https://training-course-material.com/index.php?action=history&feed=atom&title=Apache_SSLApache SSL - Revision history2026-05-13T09:38:15ZRevision history for this page on the wikiMediaWiki 1.45.1https://training-course-material.com/index.php?title=Apache_SSL&diff=10856&oldid=prevBernard Szlachta: /* Exercise */2013-06-05T08:20:24Z<p><span class="autocomment">Exercise</span></p>
<p><b>New page</b></p><div>{{Cat|Apache}}<br />
<br />
<br />
== nginx and SSL ==<br />
* Encrypted transport over which HTTP runs<br />
* Decent performance with nginx<br />
* Can be combined with other features<br />
** Apache can handle SSL and proxy to another application<br />
<br />
== Installing mod_ssl ==<br />
* SSL not included by default in EL5<br />
* `yum -y install mod_ssl` to install<br />
* Will receive errors like '`Invalid command 'SSLEngine'`' if not installed<br />
<br />
== SSL ==<br />
* Public key encryption<br />
* **Private key** - should exist only on the server and not be transferred<br />
* **Certificate** - purchased from a third party who (should) verify that the recipient really is who they say they are<br />
* Safe to copy wherever/however you like - a copy given to every visitor to the website<br />
<br />
== Getting an SSL certificate ==<br />
* First, generate a private key<br />
$ openssl genrsa -des3 -out server.key 2048<br />
* Next, generate a certificate signing request (CSR)<br />
$ openssl req -new -key server.key -out server.csr<br />
* Now give the CSR to wherever you are buying the certificate from, and<br />
wait for them to send you an SSL cert<br />
<br />
== Using SSL Certificates ==<br />
* When you receive the SSL certificate, you will also receive an intermediary certificate<br />
* On Apache, this can be kept in its own file<br />
* If you have more than one intermediary, these must be combined into a single file<br />
<br />
== Adding SSL to Apache ==<br />
<br />
<VirtualHost *:443> <br />
ServerName www.example.com<br />
DocumentRoot /var/www/html <br />
<br />
SSLEngine On<br />
SSLProtocol all -SSLv2<br />
SSLCertificateKeyFile /etc/httpd/server.key<br />
SSLCertificateFile /etc/httpd/server.crt<br />
SSLCertificateChainFile /etc/httpd/intermediate.crt<br />
</VirtualHost><br />
<br />
== Exercise ==<br />
<br />
* Generate a private key + CSR, send to me to be signed<br />
* Install provided certificate<br />
* Make /foo proxy to the server on localhost:8000<br />
<br />
== Removing password from the key ==<br />
openssl rsa -in server.key -out server-nopw.key</div>Bernard Szlachta