common Name. Enter the exact domain name of the site you will be securing. SSL will only certify exact domains, and not subdomains. If the domain you're certifying has the www prefix, you need enter this. IF you are certifying www.domain.com, ssl will then only certify that domain, and not domain.com.
*Organization. Enter the company name of your client.
*Organization Unit. This is the company section (eg: marketing). If you do not know this, perhaps type in something like "internet".
*City. Where your client is based.
*State or Province. Obvious
*Country. Here they are looking for the two letter abreviation of the country, eg, US if it's an American address.
Note: during this process, the following characters are not accepted: < > ~ ! @ # $ % ^ * / \ ( ) ?.,& . I noticed that they list a period, but a period is required when entering a domain name, and I have experienced no problems when using a period.
Then copy the csr file to /usr/local/apache/conf/ssl.csr (cp /usr/local/apache/conf/ssl.csr)
TO see the contents of the CSR, type "cat name.csr" (for example, cat microsoft.csr). As usual, replace "name" with the domain you are setting up the certificate for.
To verify the contents of the csr, type: openssl req -noout -text -in domainname.csr
Submit the content of the csr to whatever company that is creating the ssl certificate. If your client is purchasing the certificate, then send him/her the csr. Remember, you can display the csr by typing: cat name.csr
After the client purchases the certificate from Geotrust, have them email you a copy of the key. You will need this for the next step.
In WHM, go to SSL/TLS, and click on “install an ssl certificate and setup the domain”.
Paste the contents of the key file into the middle window.
Type in domain name in the relevant text box.
Paste in the certificate key that your client sent you, into the first window
Restart Apache.
If Apache does not restart, check the virtual host settings for the relevant domain in httpd.conf (pico -w /usr/local/apache/conf/httpd.conf). Rem out references to ssl in that virtual host only. I had a problem once whereby apache would not restart, even after the server was rebooted, and remming out the ssl reference resolved the problem. You rem out a line by placing a # at the very beginning of the line.
Another thing to check is the presence of your csr and key files ( /usr/local/apache/conf/ssl.csr and /usr/local/apache/conf/ssl.key respectively) The commands you need are cd to change directory, and once in the directory, dir to display the contents of the directory. To read the files, pico filename.
And that's it!