Changes between Initial Version and Version 1 of NspwUprouse/Agenda/https

Timestamp:

Sep 5, 2021, 11:39:25 AM (3 years ago)

Author:

admin

Comment:

--

NspwUprouse/Agenda/https

@@ +1 @@
+= HTTPS =
+
+= With Self-Signed Certificates =
+
+In this Lab, we will install a web server (Apache2) and enable HTTPS using self-signed SSL certificates. Lab session has to be done in the Ubuntu VM.
+
+== Install Apache2 == 
+
+Apache is a web server application that is widely used on the internet for more than 20 years, and it is a well-documented piece of Free and Open Source Software managed by the Apache Foundation.
+(https://httpd.apache.org/)
+
+Before installing, we need to update our repositories. Therefore we will first add the Debian apache repo to our list and update the list. Since we will be using Sudo commands, It will ask you for your user's password as these processors will be granted root privileges.
+{{{
+sudo add-apt-repository ppa:ondrej/apache2
+}}}
+
+When Asked, press ‘Enter’ to Continue. Once the PPA is imported, do an update.
+{{{
+sudo apt-get update
+}}}
+
+Once the repo lists are updated run,
+{{{
+sudo apt-get install apache2
+}}}
+
+When asked, press '''Y''' and hit '''Enter''' to continue, and the installation will proceed.
+
+Check installed apache version details by issuing,
+{{{
+$ apache2 -v
+}}}
+
+Now go to your host machine. Open a web browser and type the IP address of your Ubuntu VM. You will get the Apache default page.
+
+== Self-Signed Certificate ==
+
+Use the following command to create the certificate and the key.
+{{{
+sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/apache_prv.key -out /etc/ssl/certs/apache_crt.crt
+}}}
+You will be asked series of questions; answer them carefully.
+{{{
+Country Name (2 letter code) [AU]:LK
+State or Province Name (full name) [Some-State]:Kandy
+Locality Name (eg, city) []:Peradeniya
+Organization Name (eg, company) [Internet Widgits Pty Ltd]:YourInst
+Organizational Unit Name (eg, section) []:IT Team
+Common Name (e.g. server FQDN orYOUR name) []:
+Email Address []:info@yourname.ac.lk
+}}}
+Once finished, it will create two files in '''/etc/ssl'''. Private will be saved as apache_prv.key, and certificate will be saved as apache_crt.crt
+
+== Configure apache ==
+
+let us create virtual host files for the web
+{{{
+sudo nano /etc/apache2/sites-available/lab.conf
+}}}
+
+Include the following
+{{{
+<IfModule mod_ssl.c>
+    <VirtualHost _default_:443>
+         ServerAdmin admin@yourname.ac.lk
+         ServerName <FQDN of your website>
+         DocumentRoot /var/www/html
+         <Directory /var/www/html>
+                  Require all granted
+         </Directory>
+         ErrorLog ${APACHE_LOG_DIR}/error.log
+         CustomLog ${APACHE_LOG_DIR}/access.log combined
+         SSLEngine on
+         SSLCertificateFile      /etc/ssl/certs/apache_crt.crt
+         SSLCertificateKeyFile /etc/ssl/private/apache_prv.key
+         <FilesMatch "\.(cgi|shtml|phtml|php)$">
+                  SSLOptions +StdEnvVars
+         </FilesMatch>
+         <Directory /usr/lib/cgi-bin>
+                  SSLOptions +StdEnvVars
+         </Directory>
+         </VirtualHost>
+</IfModule>
+}}}
+
+Now enable this site and SSL by
+{{{
+sudo a2enmod ssl
+sudo a2ensite lab.conf
+}}}
+
+Try browsing from your host machine https://<IP address of the Ubuntu VM>, and you will be warned about the untrusted connection as it is a self-signed authentication.
+
+
+= HTTPS with Let's Encrypt =
+
+Prior to enabling HTTPS via let's encrypt, you need to satisfy the following;
+
+* You have public IP connectivity.
+* Both HTTP and HTTPS are enabled from firewall/s.
+* HTTP site is working. If you have multiple webserver virtual hosts, make sure the '''!ServerName''' attribute in every host config file is correctly populated.
+* Proper DNS values are assigned to your IP address.
+
+Follow the guideline from the official certbot. (These steps can change time to time, so always refer the original site.)
+
+{{{
+https://certbot.eff.org/lets-encrypt/ubuntufocal-apache
+}}}