Apache - Revision history

Jfreier at 18:33, 31 July 2024

2024-07-31T18:33:42Z

Jfreier at 15:37, 10 June 2020

2020-06-10T15:37:51Z

Jfreier at 15:29, 21 June 2017

2017-06-21T15:29:39Z

Jfreier: /* SSL Setup 2 */

2017-06-21T15:23:50Z

‎SSL Setup 2

Jfreier: /* SSL Setup 2 */

2017-06-21T15:20:21Z

‎SSL Setup 2

Jfreier: /* SSL Setup 2 */

2017-06-21T03:47:43Z

‎SSL Setup 2

Jfreier: /* SSL Setup 2 */

2017-06-20T21:04:23Z

‎SSL Setup 2

Jfreier: /* SSL Setup 2 */

2017-06-20T21:03:53Z

‎SSL Setup 2

Jfreier at 16:37, 18 May 2016

2016-05-18T16:37:11Z

Jfreier: /* SSL Setup 2 */

2015-03-20T21:19:10Z

‎SSL Setup 2

← Older revision		Revision as of 18:33, 31 July 2024
Line 172:		Line 172:
	1. Paste current johnfreier.com csr to website that issues the new crt.		1. Paste current johnfreier.com csr to website that issues the new crt.
	2. The new crt gets emailed, just replace it.		2. The new crt gets emailed, just replace it.
−
−
−
−	~~== Headline text ==~~
−
−	~~== Headline text ==~~

← Older revision		Revision as of 15:37, 10 June 2020
Line 167:		Line 167:

	# openssl rsa -in www.key -out new.key		# openssl rsa -in www.key -out new.key
		+
		+
		+	== Notes on updating crt ==
		+	1. Paste current johnfreier.com csr to website that issues the new crt.
		+	2. The new crt gets emailed, just replace it.
		+
		+
		+
		+	== Headline text ==
		+
		+	== Headline text ==

@@ Line 27: / Line 27: @@
 . Install SSL module for Apache on Fedora
-   > yum install mod_ssl
+   yum install mod_ssl
 . I create a folder for housing any newly created certs to be used by Apache.
-   > mkdir /etc/httpd/ssl
+   mkdir /etc/httpd/ssl
-−
-. I generated a cert.  A *.pem file contains both public and private key.  This will ask you a bunch of questions too.
-  > openssl req -new -x509 -sha256 -days 365 -nodes -out /etc/httpd/ssl/httpd.pem -keyout /etc/httpd/ssl/httpd.key
-−
-Resources
-−
-http://cs.uccs.edu/~cs526/secureWebAccess/secureWebAccess.htm
-−
-http://www.apachelounge.com/viewtopic.php?t=3571
-−
-https://www.linode.com/docs/security/ssl/ssl-certificates-with-apache-2-on-fedora-14
-−
-−
-== SSL Setup 2 ==
 *.key = Key file kind of like a password.
@@ Line 51: / Line 37: @@
 *.pem = Bundle of key, and certificates.
 *.p12 = a combo file of key and cert.
 . Create files for openssl to use for records.
@@ Line 116: / Line 100: @@
   Root key: ca.key
   Root certificate: ca.cert
@@ Line 163: / Line 146: @@
 http://linuxconfig.org/apache-web-server-ssl-authentication
 == SSL (StartSSL) ==

← Older revision		Revision as of 15:23, 21 June 2017
Line 45:		Line 45:

	== SSL Setup 2 ==		== SSL Setup 2 ==
		+
		+	*.key = Key file kind of like a password.
		+	*.csr = Certificate Signing Request, this is the built request to generate a certificate.
		+	*.crt = Certificate
		+	*.pem = Bundle of key, and certificates.
		+	*.p12 = a combo file of key and cert.

	I'm trying again...The first attempt failed because I didn't generate a CA.		I'm trying again...The first attempt failed because I didn't generate a CA.

@@ Line 56: / Line 56: @@
 . Create the private key for the CA ROOT certification.
-   # openssl genrsa -aes256 -out /etc/pki/CA/private/ca.key.pem 4096
+   # openssl genrsa -aes256 -out /etc/pki/CA/private/ca.key 4096
-   Enter pass phrase for ca.key.pem: secretpassword
+   Enter pass phrase for ca.key: secretpassword
-   Verifying - Enter pass phrase for ca.key.pem: secretpassword
+   Verifying - Enter pass phrase for ca.key: secretpassword
-   # chmod 400 /etc/pki/CA/private/ca.key.pem
+   # chmod 400 /etc/pki/CA/private/ca.key
 .  Double check configs.  I needed to uncomment out some.
@@ Line 85: / Line 85: @@
 . Create a CA certificate from your CA key.
-Now you can use the root key above to issue a root certificate (ca.cert.pem). In this example, the certificate is set to expire in ten years. As this is a CA certificate, use the v3_ca extension. You will be prompted for some responses, which you can fill with whatever you like. For convenience, defaults can be set in the openssl configuration file.
+Now you can use the root key above to issue a root certificate (ca.crt). In this example, the certificate is set to expire in ten years. As this is a CA certificate, use the v3_ca extension. You will be prompted for some responses, which you can fill with whatever you like. For convenience, defaults can be set in the openssl configuration file.
 Important: The default digest is SHA-1. SHA-1 is considered insecure. Pass the -sha256 option to use a more secure digest.
@@ Line 91: / Line 91: @@
 Make sure the common name matches your server name, wiki.johnfreier.com.
-   openssl req -new -x509 -days 3650 -key /etc/pki/CA/private/ca.key.pem -sha256 -extensions v3_ca -out /etc/pki/CA/certs/ca.cert.pem
+   openssl req -new -x509 -days 3650 -key /etc/pki/CA/private/ca.key -sha256 -extensions v3_ca -out /etc/pki/CA/certs/ca.crt
-   Enter pass phrase for ca.key.pem:
+   Enter pass phrase for ca.key:
    You are about to be asked to enter information that will be incorporated
    into your certificate request.
@@ Line 106: / Line 106: @@
    Email Address []:alice@example.com
-   chmod 444 /etc/pki/CA/certs/ca.cert.pem
+   chmod 444 /etc/pki/CA/certs/ca.crt
-  Root key: ca.key.pem
+  Root key: ca.key
-  Root certificate: ca.cert.pem
+  Root certificate: ca.cert
@@ Line 115: / Line 115: @@
 . Generate Signing Request Key.  This creates a signing request key that is used to verify things.
-   openssl genrsa -out footballaz.key.pem 4096
+   openssl genrsa -out footballaz.key 4096
@@ Line 122: / Line 122: @@
 I did not use -x509 or -days not sure what i missed???
-   openssl req -sha256 -new -key footballaz.key.pem -out footballaz.csr.pem
+   openssl req -sha256 -new -key footballaz.key -out footballaz.csr
 . Create Certificate
-   openssl ca -keyfile /etc/pki/CA/private/ca.key.pem -cert /etc/pki/CA/certs/ca.cert.pem -extensions usr_cert -notext -md sha256 -in footballaz.csr.pem -out footballaz.cert.pem
+   openssl ca -keyfile /etc/pki/CA/private/ca.key -cert /etc/pki/CA/certs/ca.crt -extensions usr_cert -notext -md sha256 -in footballaz.csr -out footballaz.crt
 . Verify new certificate
-   openssl verify -CAfile /etc/pki/CA/certs/ca.cert.pem footballaz.cert.pem
+   openssl verify -CAfile /etc/pki/CA/certs/ca.crt footballaz.crt
 Need to generate a *.p12 certificate.  Which is a special combination cert that is password protected.  This one is need by the browser to get to the site.
-   openssl pkcs12 -export -in footballaz.cert.pem -inkey footballaz.key.pem -out footballaz.p12
+   openssl pkcs12 -export -in footballaz.crt -inkey footballaz.key -out footballaz.p12
 . Install the *.p12 file in a browser or computer and....
@@ Line 143: / Line 143: @@
    <VirtualHost *:443>
    	SSLEngine on
-   	SSLCertificateFile /etc/httpd/ssl/footballaz.cert.pem
+   	SSLCertificateFile /etc/httpd/ssl/footballaz.crt
-   	SSLCertificateKeyFile /etc/httpd/ssl/footballaz.key.pem
+   	SSLCertificateKeyFile /etc/httpd/ssl/footballaz.key
-   	SSLCACertificateFile {path_to_ca}/ca.cert.pem
+   	SSLCACertificateFile {path_to_ca}/ca.crt
    	SSLVerifyClient require
    	SSLVerifyDepth	2

← Older revision		Revision as of 03:47, 21 June 2017
Line 88:		Line 88:

	Important: The default digest is SHA-1. SHA-1 is considered insecure. Pass the -sha256 option to use a more secure digest.		Important: The default digest is SHA-1. SHA-1 is considered insecure. Pass the -sha256 option to use a more secure digest.
		+
		+	Make sure the common name matches your server name, wiki.johnfreier.com.

	openssl req -new -x509 -days 3650 -key /etc/pki/CA/private/ca.key.pem -sha256 -extensions v3_ca -out /etc/pki/CA/certs/ca.cert.pem		openssl req -new -x509 -days 3650 -key /etc/pki/CA/private/ca.key.pem -sha256 -extensions v3_ca -out /etc/pki/CA/certs/ca.cert.pem

← Older revision		Revision as of 21:03, 20 June 2017
Line 138:		Line 138:
	It WORKED!!!		It WORKED!!!

		+	These were extra SSL properties I needed to get it to work correctly.
		+	<VirtualHost *:443>
		+	SSLEngine on
		+	SSLCertificateFile /etc/httpd/ssl/footballaz.cert.pem
		+	SSLCertificateKeyFile /etc/httpd/ssl/footballaz.key.pem
		+	SSLCACertificateFile {path_to_ca}/ca.cert.pem
		+	SSLVerifyClient require
		+	SSLVerifyDepth 2
		+	SSLProtocol all -SSLv2 -SSLv3
		+	SSLHonorCipherOrder On
		+	SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
		+	</VirtualHost>
	Resources		Resources

@@ Line 1: / Line 1: @@
-'''Virtual Host'''
+== Virtual Host ==
 This is how you setup apache for Virual Hosts. example if you have more domain names and only one server.
 The serverAlias is used in case people don't put in the "www" before the URL.
@@ Line 9: / Line 9: @@
-'''Virtual Host ProxyPass'''
+== Virtual Host ProxyPass ==
 This will pass any http request along.  It helps when you want to pass a connection to another server, example apache -> tomcat:8080.
@@ Line 143: / Line 143: @@
 http://linuxconfig.org/apache-web-server-ssl-authentication

← Older revision		Revision as of 21:19, 20 March 2015
Line 133:		Line 133:

	openssl pkcs12 -export -in footballaz.cert.pem -inkey footballaz.key.pem -out footballaz.p12		openssl pkcs12 -export -in footballaz.cert.pem -inkey footballaz.key.pem -out footballaz.p12
		+
		+	5. Install the *.p12 file in a browser or computer and....
		+
		+	It WORKED!!!
		+
	Resources		Resources