Certificate Lifecycle Management: Complete Guide

# Generate 2048-bit RSA private key
openssl genrsa -out private.key 2048

# For stronger security, use 4096 bits
openssl genrsa -out private.key 4096

# Generate with passphrase protection
openssl genrsa -aes256 -out private.key 2048

# Generate ECDSA P-256 key (recommended for most uses)
openssl ecparam -genkey -name prime256v1 -out private.key

# P-384 for higher security requirements
openssl ecparam -genkey -name secp384r1 -out private.key

# Generate key and CSR in one command
openssl req -new -newkey rsa:2048 -nodes \
  -keyout private.key -out request.csr \
  -subj "/CN=www.example.com/O=Example Inc/C=US"

# Generate CSR from existing key
openssl req -new -key private.key -out request.csr

# Generate CSR with SANs (Subject Alternative Names)
openssl req -new -key private.key -out request.csr \
  -config <(cat <<EOF
[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req
[req_distinguished_name]
CN = www.example.com
[v3_req]
subjectAltName = @alt_names
[alt_names]
DNS.1 = www.example.com
DNS.2 = example.com
DNS.3 = api.example.com
EOF
)

# View CSR contents
openssl req -in request.csr -noout -text

# Verify CSR signature
openssl req -in request.csr -noout -verify

# Concatenate leaf + intermediate(s)
cat server.crt intermediate.crt > fullchain.pem

# Verify the chain
openssl verify -CAfile root.crt -untrusted intermediate.crt server.crt

server {
    listen 443 ssl http2;
    server_name example.com;
    
    ssl_certificate /etc/nginx/ssl/fullchain.pem;
    ssl_certificate_key /etc/nginx/ssl/private.key;
    
    # Modern TLS configuration
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;
    
    # OCSP Stapling
    ssl_stapling on;
    ssl_stapling_verify on;
}

<VirtualHost *:443>
    ServerName example.com
    
    SSLEngine on
    SSLCertificateFile /etc/apache2/ssl/server.crt
    SSLCertificateKeyFile /etc/apache2/ssl/private.key
    SSLCertificateChainFile /etc/apache2/ssl/intermediate.crt
    
    SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
</VirtualHost>

# Test with OpenSSL
openssl s_client -connect example.com:443 -servername example.com

# Check certificate details
echo | openssl s_client -connect example.com:443 2>/dev/null | \
  openssl x509 -noout -dates -subject

# Test with curl (verbose)
curl -v https://example.com 2>&1 | grep -A 6 "Server certificate"

# Check days until expiration
echo | openssl s_client -connect example.com:443 2>/dev/null | \
  openssl x509 -noout -enddate

# Calculate days remaining
EXPIRY=$(echo | openssl s_client -connect example.com:443 2>/dev/null | \
  openssl x509 -noout -enddate | cut -d= -f2)
EXPIRY_EPOCH=$(date -d "$EXPIRY" +%s)
NOW_EPOCH=$(date +%s)
DAYS_LEFT=$(( ($EXPIRY_EPOCH - $NOW_EPOCH) / 86400 ))
echo "Days until expiration: $DAYS_LEFT"

# Check if certificate will expire within 30 days
openssl s_client -connect example.com:443 2>/dev/null | \
  openssl x509 -noout -checkend 2592000 && \
  echo "OK" || echo "EXPIRING SOON!"

# Initial certificate request
sudo certbot --nginx -d example.com -d www.example.com

# Test automatic renewal
sudo certbot renew --dry-run

# Set up cron for automatic renewal
# (Certbot usually adds this automatically)
0 0,12 * * * root certbot renew --quiet

# Install cert-manager
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.13.0/cert-manager.yaml

# Create ClusterIssuer for Let's Encrypt
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: admin@example.com
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
    - http01:
        ingress:
          class: nginx