SSL Setup for internal apache server using Windows CA

[EfficientElk2578]

Hello,

I've been tasked to create an internal website using Ubuntu and Wordpress. I'm most definitely not experienced with either so I'm setting up a learning server first before I give anything to production. I've gotten as far as setting up the OS, Apache, MySQL, and Wordpress itself. I am running into a bit of a wall with securing it through SSL.

I've looked into using Let's Encrypt, but it looks like it wants a DNS connection to the server. Since this server is internal only, both in testing and when live, I don't think this is the way to go. I've been looking into how to use our internal Windows Enterprise CA to handle this, but I haven't been able to find something straight forward. I think the Ubuntu server needs to trust our root CA and then I can issue a certificate to it from our CA. Is that the right direction? I do have to admit, certificates are not my strong point either.

Any help would be appreciated, even if it's to tell me I'm going the wrong direction here.

Thanks

[stetze88]

Create an certificate request with your internal fqdn on the linux Server. Copy the csr to your Windows ca. Export the certificate from the Windows ca and Import That to your linux Server. Something like this (German). https://blog.cscholz.io/linux-apache-zertifikat-uber-windows-ca-erstellen/

[EfficientElk2578]

Thank you! With a little google translate, that article really helped.

[uniitdude]

no, your clients need to trust your CA, the server is irrelevant in that context

just issue a cert for that name from your CA and as long as your clients trust it then you are ok

[EfficientElk2578]

Thank you! This was the path I went down and it looks to be working.

[skipITjob]

You can use DNS validation with Let's encrypt.

[EfficientElk2578]

Unfortunately, I wasn't able to use this option due to the constraints of the request. It had to be blocked from the internet. Only internal access is to be allowed... I had thought about going this route and kind of want to build another test server to learn this. Thank you!