StartCom issues free Class 1 SSL certificates under the name StartSSL. StartCom is a relatively new player in the field, but they are already accepted by most client software.
Get a web server certificate
- Sign up at https://www.startssl.com/ (use accurate address data, otherwise your registration will be rejected). If your mail server is using grey-listing you might need to start the registration process twice.
- Wait for StartSSL staff to approve your registration (never took longer than 1h for me, but plan more time just in case).
- Create backup of client certificate for StartSSL admin panel authentication. Really do it, because if you lose it you won't be able to enter your account any more. There is no "recover account" option, so you will need to create a new account. Don't forget to note down the password that you use for exporting the client certificate, you will need it when importing it again.
- Validate your domain using the Validations Wizard. Make sure your mail server is properly configured. If your mail server is using grey-listing you might need to start the validation process twice.
- Go to Certificates Wizard and select "Web Server SSL/TLS Certificate".
- Generate private key and make sure to save the private key before continuing the wizard. You won't be able to retrieve it again later. Also make sure to remember the password for decrypting the private key of course.
- Wait for StartSSL staff to approve your certificate (again, this never took longer than 1h for me, but plan more time just in case).
- Go to Decrypt private key in the Toolbox, decrypt using the key's password and save the decrypted private key as <yourdomain>.key (keep this key private).
- Go to Retrieve Certificate in the Toolbox and save the certificate as <yourdomain>.crt (keep private).
Install a web server certificate
- Download StartSSL's Class 1 Intermediate Server CA (sub.class1.server.ca.pem) and place it in the SSL configuration folder of your server.
- Place <yourdomain>.key and <yourdomain>.crt in the SSL configuration folder of your server.
- Edit your Apache config and point SSLCertificateKeyFile (key), SSLCertificateFile (crt) and SSLCertificateChainFile (ca.pem) to these files.
- Restart Apache.
- Go to https://<yourdomain> and see if the correct SSL certificate is used.
Things you should have collected by now:
- Backup of StartSSL client certificate (.p12 file)
- Password for .p12 file
- Encrypted server private key
- Password for encrypted private key
- Decrypted private key (.key file)
- Certificate issued by StartSSL (.crt file)
- Intermediate server CA file (sub.class1.server.ca.pem) - available for download on the internet, so don't worry if you lose this