OpenSSL is an indispensable open-source tool that implements SSL and TLS protocols. It plays a significant role in establishing secure and encrypted communication between web servers and browsers. However, its utility is not confined to securing websites. OpenSSL is equally paramount for any application that demands secure network communication. This article is a comprehensive guide to installing OpenSSL on Debian 12.

Understanding OpenSSL

OpenSSL’s key features include:

1. SSL/TLS Protocol Implementation: It facilitates the secure transfer of private data.
2. Cryptographic Algorithms: It uses symmetric ciphers like AES, hashes like SHA256, and public key algorithms like RSA.
3. Key and Certificate Management Tools: It provides tools for generating and managing keys, certificates, and more.
4. Broad-based Application: It is extensively used in web servers, email servers, VPNs, and other network software.

Prerequisites for OpenSSL Installation

Before you kick off the installation process, ensure that you have:

• A server running Debian 12 (Bookworm).
• A fresh OS installation to avoid potential issues.
• SSH access to the server (or just open Terminal if you’re on a desktop).
• An active internet connection for downloading the necessary packages and dependencies.
• A user account with sudo privileges.

OpenSSL Installation on Debian 12

Step 1: Update System’s Package List

Before installing any new software, remember to update your system’s package list. Use the following commands in your terminal:

sudo apt update
sudo apt upgrade

Step 2: Install OpenSSL

2.1 From Debian Repositories

The easiest way to install OpenSSL is to use the precompiled packages from the Debian repositories. Execute these commands:

sudo apt update
sudo apt install openssl

To check the installed version, use:

openssl version -a

2.2 From Source

If the OpenSSL version in Debian is outdated, install it from the source. The procedure is as follows:

Firstly, install Build Dependencies using:

sudo apt install build-essential checkinstall zlib1g-dev

Then, download and extract the source tarball:

cd /usr/local/src
sudo wget https://www.openssl.org/source/openssl-3.0.8.tar.gz
sudo tar xzf openssl-3.0.8.tar.gz

Configure OpenSSL with the correct install directories and compile options:

cd openssl-3.0.8
sudo ./config --prefix=/usr/local/ssl --openssldir=/usr/local/ssl shared zlib
sudo make
sudo make test

Finally, install the compiled binaries and libraries:

sudo make install
/usr/local/ssl/bin/openssl version -a

Step 3: Basic OpenSSL Commands

Here are some basic OpenSSL commands:

• Generate a private key:

openssl genrsa -out private.key 2048

• Generate a Certificate Signing Request (CSR):

openssl req -new -key private.key -out csr.pem

• Generate a self-signed certificate:

openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 365

• View certificate details:

openssl x509 -in cert.pem -text -noout

Step 4: Configuring OpenSSL

The primary OpenSSL configuration file is openssl.cnf located in /usr/lib/ssl on Debian systems. This file controls the default settings used by OpenSSL commands. Some configurable aspects include:

• Security level:

ssl_conf = ssl_sect
[ssl_sect]
system_default = system_default_sect
[system_default_sect]
MinProtocol = TLSv1.2

• Cipher suites:

[system_default_sect]
CipherString = DEFAULT:@SECLEVEL=2

• Certificate details:

[req]
default_bits = 2048
default_md = sha256

You can refer to the OpenSSL configuration documentation for more details.

Congratulations! You have successfully installed OpenSSL. For additional help or information, you can check the official OpenSSL website. If you don’t have time to do all of this or if this is not your area of expertise, you can avail of managed VPS services, like the ones offered by Shape.host. They provide Linux SSD VPS, ensuring efficient, scalable, and secure cloud hosting solutions.

Christian Wells