Setting up SSL for Apache HTTPD - Revision history

Admin: /* Step 5: Start the web server and test */

2009-10-13T21:58:27Z

Step 5: Start the web server and test

← Older revision		Revision as of 00:58, 14 October 2009
Line 174:		Line 174:

	In order to test that your SSL/TLS web server is running, you will now need to connect to it with a browser. The URL you use should be https://yourservername.com. You will probably get a warning prompt about the Certificate Authority (CA) being unknown. You can view the certificate properties, which will look familiar because you created the cert yourself. You can save the cert in your browser, or import the my-ca.crt file into your browser as a new CA. How you do this will depend on which browser you are using. I had no problems doing this with Mozilla.		In order to test that your SSL/TLS web server is running, you will now need to connect to it with a browser. The URL you use should be https://yourservername.com. You will probably get a warning prompt about the Certificate Authority (CA) being unknown. You can view the certificate properties, which will look familiar because you created the cert yourself. You can save the cert in your browser, or import the my-ca.crt file into your browser as a new CA. How you do this will depend on which browser you are using. I had no problems doing this with Mozilla.

			==Creating Client Certificates for Authentication==

			Now, let's say that we want a stronger method of authenticating clients, one that is not as susceptible to password guessing and shoulder-surfing. What can we do? We can create an SSL/TLS client certificate. The certificate has to be digitally signed by a CA that the server trusts, the user has to have the client loaded in his browser, and the user has to know a pass phrase to use it. The certificate itself uses strong, public-key cryptography. We can make such a certificate with our OpenSSL toolkit.

			A note on certificate formats: The server and CA certs that we have been using up to now are encoded in PEM format, which uses ASCII characters. For some reason, the industry-standard client certs used in web browsers are encoded in the PKCS#12 format, which cannot be viewed as simple text. It is a binary file. We will now create a client cert by following these steps:

			* Create a new private key and certificate request
			* Sign the certificate request, thereby creating the client certificate
			* Generate the PKCS#12 cert file
			* View information about the PKCS#12 cert
			* Import the PKCS#12 client cert into your browser
			* Test!

			[root]# cd /root/CA
			[root]# openssl genrsa -des3 -out dex-c.key 1024
			Generating RSA private key, 1024 bit long modulus
			..++++++
			........................................................................++++++
			e is 65537 (0x10001)
			Enter PEM pass phrase:
			Verifying password - Enter PEM pass phrase:
			[root]# openssl req -new -key dex-c.key -out dex-c.csr
			Using configuration from /usr/share/ssl/openssl.cnf
			Enter PEM pass phrase:
			You are about to be asked to enter information that will be incorporated
			into your certificate request.
			What you are about to enter is what is called a Distinguished Name or a DN.
			There are quite a few fields but you can leave some blank
			For some fields there will be a default value,
			If you enter '.', the field will be left blank.
			-----
			Country Name (2 letter code) [GB]:RO
			State or Province Name (full name) [Berkshire]:Dolj
			Locality Name (eg, city) [Newbury]:Craiova
			Organization Name (eg, company) [My Company Ltd]:d3xt3r01.tk
			Organizational Unit Name (eg, section) []:IT
			Common Name (eg, your name or your server's hostname) []:d3xt3r01.tk
			Email Address []:dexter@d3xt3r01.tk
			Please enter the following 'extra' attributes
			to be sent with your certificate request
			A challenge password []:
			An optional company name []:
			[root]# openssl x509 -req -in dex-c.csr -out dex-c.crt -sha1 -CA my-ca.crt -CAkey my-ca.key -CAcreateserial -days 3650
			[root]# openssl pkcs12 -export -in dex-c.crt -inkey dex-c.key -name "dex Emery Cert" -out dex-c.p12
			[root]# openssl pkcs12 -in dex-c.p12 -clcerts -nokeys -info

			'''Note:''' The "export password" is all the end-user needs to know. This is what you will be asked for when installing the certificate in a browser.

			Now move the dex-c.p12 file to your client machine and import it into your web browser. This is usually done your browser's "Preferences" section under "Privacy and Security", "Certificates", "Manage Certificates". You may be asked to input a Software Security Device Master Password. DO NOT FORGET this password! You will also be asked for the client certificate's export password.

			==Configure Apache to require client certificates for a specific directory==

			In order to require client certificates for the /var/www/SSL/Certneeded directory, you will need to add the following lines to the /etc/httpd/conf.d/ssl.conf configuration file:

			<Directory /var/www/SSL/Certneeded>
			SSLVerifyClient require
			SSLVerifyDepth 1
			</Directory>

			Now, restart Apache with /etc/init.d/httpd restart. You can now connect from your client machine browser to the secure webserver at https://yoursevername.com:444. You should now be able to click on the "Client Certificate Required" link and view the files in that directory.

			If you connect from a different browser that does not have the certificate installed, you will not be able to enter the directory at all. When you look in your /var/www/httpd/ssl_error_log file, you will see this error:

			[01:02:41] [error] Re-negotiation handshake failed: Not accepted by client!?
			[01:02:41] [error] SSL handshake failed (server d3xt3r01.tk:444, client 192.168.1.191)
			[01:02:41] [error] SSL Library Error: 336105671 error:140890C7:lib(20):func(137):reason(199)

			==Configure Apache to require client certificates AND username/password for a specific directory==

			If you are super paranoid, you may want to require a client certificate AND username/password. This is totally up to you, and it is easy to do.

			For this simple example, we will use the .htpasswd file and usernames/passwords that have already been created earlier. This will force clients to have a certificate and a valid username/password pair in order to access the /var/www/SSL/PassAndCert. All we have to do is add the following section to the /etc/httpd/conf.d/ssl.conf configuration file:

			<Directory "/var/www/SSL/PassAndCert">
			SSLVerifyClient require
			SSLVerifyDepth 1
			AuthType Basic
			AuthName "Restricted Area"
			AuthUserFile /etc/httpd/.htpasswd
			Require valid-user
			</Directory>

			Now, restart Apache with /etc/init.d/httpd restart. Connect from your client machine browser to the secure webserver. When you click the link for the "Client Cert AND Password Required" directory, you should be prompted for a username and password. You should then be able to view the directory contents. If you delete your client certificate from the browser, you will be unable to access either directory that requires client certificates.

			==Web Server Key Password==

			You have probably noticed by now that every time you restart Apache or boot your server, you are forced to enter the password for the server key. This is a security measure, but it can be inconvenient. If you would like to make an insecure server key that will allow Apache to start automatically at boot time, then there is a way to do this. In my case, I don't run an e-commerce site and I'm not worried about someone else creating a fake d3xt3r01.tk secure web site. It is more likely that a power outage will occur that will cause my server to reboot while I am not around, so I want it to boot without requiring a password. The choice is yours...

			Here is how you do it:

			[root]# cd /etc/httpd/conf/ssl.key
			[root]# cp mars-server.key mars-server.key.org
			[root]# openssl rsa -in mars-server.key.org -out mars-server.key
			[root]# chmod 0400 mars-server*

			Now, you should be able to restart Apache or boot your server without having to input the password. This may also be a very good time to copy all the keys and certificates that you made to floppy or CD. You can imagine what a pain it would be if you lost all of your keys and certs due to a disk failure. You may even want to make paper copies of the PEM encoded certificates and keys, which use ASCII text. Lock them in a secure place, along with any passwords.

			==Conclusion/Final Comments==

			As you can see, setting up a secure web server for some specific function is not that difficult. All the tools are included with a standard GNU/Linux distribution. OpenSSL is a fantastic Open Source toolkit that can be used in a number of applications. You can use it to run files through different hashing functions, handle S/MIME encrypted mail, or encrypt & decrypt files.

			In order to use Apache as a high-volume e-commerce server with SSL/TLS, you will probably need to do more configuration and hardware tuning. You may need to buy and configure a hardware crypto accelerator card. You will almost certainly want to purchase a "real" server certificate signed by Entrust, Thawte, or one of the other root-level CAs.

			In any event, you now have a good feel for all the pieces, parts, and protocols that make it work!

			[[Category: Apache]]
			[[Category: HTTPD]]
			[[Category: SSL]]

Admin: /* Step 2: Make a key and a certificate for the web server */

2009-10-13T21:23:06Z

Step 2: Make a key and a certificate for the web server

← Older revision		Revision as of 00:23, 14 October 2009
Line 109:		Line 109:
	[root]# cp mars-server.crt /etc/httpd/CA		[root]# cp mars-server.crt /etc/httpd/CA
	[root]# cp mars-server.key /etc/httpd/CA		[root]# cp mars-server.key /etc/httpd/CA
	[root]# cp my-ca.crt /etc/httpd~~/conf~~/CA		[root]# cp my-ca.crt /etc/httpd/CA

	==Step 3: Create directories and files for the secure web service==		==Step 3: Create directories and files for the secure web service==

Admin: /* Step 4: Configure the Apache web server */

2009-10-13T21:10:30Z

Step 4: Configure the Apache web server

← Older revision		Revision as of 00:10, 14 October 2009
Line 139:		Line 139:
	SSLCertificateChainFile /etc/httpd/CA/my-ca.crt		SSLCertificateChainFile /etc/httpd/CA/my-ca.crt
	# Certificate Authority (CA):		# Certificate Authority (CA):
	SSLCACertificateFile /etc/httpd/~~conf/ssl.crt~~/my-ca.crt		SSLCACertificateFile /etc/httpd/CA/my-ca.crt
	# This is needed so that you can use auto-indexing for some directories in the		# This is needed so that you can use auto-indexing for some directories in the
	# /var/www/SSL directory branch. This can be handy if you would like to have		# /var/www/SSL directory branch. This can be handy if you would like to have

Admin: /* Step 2: Make a key and a certificate for the web server */

2009-10-13T21:09:49Z

Step 2: Make a key and a certificate for the web server

← Older revision		Revision as of 00:09, 14 October 2009
Line 106:		Line 106:
	Now, we need to move the new keys and certs into the proper directories in the /etc/httpd hierarchy:		Now, we need to move the new keys and certs into the proper directories in the /etc/httpd hierarchy:

	[root]# cp mars-server.crt /etc/httpd/~~conf/ssl.crt~~		[root]# mkdir /etc/httpd/CA
	[root]# cp mars-server.key /etc/httpd/~~conf/ssl.key~~		[root]# cp mars-server.crt /etc/httpd/CA
	[root]# cp my-ca.crt /etc/httpd/conf/~~ssl.crt~~		[root]# cp mars-server.key /etc/httpd/CA
			[root]# cp my-ca.crt /etc/httpd/conf/CA

	==Step 3: Create directories and files for the secure web service==		==Step 3: Create directories and files for the secure web service==

Admin: /* Step 4: Configure the Apache web server */

2009-10-13T21:08:55Z

Step 4: Configure the Apache web server

← Older revision		Revision as of 00:08, 14 October 2009
Line 132:		Line 132:
	SSLProtocol all -SSLv2		SSLProtocol all -SSLv2
	# Server Certificate:		# Server Certificate:
	SSLCertificateFile /etc/httpd/~~conf/ssl.crt~~/mars-server.crt		SSLCertificateFile /etc/httpd/CA/mars-server.crt
	# Server Private Key:		# Server Private Key:
	SSLCertificateKeyFile /etc/httpd/~~conf/ssl.key~~/mars-server.key		SSLCertificateKeyFile /etc/httpd/CA/mars-server.key
	# Server Certificate Chain:		# Server Certificate Chain:
	SSLCertificateChainFile /etc/httpd/~~conf/ssl.crt~~/my-ca.crt		SSLCertificateChainFile /etc/httpd/CA/my-ca.crt
	# Certificate Authority (CA):		# Certificate Authority (CA):
	SSLCACertificateFile /etc/httpd/conf/ssl.crt/my-ca.crt		SSLCACertificateFile /etc/httpd/conf/ssl.crt/my-ca.crt

Admin: /* Step 5: Start the web server and test */

2009-10-13T20:38:33Z

Step 5: Start the web server and test

@@ Line 160: / Line 160: @@
    Server d3xt3r01.tk:443 (RSA)
    Enter pass phrase:
-   Ok: Pass Phrase Dialog successful.
+   Ok: Pass Phrase Dialog successful.                       [  OK  ]
-                                                           [  OK  ]

Admin: /* Step 5: Start the web server and test */

2009-10-13T20:35:19Z

Step 5: Start the web server and test

← Older revision		Revision as of 23:35, 13 October 2009
Line 154:		Line 154:

	[root]# /etc/init.d/httpd start		[root]# /etc/init.d/httpd start
	Starting httpd: Apache/2.2.6 mod_ssl/2.0.40 (Pass Phrase Dialog)		Starting httpd: Apache/2.2.3 mod_ssl/2.2.3 (Pass Phrase Dialog)
	Some of your private key files are encrypted for security reasons.		Some of your private key files are encrypted for security reasons.
	In order to read them you have to provide ~~us with~~ the pass phrases.		In order to read them you have to provide the pass phrases.

	Server d3xt3r01.tk:443 (RSA)		Server d3xt3r01.tk:443 (RSA)
	Enter pass phrase:		Enter pass phrase:
	Ok: Pass Phrase Dialog successful.		Ok: Pass Phrase Dialog successful.
	[ OK ]		[ OK ]

Admin: /* Step 4: Configure the Apache web server */

2009-10-13T20:33:31Z

Step 4: Configure the Apache web server

← Older revision		Revision as of 23:33, 13 October 2009
Line 124:		Line 124:

	==Step 4: Configure the Apache web server==		==Step 4: Configure the Apache web server==

			On a default CentOS 5.3 install, there are two config files that concern us: httpd.conf and ssl.conf. All of our changes will be made in the /etc/httpd/conf.d/ssl.conf file. It is not necessary to modify the httpd.conf file to accomplish our goals on a stock CentOS 5.3 server. Here are the changes/additions to ssl.conf :

			# Here, I am allowing only "high" and "medium" security key lengths.
			SSLCipherSuite HIGH:MEDIUM
			# Here I am allowing SSLv3 and TLSv1, I am NOT allowing the old SSLv2.
			SSLProtocol all -SSLv2
			# Server Certificate:
			SSLCertificateFile /etc/httpd/conf/ssl.crt/mars-server.crt
			# Server Private Key:
			SSLCertificateKeyFile /etc/httpd/conf/ssl.key/mars-server.key
			# Server Certificate Chain:
			SSLCertificateChainFile /etc/httpd/conf/ssl.crt/my-ca.crt
			# Certificate Authority (CA):
			SSLCACertificateFile /etc/httpd/conf/ssl.crt/my-ca.crt
			# This is needed so that you can use auto-indexing for some directories in the
			# /var/www/SSL directory branch. This can be handy if you would like to have
			# a list of sensitive files for people to download.
			<Directory "/var/www/SSL">
			Options Indexes
			AllowOverride None
			Allow from from all
			Order allow,deny
			</Directory>

			==Step 5: Start the web server and test==

			Run the following commands to start the the Apache web server:

			[root]# /etc/init.d/httpd start
			Starting httpd: Apache/2.2.6 mod_ssl/2.0.40 (Pass Phrase Dialog)
			Some of your private key files are encrypted for security reasons.
			In order to read them you have to provide us with the pass phrases.

			Server d3xt3r01.tk:443 (RSA)
			Enter pass phrase:
			Ok: Pass Phrase Dialog successful.
			[ OK ]

Admin: /* Step 2: Make a key and a certificate for the web server */

2009-10-13T20:18:55Z

Step 2: Make a key and a certificate for the web server

← Older revision		Revision as of 23:18, 13 October 2009
Line 65:		Line 65:

	Now, we have to make an X.509 certificate and corresponding private key for the web server. Rather than creating a certificate directly, we will create a key and a certificate request, then "sign" the certificate request with the CA key we made in Step 1. You can make keys for multiple web servers this way. One thing to note is that SSL/TLS private keys for web servers need to be either 512 or 1024 bits. Any other key size may be incompatible with certain browsers.		Now, we have to make an X.509 certificate and corresponding private key for the web server. Rather than creating a certificate directly, we will create a key and a certificate request, then "sign" the certificate request with the CA key we made in Step 1. You can make keys for multiple web servers this way. One thing to note is that SSL/TLS private keys for web servers need to be either 512 or 1024 bits. Any other key size may be incompatible with certain browsers.

			[root]# openssl genrsa -des3 -out mars-server.key 1024
			Generating RSA private key, 1024 bit long modulus
			..................++++++
			.................++++++
			e is 65537 (0x10001)
			Enter pass phrase for mars-server.key:
			Verifying - Enter pass phrase for mars-server.key:
			[root]# openssl req -new -key mars-server.key -out mars-server.csr
			Enter pass phrase for mars-server.key:
			You are about to be asked to enter information that will be incorporated
			into your certificate request.
			What you are about to enter is what is called a Distinguished Name or a DN.
			There are quite a few fields but you can leave some blank
			For some fields there will be a default value,
			If you enter '.', the field will be left blank.
			-----
			Country Name (2 letter code) [GB]:TW
			State or Province Name (full name) [Berkshire]:Taipei County
			Locality Name (eg, city) [Newbury]:Nankang
			Organization Name (eg, company) [My Company Ltd]:d3xt3r01.tk
			Organizational Unit Name (eg, section) []:Web Services
			Common Name (eg, your name or your server's hostname) []:d3xt3r01.tk <=== This must be the real FQDN of your server!!!
			Email Address []:hostmaster@d3xt3r01.tk
			Please enter the following 'extra' attributes
			to be sent with your certificate request
			A challenge password []:
			An optional company name []:
			[root]# openssl x509 -req -in mars-server.csr -out mars-server.crt -sha1 -CA my-ca.crt -CAkey my-ca.key -CAcreateserial -days 3650
			Signature ok
			subject=/C=TW/ST=Taipei County/L=Nankang/O=d3xt3r01.tk/OU=Web Services/CN=d3xt3r01.tk/Email=hostmaster@d3xt3r01.tk
			Getting CA Private Key
			Enter pass phrase for my-ca.key:
			[root]# openssl x509 -in mars-server.crt -text -noout

			Make sure that your server name is the same as the FQDN that your clients will use when connecting to your site. Also, let's get in the habit of protecting our keys with appropriate permissions:

			[root]# chmod 0400 *.key

			Now, we need to move the new keys and certs into the proper directories in the /etc/httpd hierarchy:

			[root]# cp mars-server.crt /etc/httpd/conf/ssl.crt
			[root]# cp mars-server.key /etc/httpd/conf/ssl.key
			[root]# cp my-ca.crt /etc/httpd/conf/ssl.crt

			==Step 3: Create directories and files for the secure web service==

			I do not want the secure branch of my webserver directory tree to be part of my "insecure" branch that serves unencrypted files. My normal web root directory is /var/www/html . The document root for the secure web server will be located at /var/www/SSL .

			[root]# mkdir /var/www/SSL
			[root]# chmod 0775 /var/www/SSL
			[root]# cd /var/www/SSL
			[root]# mkdir Passneeded
			[root]# mkdir Certneeded
			[root]# mkdir PassAndCert

			For testing purposes, I added a very simple test SSL index file into /var/www/SSL . Save it as index.html . Copy some JPEG files and text files into each directory, so that there will be something to look at/retrieve in each directory.

			==Step 4: Configure the Apache web server==

Admin: Setting up SSL for apache moved to Setting up SSL for Apache HTTPD

2009-10-13T20:10:00Z

Setting up SSL for apache moved to Setting up SSL for Apache HTTPD

← Older revision	Revision as of 23:10, 13 October 2009
(No difference)