linux_wiki:configure_tls_security

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision 		Previous revision
linux_wiki:configure_tls_security [2018/04/09 23:30]
billdozor [Lab Setup] 		linux_wiki:configure_tls_security [2019/05/25 23:50] (current)
Line 30: Line 30:
 Create a key and certificate with openssl - check syntax Create a key and certificate with openssl - check syntax
 <code bash> <code bash>
-cat /etc/pki/tls/certs/make-dummy-cert+cat /etc/pki/tls/certs/make-dummy-cert | grep answer
 </code> </code>
   * This line contains the syntax you are looking for: answers | /usr/bin/openssl req -newkey rsa:2048 -keyout $PEM1 -nodes -x509 -days 365 -out $PEM2 2> /dev/null   * This line contains the syntax you are looking for: answers | /usr/bin/openssl req -newkey rsa:2048 -keyout $PEM1 -nodes -x509 -days 365 -out $PEM2 2> /dev/null
Line 37: Line 37:
 Create a key and certificate with openssl Create a key and certificate with openssl
 <code bash> <code bash>
-openssl req -newkey rsa:2048 -keyout /etc/pki/tls/private/myvhost.example.com.key -nodes -x509 -days 365 -out /etc/pki/tls/certs/myvhost.example.com.crt+openssl req -newkey rsa:2048 -keyout /etc/pki/tls/bluesite.key -nodes -x509 -days 365 -out /etc/pki/tls/bluesite.crt
 </code> </code>
 +
 +\\
 +Prompts from the openssl cert create
 +<code bash>
 +Country Name (2 letter code) [XX]:US
 +State or Province Name (full name) []:Here
 +Locality Name (eg, city) [Default City]:Right
 +Organization Name (eg, company) [Default Company Ltd]:Ur Co
 +Organizational Unit Name (eg, section) []:
 +Common Name (eg, your name or your server's hostname) []:bluesite.example.com
 +Email Address []:
 +</code>
 +  * For the purposes of the lab, the 'Common Name' (website name) is really the only important part.
  
 ---- ----
Line 44: Line 57:
 ====== Configuring a Site with a TLS Certificate ====== ====== Configuring a Site with a TLS Certificate ======
  
-Edit virtual host file and add a tcp/443 listen entry+Edit virtual host file and add a tcp/443 listen entry for bluesite
 <code bash> <code bash>
-vim /etc/httpd/conf.d/myvhost.conf+vim /etc/httpd/conf.d/vhosts.conf
  
 <VirtualHost *:443> <VirtualHost *:443>
-  ServerAdmin admin@myvhost.example.com +  ServerAdmin admin@bluesite.example.com 
-  DocumentRoot /var/www/html/myvhost +  DocumentRoot /var/www/html/bluesite 
-  ServerName myvhost.example.com:443 +  ServerName bluesite.example.com 
-   + 
-  SSLCertificateFile /etc/pki/tls/certs/testsite.example.com.crt +  SSLEngine On 
-  SSLCertificateKeyFile /etc/pki/tls/certs/testsite.example.com.key +  SSLCertificateFile /etc/pki/tls/bluesite.crt 
-   +  SSLCertificateKeyFile /etc/pki/tls/bluesite.key 
-  ErrorLog logs/myvhost-ssl-error_log + 
-  CustomLog logs/myvhost-ssl-access_log combined+  ErrorLog logs/bluesite-ssl-error_log 
 +  CustomLog logs/blusite-ssl-access_log combined
 </VirtualHost> </VirtualHost>
 </code> </code>
Line 77: Line 91:
 Visit the secure site Visit the secure site
 <code bash> <code bash>
-https://testsite.example.com+https://bluesite.example.com
 </code> </code>
  
Line 86: Line 100:
 Redirect http to https. Redirect http to https.
  
-Option 1: Using mod_rewrite+\\ 
 +Option 1: Using Redirect (**Apache documentation recommends this method**)
 <code bash> <code bash>
 <VirtualHost *:80> <VirtualHost *:80>
-  ServerName myvhost.example.com +  ServerName bluesite.example.com 
-   + 
-  RewriteEngine on +  Redirect / https://bluesite.example.com/
-  RewriteRule ^(/.*)$  https://%{HTTP_POST}$1 [redirect=301]+
 </VirtualHost> </VirtualHost>
 </code> </code>
  
 \\ \\
-Option 2: Using Redirect+Option 2: Using mod_rewrite
 <code bash> <code bash>
 <VirtualHost *:80> <VirtualHost *:80>
-  ServerName myvhost.example.com +  ServerName bluesite.example.com 
- +   
-  Redirect / https://myvhost.example.com/+  RewriteEngine on 
 +  RewriteRule ^(/.*)$  https://%{HTTP_POST}$1 [redirect=301]
 </VirtualHost> </VirtualHost>
 </code> </code>
  • linux_wiki/configure_tls_security.1523331059.txt.gz
  • Last modified: 2019/05/25 23:50
  • (external edit)