How to remove SSL certificate?

Question

I've been asked to remove certificates from some of our servers, but I don't know anything about httpd configuration. If I have one server where if I do this

/usr/sbin/httpd -t -DDUMP_CERTS 2>/dev/null | /bin/sort -u

I get

/etc/httpd/certs/domain1.certificate
/etc/httpd/certs/domain2.certificate
/etc/httpd/certs/domain3.cert
/etc/pki/tls/certs/localhost.crt

and I only want to keep domain3.cert. How can I remove the others?

If /etc/pki/tls/certs/localhost.crt is the only one on a machine, do I have to remove it in a different way? I tried commenting out the line mentioning that localhost.crt in /etc/httpd/conf.d/ssl.conf but then httpd reports failed when I do a service restart.

Answer 1

I know the question is one year old so the answer probably comes much too late but anyway, since somebody already dug this out, it may be worth putting an answer here for future visitors. Sadly we do not have any detailed info about the distro used and what particular package provides httpd functionality (Apache, Nginx, something else?) so it's going to be a bit of a shot in the dark but anyway:

The reason why the restart you mention fails is probably because you're commenting out the certificate in a general config file and leave it in some other file, probably in a vhost config. You could check for that with this: grep -E '(domain[12]\.certificate|localhost\.crt) /etc/httpd/sites-enabled/*', which will search for the strings: domain1.certificate, domain2.certificate and localhost.crt in all files in /etc/httpd/sites-enabled/ directory. If it finds either of these strings it will print out the relevant lines prepended with the filename containing them. You can then proceed to comment out those lines. You may have to change the certificate file path in order to provide another certificate or comment out the whole HTTPS section if you only want plain HTTP.

Try to restart (or test configuration) after you're done. If you get through a restart successfully, then the server has stopped using the certificates.