{"id":1407,"date":"2010-11-23T10:38:13","date_gmt":"2010-11-23T03:38:13","guid":{"rendered":"http:\/\/www.jfdesignnet.com\/?p=1407"},"modified":"2010-11-23T10:38:13","modified_gmt":"2010-11-23T03:38:13","slug":"apache-ssl-and-virtualhost","status":"publish","type":"post","link":"https:\/\/www.jfdesignnet.com\/?p=1407","title":{"rendered":"apache, mod_ssl and virtualhosts"},"content":{"rendered":"

Securing connections to your website are vital when entering passwords or entering administration areas. Gathering information from RHEL and some debian admin site I found some nice steps creating a self-signed certificate and configuring your virtual host to use https (port 443) connections.<\/p>\n

Non-commercial<\/h2>\n

Before we go any further I would point out that self-signed certificates will produce warnings when accessed via an https link. They are not suitable for commercial sites or any public facing site but are ideal for personal administration areas. There are many sites that specialize in issuing recognized and guaranteed certificates. A search for ‘ssl certificates’ in your favorite search engine will provide many links.<\/p>\n

SSL directory<\/h2>\n

We can place the generated certificate anywhere but I like to keep them in one folder. Let’s create that folder:
\n{code}mkdir \/etc\/apache2\/ssl{\/code}<\/p>\n

Certificate<\/h2>\n

There are a couple of ways of creating self-signed certificates. The method used here creates a single file and does not require a passphrase on a reboot or Apache restart.<\/p>\n

To start enter the following command :
\n{code}openssl req -new -x509 -days 365 -nodes -out \/etc\/apache2\/ssl\/apache.pem -keyout \/etc\/apache2\/ssl\/apache.pem{\/code}<\/p>\n

The initial output is as follows :
\n{code}Generating a 1024 bit RSA private key
\n………..++++++
\n………..++++++
\nwriting new private key to ‘\/etc\/apache2\/ssl\/apache.pem’
\n—–
\nYou are about to be asked to enter information that will be incorporated
\ninto your certificate request.
\nWhat you are about to enter is what is called a Distinguished Name or a DN.
\nThere are quite a few fields but you can leave some blank
\nFor some fields there will be a default value,
\nIf you enter ‘.’, the field will be left blank.
\n—–{\/code}<\/p>\n

As indicated, you will be asked a series of questions:<\/p>\n

Country<\/strong><\/p>\n

Country Name (2 letter code) [AU]:<\/pre>\n
In my case, I entered ‘ID’ for Indonesia.<\/p>\n
State<\/strong><\/p>\n
State or Province Name (full name) [Some-State]:<\/pre>\n
You can leave this blank but for demonstration purposes I entered ‘East Java’.<\/p>\n
City<\/strong><\/p>\n
Locality Name (eg, city) []:<\/pre>\n
Again, leave blank if you wish. I entered ‘Surabaya’.<\/p>\n
Organization<\/strong><\/p>\n
Organization Name (eg, company) [Internet Widgits Pty Ltd]:<\/pre>\n
Here I entered ‘KSI’.<\/p>\n
Unit<\/strong><\/p>\n
Organizational Unit Name (eg, section) []:<\/pre>\n
I entered ‘Linux Development’<\/p>\n
Name<\/strong><\/p>\n
Common Name (eg, YOUR name) []:<\/pre>\n
Enter your domain address here – so you might enter something like  admin.domain.com. Only use your URL’s or IP address. I used  admin.domain.com as an example.<\/p>\n
Email<\/strong><\/p>\n
Email Address []:<\/pre>\n
If you want your email address displayed on the certificate, then  enter it here. If you are going to use a self-signed certificate for  public facing sites then I would recommend entering a valid address as  it gives them a person to contact.<\/p>\n
Anyway, I entered ‘webmaster@domain.com’.<\/p>\n
You will be placed back at the command prompt and the certificate has been placed, as directed, in \/etc\/apache2\/ssl\/apache.pem.<\/p>\n
mod_ssl<\/h2>\n
So now we have the certificate we need to enable Apache mod_ssl:<\/p>\n
a2enmod ssl<\/pre>\n
<\/a><\/p>\n
Virtual Hosts<\/h2>\n
Now we get to configuring the virtual hosts to enable secure connections.<\/p>\n
Remember that you can only have one certificate per IP address  which means that if you enable SSL connections to more than one virtual  host they will share the same certificate.<\/p>\n
If you have multiple IPs for your Cloud Server (yes, they are  coming!) then you would configure the virtual hosts based on IP address  and not necessarily based on named hosts (more on this when multiple IPs  are available).<\/p>\n
Let’s start by enabling port 443 on the default vhost:<\/p>\n
mcedit \/etc\/apache2\/sites-available\/default<\/pre>\n
At the very top of the file you will see this:<\/p>\n
NameVirtualHost *\n\n<VirtualHost *>\n...<\/pre>\n
Change these settings to listen to the default http port (80):<\/p>\n
NameVirtualHost *:80\n\n<VirtualHost *:80>\n...<\/pre>\n
Now we need to add support for port 443.<\/p>\n
Add ‘NameVirtualHost *:443’ so it looks like this:<\/p>\n
NameVirtualHost *:80\nNameVirtualHost *:443\n\n<VirtualHost *:80>\n...<\/pre>\n
So now the default virtual host is listening to both port 80 and port  443. However, we’ve only got settings for port 80: It won’t know what  to do with any connections to port 443.<\/p>\n
Let’s rectify that by copying the <VirtualHost *:80> settings:<\/p>\n
<VirtualHost *:80>\n...\n...\n<\/VirtualHost><\/pre>\n
…and paste them at the bottom of the file with the port changed to *:443 as follows:<\/p>\n
<VirtualHost *:443>\n...\n...\n<\/VirtualHost><\/pre>\n
One final tweak to the pasted settings is the addition of these two lines:<\/p>\n
SSLEngine on\nSSLCertificateFile \/etc\/apache2\/ssl\/apache.pem<\/pre>\n
<\/a><\/p>\n
Reload<\/h2>\n
At this point, reload Apache for the new settings to take effect:<\/p>\n
\/etc\/init.d\/apache2 force-reload<\/pre>\n
Somehow on mine \/etc\/init.d\/apache restart is giving an error, so you must use stop then start or force-reload option.
\n<\/a><\/p>\n
Warnings<\/h2>\n
Now when you browse to your IP address or whichever virtual host you setup to use SSL, you will see warnings similar to these :<\/p>\n
\"\"<\/a><\/p>\n
Clicking ‘Confirm Exception’ will take you to a second warning:<\/p>\n
\"\"<\/a><\/p>\n
If you accept the certificate, you will then proceed to the site.  However, as you can tell, a visitor receiving these warnings on a  supposedly secure area of a public website will not be too impressed.  They are, however, fine for personal use and for an administration area.<\/p>\n
<\/a><\/p>\n
Other virtual hosts<\/h2>\n
Remember how we changed <VirtualHost *> to <VirtualHost  *:80> in the default virtual hosts file? Well, we need to do the same  for any other virtual hosts files.<\/p>\n
Then, to add SSL support to any other virtual hosts simply repeat  the procedure and have two configurations in each file. One for port 80  and one for port 443 – keep in mind that any configured virtual hosts  will share the same certificate.<\/p>\n
You don’t need the NameVirtualHost settings in each file though. They only need to be in the default file.<\/p>\n
<\/a><\/p>\n
Summary<\/h2>\n
Once you get used to the process, adding self-signed certificates and  configuring virtual host support for SSL connections is relatively  straight forward.<\/p>\n
 <\/p>\n
Note :<\/strong><\/span><\/p>\n
Adjust all apache2 path \/etc\/apache2\/ssl into httpd \/etc\/httpd\/ssl if you were using klixs.<\/p>\n","protected":false},"excerpt":{"rendered":"
Securing connections to your website are vital when entering passwords or entering administration areas. Gathering information from RHEL and some debian admin site I found some nice steps creating a self-signed certificate and configuring your virtual host to use https (port 443) connections. Non-commercial Before we go any further I would point out that self-signed […]<\/p>\n","protected":false},"author":1,"featured_media":1409,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[16,9],"tags":[153,228],"_links":{"self":[{"href":"https:\/\/www.jfdesignnet.com\/index.php?rest_route=\/wp\/v2\/posts\/1407"}],"collection":[{"href":"https:\/\/www.jfdesignnet.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.jfdesignnet.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.jfdesignnet.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.jfdesignnet.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1407"}],"version-history":[{"count":0,"href":"https:\/\/www.jfdesignnet.com\/index.php?rest_route=\/wp\/v2\/posts\/1407\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.jfdesignnet.com\/index.php?rest_route=\/wp\/v2\/media\/1409"}],"wp:attachment":[{"href":"https:\/\/www.jfdesignnet.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1407"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.jfdesignnet.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1407"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.jfdesignnet.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1407"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}