208.2. Apache configuration for HTTPS

208.2 Apache configuration for HTTPS

Weight: 3

Description: Candidates should be able to configure a web server to provide HTTPS.

Key Knowledge Areas:

  • SSL configuration files, tools and utilities

  • Generate a server private key and CSR for a commercial CA

  • Generate a self-signed Certificate

  • Install the key and certificate, including intermediate CAs

  • Configure Virtual Hosting using SNI

  • Awareness of the issues with Virtual Hosting and use of SSL

  • Security issues in SSL use, disable insecure protocols and ciphers

Terms and Utilities:

  • Apache2 configuration files

  • /etc/ssl/, /etc/pki/

  • openssl, CA.pl

  • SSLEngine, SSLCertificateKeyFile, SSLCertificateFile

  • SSLCACertificateFile, SSLCACertificatePath

  • SSLProtocol, SSLCipherSuite, ServerTokens, ServerSignature, TraceEnable

This lesson is almost theory, first lets review some concepts and then we will see how secure an apache web server using them.

Encryption and Decryption

Plaintext can be every thing a message, a file, a document , ... . Then it is encrypted using and Encryption Key and we would have Ciphertext. After transfer it would be Decrypted using Decryption Key (the same same key for Encryption) and as a result we would have the original plain text. The simplest for of Encryption( as above) use the same key for Encryption and Decryption is known as Symmetric Encryption. But the security is tied up to the security of the key, if some one get access to the key the whole afforts would be useless !

A Symmetric Encryption uses a public and private key pairs. Data Encrypted with either key can be Decrypted with the other.

usually one of the keys is made public and the other one is held private and typically stored in a file, and it is self encrypted with a passphrase which is need to be supplied if the private key is to be used.

Hashes

A hash is a one-way transformation.

  • Variable lenght input , fixed lenght output.

  • Can not "Reverse Enginner" the hash back to the orginal message.

Digital Signatures

Combining Public and private key with hashes create Digital Signatures. These Digital Signatures giva us high confidence that the file we have recived really have come from the person we think come from, and has n't been modifiend either by accident or maliciously, since it was signed.

One thing to notice about all of this, is we are asuming here, that the publickey we have obtained really is the public key of the creator who originate the document whith signature we trying to check.

The Secure Socket Layer (SSL)

Digital Signatures are used in Secure Sockets Layer, which is a Layer in protocol stack, it seats above the transfor Layer, and it verifies the server identity and negotiates asymmetric session key that will be used to encrypt all the traffic between the browser and the server.

In this diagram the browser and the server first communicate trough the regular TCP/IP protocol stack and that communication is not encrypetd(Insecure path).

SSL is a Layer above the transport Layer at the both client and server end and the hand shake is preformed when the SSL connection is made, it verifies the server identity and negotiate the asymmatric session key that gives us a secure path between the browser and the server

SSL relies on the use of Digital Certificates. And basically a Digital Certificates is a collection of information identifying a site, signed by some trusted tird party certification authority. Digital certificates contain:

  • The issuer'd identity Certification Authority (CA)

  • The site's domain name and public key

  • expiry date

  • The signature of the CA

So a web site needs to obtain digital certificate inroder to be able to offer secure service.

How SSL works with Apache ?

In The linux world all of these functionalities are done by using a couple of packages.

Open SSL

Open SSL is an open-source toolkit containing command-line tools and libraries that support a wide range of cryptographic operations related to ssl.

The openssl command can be used for:

  • Creation and management of public and private keys

  • Creation of X509 certificates and certificate request

  • Calculation of message digests (hashes)

  • Encryption and decryption

The mod_ssl Module

The mod_ssl module provides SSL support for Apache.

package include:

  1. The module itself (mod_ssl.so)

  2. A config file added to /etc/httpd/conf.d

Apache Directives for SSL

The mod_ssl module supports serveral SSL-specific directives:

Directive

Meaning

SSLCertificateFile

The name of the file containing the site's digital certificate

SSLCertificateKeyFile

The name of the file containing the site's private key

SSLCipherSuite

Specifies the ciphers (encryption algorithms) that the browser may use

SSLEngine (on/off)

Enable or Disable SSL (usually within VirtualHost)

SSLRequire

Supports access control based on multiple server variables, time of day, ...

Okey enough theory, Lets Demonstrate how to make our web site secure using SSL connection. For that we could either generate private key and then create a certificate signing request (.csr) from that and then send it to a real CA to sign it(which is impossible to demostrate here), or as we would do we will create a self signed certificate and then configure apache to use that.

We will use Cent OS in this example because in ubuntu sort of setting are done. Lets quicky install apache and setup example.com:

Okey lets start with generating self signed certificates:

-nodes option means that we are not going to encrypt private key, -days 365 define expiry date. rsa stands for tha asymmetric algorithem that we are used here. And now the certificate and the key should be created:

Now we install apache module mod_ssl:

Now lets go and see mod_ssl main configuration file:

Bellow the SSL Virtual Host Content we edit our Name Virtual Host Directive :

Now lets tell apache where the Certificate File and key are :

Now every thing seems fine Lets checks the configuration for syntax errors :

ops we got an error lets fix it and restrat the service:

Finally check our web site in a secure manner:

There is an error about Certificate Validity and that is okey because we have used Self Signed Certificate.

Issues with Virtual Hosting and use of SSL

Using name-based virtual hosts with SSL adds another layer of complication. Without the SNI extension, it's not generally possible

What is The Problem ?

The problem with using named virtual hosts over SSL is that named virtual hosts rely on knowing what hostname is being requested, and the request can't be read until the SSL connection is established. The ordinary behavior, then, is that the SSL connection is set up using the configuration in the default virtual host for the address where the connection was received.

While Apache can renegotiate the SSL connection later after seeing the hostname in the request (and does), that's too late to pick the right server certificate to use to match the request hostname during the initial handshake, resulting in browser warnings/errors about certificates having the wrong hostname in them.

And while it's possible to put multiple hostnames in a modern certificate and just use that one certificate in the default vhost, there are many hosting providers who are hosting far too many sites on a single address for that to be practical for them.

Server Name Indication (SNI)

The solution is an extension to the SSL protocol called Server Name Indication (RFC 4366), which allows the client to include the requested hostname in the first message of its SSL handshake (connection setup). This allows the server to determine the correct named virtual host for the request and set the connection up accordingly from the start.

With SNI, we can have many virtual hosts sharing the same IP address and port, and each one can have its own unique certificate (and the rest of the configuration).

That seems enough for LPIC2 exam.

Previous208.1. Implementing a web serverNext208.3. Implementing a proxy server

Last updated