Linux
Linux servers can obtain certificates in two ways.
- CSR enrollment: A CSR is created on the server with OpenSSL and submitted through Enroll CSR in the portal. Best for: Occasional certificates, servers that change rarely.
- ACME: An ACME client such as certbot requests and renews the certificate automatically. See ACME. Best for: Web servers, containers, short-lived certificates.
Create a CSR with OpenSSL
openssl req -new -newkey rsa:3072 -nodes \
-keyout server.key -out server.csr \
-subj "/CN=app.example.com/O=Example Corporation" \
-addext "subjectAltName=DNS:app.example.com"
Submit server.csr through Enroll CSR, download the certificate and install it with its chain.
Trust the EC CA chain on Linux
- Debian, Ubuntu: Copy the CA files to
/usr/local/share/ca-certificates/with a.crtextension, then runsudo update-ca-certificates. - RHEL, CentOS, Rocky, Fedora: Copy the CA files to
/etc/pki/ca-trust/source/anchors/, then runsudo update-ca-trust.