Pages

Friday, February 25, 2011

Setting up SSL Certificates on Apache

Apache, imap, and exim all support ssl connections. Because I want webmail connections to be encrypted, so that passwords are not sent over the internet in plain text, I needed to create a key and a certificate for apache. For testing purposes I am going to be my own certificate authority. This will most likely be changed for the production server. You don't have to use any certificate authority - see http://www.tldp.org/HOWTO/SSL-RedHat-HOWTO.html
Note: The author of this page, and owner of this web site, is not to be held liable for any damage or trouble arrising from following these directions. You are responsible for your own security, use, and creation of certificates.
See http://www.eclectica.ca/ssl-cert-howto.php for much more information. (Much of what I cover here was learned from this page.)


Quick steps:

  1. Setup and create root certificate.
  2. Create a key and signing request.
  3. Sign the request.
  4. Copy to the correct location.
  5. Edit the apache config file.
  6. Restart apache.
  7. Tips.
The following covers the command-line way of doing it. If you are using a GUI, it should be fairly simple to follow along.
Note: I am running Red Hat Linux 8.0, apache 2.x with mod_ssl, and openssl 0.9.x. Steps vary slightly when you are using a certificate authority.

Installing Ajaxterm

To install Ajaxterm issue the following commands:

    wget http://antony.lesuisse.org/ajaxterm/files/Ajaxterm-0.10.tar.gz
    tar zxvf Ajaxterm-0.10.tar.gz
    cd Ajaxterm-0.10
    ./ajaxterm.py

Then point your browser to this URL : http://localhost:8022/


source: http://antony.lesuisse.org/software/ajaxterm/

Using netstat to Check Opened Ports

[root@server ssl]# netstat -tulpn


Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name
tcp        0      0 0.0.0.0:3306                0.0.0.0:*                   LISTEN      14552/mysqld
tcp        0      0 0.0.0.0:111                 0.0.0.0:*                   LISTEN      2973/portmap
tcp        0      0 0.0.0.0:80                  0.0.0.0:*                   LISTEN      12095/httpd
tcp        0      0 127.0.0.1:631               0.0.0.0:*                   LISTEN      3342/cupsd
tcp        0      0 0.0.0.0:5432                0.0.0.0:*                   LISTEN      3670/postmaster
tcp        0      0 0.0.0.0:5434                0.0.0.0:*                   LISTEN      3645/postmaster
tcp        0      0 0.0.0.0:668                 0.0.0.0:*                   LISTEN      3030/rpc.statd
tcp        0      0 :::22                       :::*                        LISTEN      3324/sshd
tcp        0      0 :::5432                     :::*                        LISTEN      3670/postmaster
tcp        0      0 :::5434                     :::*                        LISTEN      3645/postmaster
udp        0      0 0.0.0.0:56449               0.0.0.0:*                               3572/avahi-daemon:
udp        0      0 0.0.0.0:662                 0.0.0.0:*                               3030/rpc.statd
udp        0      0 0.0.0.0:665                 0.0.0.0:*                               3030/rpc.statd
udp        0      0 0.0.0.0:5353                0.0.0.0:*                               3572/avahi-daemon:
udp        0      0 0.0.0.0:111                 0.0.0.0:*                               2973/portmap
udp        0      0 0.0.0.0:631                 0.0.0.0:*                               3342/cupsd
udp        0      0 :::51891                    :::*                                    3572/avahi-daemon:
udp        0      0 :::5353                     :::*                                    3572/avahi-daemon: