wiki/pages/en/server/services/ssl.txt

====== SSL ======

Be your own SSL Certificate Authority.

This tutorial is based on the domain ''nextcloud.home''. So change the domain to your specific domain.

It is also important that the domain address gets redirected from your router or use [[/en/server/services/adguardhome#dns_rewrites|AdGuardHome]]. This can also be set in the ''/etc/hosts'' file of your computer, but to reach the domain on every device, it is easier to change this directly in the router or [[/en/server/services/adguardhome#dns_rewrites|AdGuardHome]]:

<code>
nextcloud.domain SERVER-IP
</code>


===== mkcert =====

[[https://github.com/FiloSottile/mkcert|mkcert]] is a simple tool for making locally-trusted development certificates. It requires no configuration.


==== Packages ====

<code>
pacman -S nss mkcert
</code>


==== Create root certificate ====

<code>
mkcert -install
</code>


==== Create certificates for your domains ====

<code>
mkcert nextcloud.home
</code>


===== Manually =====


==== Generating the private key and root certificate ====

<code>
openssl genrsa -des3 -out rootCA.key 2048
</code>

<code>
openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 1825 -out rootCA.pem
</code>

Change the following information as you wish. It appears when you view the certificate through your browser.
<code>
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:
Email Address []:
</code>


==== Creating CA-Signed certificates for your domains ====

<code>
openssl genrsa -out nextcloud.home-key.pem 2048
</code>

<code>
openssl req -new -key nextcloud.home-key.pem -out nextcloud.home.pem
</code>

<code>
nano nextcloud.home.ext
</code>

<code>
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names

[alt_names]
DNS.1 = nextcloud.home
</code>


=== Script ===

Create the file in ''nano /etc/nginx/ssl/ssl.sh''.

<code>
#!/bin/sh

if [ "$#" -ne 1 ]
then
  echo "Usage: Must supply a domain"
  exit 1
fi

DOMAIN=$1

openssl genrsa -out $DOMAIN-key.pem 2048
openssl req -new -key $DOMAIN-key.pem -out $DOMAIN.pem

cat > $DOMAIN.ext << EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names
[alt_names]
DNS.1 = $DOMAIN
EOF

openssl x509 -req -in $DOMAIN.pem -CA rootCA.pem -CAkey rootCA.key -CAcreateserial \
-out $DOMAIN.crt -days 825 -sha256 -extfile $DOMAIN.ext
</code>

<code>
chmod +x ssl.sh
./ssl.sh nextcloud.home
</code>


===== Installing your root certificate on all the devices =====

You'll need to create a ''rootCA.pem'' file on every device and copy the content of ''cat rootCA.pem'' file wherever you created it in section [[#generating_the_private_key_and_root_certificate]] (manually). 

If you used [[#mkcert]] just run this command ''cat $(mkcert -CAROOT)/rootCA.pem''.


==== Arch Linux ====

<code>
sudo trust anchor --store rootCA.pem
</code>


==== Android ====

=== User trusted credentials ===

''Settings'' - ''Security'' - ''Encryption and credentials'' - ''Install a certificate''

Check under:

''Settings'' - ''Security'' - ''Trusted credentials'' - ''User''


=== System trusted credentials ===

If "User trusted credentials" is not enough and you need the certificate in the system, follow the next lines. However, this requires a rooted device: 

<code>
hashed_name=`openssl x509 -inform PEM -subject_hash_old -in rootCA.pem | head -1` && cp rootCA.pem $hashed_name.0
ls $hashed_name.0
</code>

<code>
adb root
adb shell mount -o rw,remount /
adb push $hashed_name.0 /system/etc/security/cacerts/
adb shell chmod 644 /system/etc/security/cacerts/$hashed_name.0
adb shell chown root:root /system/etc/security/cacerts/$hashed_name.0
adb shell reboot
</code>

You can also use the Magisk module [[https://github.com/NVISOsecurity/MagiskTrustUserCerts/releases|MagiskTrustUserCerts]] (Android 13) or [[https://github.com/nccgroup/ConscryptTrustUserCerts|ConscryptTrustUserCerts]] (Android 14) which does the same as above.



===== Nginx =====

Check also [[/en/server/services/nginx]]


==== ssl-params.conf ====

<code>
nano /etc/nginx/conf.d/ssl-params.conf
</code>

<code>
ssl_protocols TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
ssl_ecdh_curve secp384r1;
ssl_session_cache shared:SSL:10m;
</code>


==== example ====

<code>
server {
        listen 80;
        listen [::]:80;
        server_name nextcloud.home;

        # enforce https
        return 301 https://$server_name:443$request_uri;
}

server {
        listen 443 ssl http2;
        listen [::]:443 ssl http2;
        server_name nextcloud.home;

        ssl_certificate /etc/nginx/ssl/nextcloud.home.pem;
        ssl_certificate_key /etc/nginx/ssl/nextcloud.home-key.pem;
        include conf.d/ssl-params.conf;
    
        access_log /var/log/nginx/nextcloud.home_access_log;
        error_log /var/log/nginx/nextcloud.home-error_log;

        location / {
                your things;
        }
}
</code>