{"id":844,"date":"2016-03-04T17:11:05","date_gmt":"2016-03-04T15:11:05","guid":{"rendered":"http:\/\/www.systemcodegeeks.com\/?p=844"},"modified":"2018-05-31T15:05:39","modified_gmt":"2018-05-31T12:05:39","slug":"apache-ssl-tls-tutorial","status":"publish","type":"post","link":"https:\/\/www.systemcodegeeks.com\/web-servers\/apache\/apache-ssl-tls-tutorial\/","title":{"rendered":"Apache enable SSL \/ TLS tutorial"},"content":{"rendered":"

In this post, we feature a comprehensive Apache enable SSL \/ TLS Tutorial. This article is part of our Academy Course titled Apache HTTP Server Tutorial<\/a>.<\/em><\/p>\n

In this course, we provide a compilation of Apache HTTP Server tutorials that will help you get started with this web server. We cover a wide range of topics, from installing the server and performing a basic configuration, to configuring Virtual Hosts and SSL support. With our straightforward tutorials, you will be able to get your own projects up and running in minimum time. Check it out here<\/a>!<\/p>\n

In the previous articles of this series, we discussed how to install Apache<\/a>, configure virtual hosts<\/a>, rewrite and redirect URLs<\/a>, and add basic authentication to access resources, among other things.<\/span><\/p>\n

Although all those things are necessary in order to have a functional web server, any serious discussion about Apache must take security into account.<\/p>\n

In other words, you need to ensure that sensitive and other private data that is sent from a client to your web server is protected along its way.
\n[ulp id=’euI76dOod8fb2P3K’]<\/p>\n

1. Introducing SSL and TLS<\/h2>\n

Originally designed by Netscape to secure transactions between web servers and browsers, the Secure Sockets Layer<\/strong> (best known as SSL<\/strong>) protocol served well its purpose for a long time. This was the case until critical vulnerabilities (such as Heartbleed and Poodle) were found in some of its most-used implementations. This eventually led to the recommendation of avoiding SSL and using the Transport Layer Security<\/strong>, or TLS<\/strong> for short. <\/span><\/p>\n

Version 1.2 of the TLS protocol is well documented in RFC 5246<\/span><\/a>.<\/span><\/div>\n

When you request a page over HTTPS (<\/span>https:\/\/www.facebook.com\/<\/span><\/a> for example), the server responds with a valid certificate that has been signed by a common trusted party, along with its public key. The client then returns an encrypted key (signed with the server\u2019s public key), which is then decrypted using the server\u2019s private key.<\/span><\/p>\n

From this point on, a secure session is initiated between server and client, and both use the session key to encrypt and decrypt exchanged data. In more technical terms, asymmetric cryptography (public \/ private key pair) is used while the session key is being exchanged, and then symmetric encryption (shared key) is utilized while the client and the server communicate with each other.<\/p>\n

2. Apache and TLS<\/h2>\n

In this guide we will again use example2.com, one of the virtual hosts that we previously set up. To begin, we need to make sure that the mod_ssl package is installed if we are using CentOS:<\/span><\/p>\n

yum install mod_ssl<\/pre>\n
or that the ssl module is loaded in Ubuntu:<\/span><\/p>\n
sudo service apache2 restart<\/pre>\n
To illustrate, we will use a self-signed certificate, which is easy to create and use.<\/span><\/p>\n
A self-signed certificate is perfectly valid for a private application (as you can generate it on your own at no cost to you), but not for a production application. For a web site or application that other people will use, you may want to consider getting a certificate signed by a trusted Certificate Authority<\/span><\/a>. Note, however, that this option is not free.<\/span><\/div>\n
Let\u2019s begin by creating a special directory to store the certificate and the key.<\/span><\/p>\n
In CentOS:<\/span><\/p>\n
mkdir \/etc\/httpd\/certs<\/pre>\n
In Ubuntu:<\/span><\/p>\n
sudo mkdir \/etc\/apache2\/certs<\/pre>\n
Important: <\/b>The following example is based in Ubuntu, so if you are using CentOS make sure you change the path to the certs directory. The rest of the set up is identical for both distributions.<\/span><\/p>\n
Now we can go ahead and create a certificate that will be valid for 365 days and a 2048-bit RSA key. As you can see in Fig. 1, you can fill the required fields with whatever information you want:<\/span><\/p>\n
sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout \/etc\/apache2\/certs\/apache2.key -out \/etc\/apache2\/certs\/apache2.crt<\/pre>\n
\"Figure
Figure 1: Creating a self-signed certificate and key file<\/figcaption><\/figure>\n
You can find the explanation for the other options in the man page of openssl.<\/span><\/p>\n
A quick inspection of \/etc\/apache2\/certs will show the certificate and key files, as can be seen in Fig. 2:<\/span><\/p>\n
cd \/etc\/apache2\/certs\r\nls\r\nfile apache2.crt\r\nfile apache2.key<\/pre>\n
\"Figure
Figure 2: Displaying the certificate and key file types<\/figcaption><\/figure>\n
Now let\u2019s go to the configuration file of example2.com, which up to this point should look as follows:<\/span><\/p>\n
<VirtualHost *:80>\r\nDocumentRoot \"\/var\/www\/example2.com\/public_html\/\"\r\nServerName www.example2.com\r\nServerAlias example2.com\r\nErrorLog \/var\/www\/example2.com\/error.log\r\nCustomLog \/var\/www\/example2.com\/access.log combined\r\n<\/VirtualHost><\/pre>\n
We need to tell Apache to use TLS for this particular virtual host. To do that, change the IP address and port where the virtual host is defined to 192.168.0.30 (the IP address of the Ubuntu server) and 443, respectively, and then add the following directives:<\/span><\/p>\n