Installing SSL certificate in Apache

<yambe:breadcrumb>Security_tips|Security tips</yambe:breadcrumb> <yambe:breadcrumb>Apache web server configuration</yambe:breadcrumb>

Using startssl SSL certificates for HTTPS

It is good to have HTTPS certificate signed by recognized CA instead of using self-signed certificate. One very viable option for simple HTTPS certificate is http://www.startssl.com Using this website one can generate SSL certificates recognized by all popular browsers for free. Steps for obtaining such certificate are:

1. Register on website and provide authetication code from email
2. Wait for another acceptance email with code and paste same in browser
3. Generate client certificate to recognize oneself. Take backup of this certificate with password at some safe location.
4. Go to control panel -> Validation wizard -> Domain name validation
5. Verify by email ID of domain owner. An email with verification code will be sent to chosen email ID.
6. Go to control panerl -> Certificate wizard -> SSL/TLS web certificate
7. Choose simple password and create private key
8. Download private key and decrypt it with password chosen in previous step. Decoding command is shown on the screen as "openssl rsa -in ssl,key -out ssl.key"
9. Enter desired TLD and sub-domain for which certificate is being requested
10. Wait for email confirmation for certificate request
11. Download the certificate and copy it to server along with key and CA (pem) format with CRL included ( https://www.startssl.com/certs/ca-bundle.pem )

Install SSL certificate in apache

For installation of certificate in apache use following steps:

1. Copy all (certificate, key, CA bundle) to /etc/httpd/conf folder
2. chmod 400 ssl.key
3. Edit /etc/httpd/conf.d/ssl.conf and replace appropriate values. Following three values need to be updated:

   SSLCertificateFile /etc/httpd/conf/ssl.crt
   SSLCertificateKeyFile /etc/httpd/conf/ssl.key
   SSLCACertificateFile /etc/httpd/conf/ca-bundle.pem

4. Restart apache and verify that certificate is working as expected.

Securing Apache SSL configuration

Default SSL configuration of apache is vulnerable to many attacks. We can improve apache SSL configuration as follows:

1. Edit /etc/httpd/conf/ssl.conf and replace/insert following two values

   SSLProtocol all -SSLv2 -SSLv3
   SSLHonorCipherOrder on
   SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA !RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS"

   In case of Virtualhost 'SSLEngine On' line is also required.

2. Check ranking of HTTPS security using https://www.ssllabs.com/ssltest/index.html

Steps learned from https://www.sslshopper.com/article-how-to-disable-weak-ciphers-and-ssl-2.0-in-apache.html

<yambe:breadcrumb>Security_tips|Security tips</yambe:breadcrumb> <yambe:breadcrumb>Apache web server configuration</yambe:breadcrumb>