HOWTO APACHE HTTP SSL SERVER

APACHE HTTP SSL SERVER ON RHEL 5

Author Marian Sanchez
Date 2007-06-05

Overview

What is Apache-SSL?
Apache-SSL is a secure Webserver, based on Apache and SSLeay/OpenSSL.
What provides Mod_ssl to Apache Web Server?
Strong cryptography using the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols

Highlights

The feature highlights of mod_ssl are the following:

Open Source software.
Useable for both commercial and non-commercial use
Available for both Unix and Win32 platforms 128-bit strong cryptography world-wide
Support for SSLv2, SSLv3 and TLSv1 protocols
Support for both RSA and Diffie-Hellman ciphers
Clean reviewable ANSI C source code
Clean Apache module architecture
Integrates seamlessly into Apache through an Extended API (EAPI)
Full Dynamic Shared Object (DSO) support
Support for the OpenSSL+RSAref US-situation
Advanced pass-phrase handling for private keys
X.509 certificate based authentication for both client and server
X.509 certificate revocation list (CRL) support
Support for per-URL renegotiation of SSL handshake parameters
Support for explicit seeding of the PRNG with external sources
Additional boolean-expression based access control facility
Backward compatibility to other Apache SSL solutions
Inter-process SSL session cache (DBM or Shared Memory based)
Powerful dedicated SSL engine logging facility
Simple and robust application to Apache source trees
Fully integrated into the Apache 1.3 configuration mechanism
Additional integration into the Apache Autoconf-style Interface (APACI)
Assistance in X.509v3 certificate generation (both RSA and DSA

Requirements

*Apache Web Server already Installed.
*OpenSSL library already installed.
*Mod_SSL already installed.

Implementation

Step one - create the key and request:
openssl req -new > new.cert.csr

Step two - remove the passphrase from the key (optional):
openssl rsa -in privkey.pem -out new.cert.key

Step three - convert request into signed cert:
openssl x509 -in new.cert.csr -out new.cert.cert -req -signkey new.cert.key -days 365

The Apache-SSL directives that you need to use the resulting cert are:
SSLCertificateFile /path/to/certs/new.cert.cert
SSLCertificateKeyFile /path/to/certs/new.cert.key

How do I create a client certificate?

Step one - create a CA certificate/key pair, as above.
Step two - sign the client request with the CA key:
openssl x509 -req -in client.cert.csr -out client.cert.cert -signkey my.CA.key -CA my.CA.cert -CAkey my.CA.key -CAcreateserial -days 365
Step three - issue the file 'client.cert.cert' to the requester.

The Apache-SSL directives that you need to validate against this cert are:

SSLCACertificateFile /path/to/certs/my.CA.cert
SSLVerifyClient 2
How do I access client certs from my CGI?
In release apache_1.3.2+ssl_1.27 and above, you can use the directive:
SSLExportClientCertificates

Which will create environment variables containing the contents of client certs. For more details, see the SSLExportClientCertificates section in the docs.There is also a working example at: https://www.apache-ssl.org/cgi/cert-export.

After the certificate is created, we saved them inside one DIR and chmod it to allow only root had access to that particular DIR for security reasons.
chmod 400 /etc/ssl/midominio.org/server.*

Marian Sanchez