Install the base package and enable at startup in any scenario, e.g. on CentOS,
yum install httpd mod_ssl openssl
service httpd start
chkconfig httpd on
on Ubuntu,
apt install apache2 openssl libapache2-mod-gnutls
#libapache2-mod-nss
enable paranoid dns checks so the logs actually tells you who's accessing the server,
cd /etc/httpd/conf/
cp -pi httpd.conf httpd.conf.dist
vi httpd.conf
HostnameLookups Double
disable a few default confs, e.g.,
cd /etc/httpd/conf.d/
mv welcome.conf welcome.conf.disabled
note. it may come back when updating the apache package so if it does, rather edit the file and comment out the shit.
note. same for the ssl.conf, keep it named like that or it might come back after an update.
apply,
service httpd restart
Ref. http://httpd.apache.org/docs/2.4/mod/core.html#hostnamelookups
Make some handy symlinks for operations,
cd ~/
ln -s /etc/httpd/conf
ln -s /etc/httpd/conf.d
See Preparing SSL certificates
mkdir /etc/httpd/ssl/
Just in case one doesn't have real certificates,
cd /etc/httpd/ssl/
openssl genrsa -out ca.key 2048
openssl req -new -key ca.key -out ca.csr
openssl x509 -req -days 365 -in ca.csr -signkey ca.key -out ca.crt
Ref. https://wiki.centos.org/HowTos/Https
Deploy the officially delivered SSL certificate into e.g. /etc/httpd/ssl/ (RapidSSL, Trustico, whatever...) and check the perms (folder has 700, files have 400 all owned by root, apache restarts fine),
chmod 700 /etc/httpd/ssl/
ls 400 /etc/httpd/ssl/*
ls -alhF /etc/httpd/ssl/
Setup the certs include,
cd /etc/httpd/conf/
vi certs.conf
Header always set Strict-Transport-Security "max-age=31536000; includeSubdomains;"
SSLEngine on
SSLProtocol all -TLSv1 -SSLv2 -SSLv3
SSLHonorCipherOrder on
SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4"
SSLCertificateFile /etc/httpd/ssl/certificate.crt
SSLCertificateKeyFile /etc/httpd/ssl/certificate.key
SSLCertificateChainFile /etc/httpd/ssl/issuer-concat-cert.crt
Note. SSLv2 and SSLv3 and TLSv1.0 are disabled! TLS v1.1 & v1.2 are allowed!
Allow wheeled users to read the apache logs on CentOS/RHEL,
chown -R root:wheel /etc/httpd/
chmod 750 /etc/httpd/
chmod 640 /etc/httpd/*
Setup a common config headers that globally enables SSL for all the vhosts (replacing the CentOS/RHEL ssl.conf template),
cd /etc/httpd/conf.d/
ls -lhF /usr/libexec/httpd-ssl-pass-dialog
ls -lhF /run/httpd/sslcache # will be created
ls -lhF /dev/urandom
vi 00ssl.conf
Listen 443 https
SSLPassPhraseDialog exec:/usr/libexec/httpd-ssl-pass-dialog
SSLSessionCache shmcb:/run/httpd/sslcache(512000)
SSLSessionCacheTimeout 300
SSLRandomSeed startup file:/dev/urandom 256
SSLRandomSeed connect builtin
SSLCryptoDevice builtin
Setup e.g. examplehost vhost, as root,
cd /etc/httpd/conf.d/
vi examplehost.ssl.conf
<VirtualHost *:80>
ServerAdmin user@example.com
ServerName examplehost.example.com
ServerAlias examplehost
Redirect / https://examplehost.example.com/
</VirtualHost>
<VirtualHost *:443>
Include conf/certs.conf
ServerAdmin user@example.com
ServerName examplehost
Redirect / https://examplehost.example.com/
</VirtualHost>
<VirtualHost *:443>
Include conf/certs.conf
ServerAdmin user@example.com
ServerName examplehost.example.com
ErrorLog logs/examplehost.ssl.error.log
TransferLog logs/examplehost.ssl.access.log
#CustomLog logs/examplehost.ssl.request.log "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
CustomLog logs/examplehost.ssl.request.log ssl_combined
LogLevel warn
ProxyRequests off
ProxyTimeout 300
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
<Location />
#Require ip 10.0.0.0/255.0.0.0 ::1/128
ProxyPass http://localhost:9001/
ProxyPassReverse http://localhost:9001/
</Location>
</VirtualHost>
Note. on the Require line, adding IPv6 localhost just in case we are serving IPv6...
Setup Apache SSLProxyEngine (reverse proxying an SSL enabled service): you need to add that in the vhost config,
SSLProxyEngine On
and eventually bypass the hostname mismatch caused by the container hostname which is not an fqdn and doesn't match with the world-facing address,
Error during SSL Handshake with remote server
like,
SSLProxyVerify none
SSLProxyCheckPeerCN off
SSLProxyCheckPeerName off
SSLProxyCheckPeerExpire off
Ref. stackoverflow.com/questions/18872482/error-during-ssl-handshake-with-remote-server
Make sure apache is up and running,
netstat -antpe --inet --inet6 | grep LISTEN | egrep "80|443"
service httpd restart
(provide the pass phrase if there is one)
netstat -antpe --inet --inet6 | grep LISTEN | egrep "80|443"
Eventually check the quality of your SSL setup:
Proxy modules: