web security

All posts tagged web security

SSL: 02 Installing a self-signed SSL certificate

Posted by Kulani Mahadewa on January 28, 2016
Posted in: ssl. Tagged: , , , , . 1 Comment

Hi ! 🙂 This is the second part of SSL guide. After obtaining the keys you can followed up to installing the keys on apache and do the changes in the virtual hosts and test your web site with https.

Step 5: Copying the private key and the certificate to etc/apache2/ssl

Command: cp server.crt /etc/apache2/ssl/server.crt
Command: cp server.key /etc/apache2/ssl/server.key
keyandcert

Step 6: Configuring apache to use SSL

You will need to edit the ‘default-ssl’ configuration file which resides in etc/apache2/sites-avaiable directory.

5#

  • Change the ServerAdmin your_email, ServerName: domain_name or common_name, DocumentRoot: path to the web site content.

9

  • Change the path to —>  SSL certificate and server key
11

Step 7: Enable the default-ssl configuration

You can use following commands interchangeably while enabling the proper configuration on your server.

Check already enabled site settings:

Command: a2dissite

Disable site settings:

Command: sudo a2dissite default-ssl

Enable site settings:

Command: sudo a2ensite default-ssl

Each time you need to restart the server to apply the config changes:

Command: sudo service apache2 restart
restart

Step 8: Testing the site with SSL on browser

You will see tha padlock sign with https://domain_name_or_common_name

17

Now click on the padlock icon and go to “view certificate”.  You will the data that you entered when creating the CSR request there.

16

*Note: Sometimes you may see partially encrypted pages with https:// . The reason is the page may content images or other content with http.

error

error details

Cheers ! 🙂

 

 

 

SSL: 01 Creating a self-signed SSL certificate

Posted by Kulani Mahadewa on January 28, 2016
Posted in: ssl. Tagged: , , , , . Leave a comment

SSL (Secure Socket Layer) is a standard protocol, ensuring a trusted connection between a client and a server. A web site that is secured with SSL, encrypts the sensitive data passed between the browser (client) and the web server. If your web site is serving the public and if it does process sensitive data like credit card details, personal info, authentication data, etc then you will have to get a certificate from a third party trusted CA (Certificate Authority). If otherwise you just need a certificate for testing purpose or your web site has a small trusted audience, then of course this guide may useful. 🙂

The disadvantage comes with a self-signed certificate is that, when you try to browse your page with https it will display a message on the browser saying “This connection is Untrusted”, since browser only trust a list of CAs that are already stored in.

12#

I will briefly state here the steps to create a self-signed certificate for your website. I am working with Apache server on Ubuntu.

Step 1: Enable SSL support comes with apache

Command: sudo a2enmod ssl

Each time you do a change in configurations , restart the apache server to apply the changes.

Command: sudo service apache2 restart
0

Step 2: Generate private server key

You will have to give a password in this step and that password should be remembered to use in next steps.

Command: openssl genrsa -des3 -out server.key 1024
2

Step 2: Generate Certificate Signing Request (CSR)

In creating CSR process, you will be asked for several question. The important information here is the Common Name (N) which you should give the ‘domain name’ of your web site. If you are purchasing a Certificate from a CA, this csr request should be sent to the 3rd partY CA. Since i am doing local development common name (CN) will be “localhost”.

Command: openssl req -new -key server.key -out server.csr
3
Step 3: Removing pass-phrase of server key

Removing the pass-phrase of server key, so that you won’t need to enter it every time the apache server restart. The server key will not contain the pass-phrase anymore with this command.

Command: cp server.key server.key.org

Command: openssl rsa -in server.key.org -out server.key
4

Step 4: Generate Certificate using .csr

This will generate a X.509 certificate. So this is the self-signed certificate that we were looking for. 🙂

Command: openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
6#

For Installing…
See the guide: SSL: 02 Installing a self-signed SSL certificate

Cheers ! 🙂