3

I have a website, the main requirement is to make that website secure by using https

When the client access from a different machine it has to work only if the certificate had uploaded in the browser settings. If not it should deny the access to that website. Can anyone help me achieve this.

I am using Ubuntu 14.04 Let me know if you people need any more details

1 Answer 1

8

It tunrs out that the official documentation of Apache (see at this link) is really well done on this subject.

In short, you should end-up with something like this :

LoadModule ssl_module modules/mod_ssl.so

Listen 443
<VirtualHost *:443>
   DocumentRoot /var/www/yoursite/
   <Directory /var/www/yoursite/>
     AllowOverride All
     order allow,deny
     allow from all
   </Directory>

   ServerName www.example.com
   SSLEngine on
   SSLCertificateFile /path/to/www.example.com.cert
   SSLCertificateKeyFile /path/to/www.example.com.key

   SSLVerifyClient require
   SSLVerifyDepth 1
   SSLCACertificateFile /path/to/www.example.com.ca.crt
</VirtualHost>

Some details on the above

  • LoadModule ... : to load the appropriate Apache module, containing the SSL implementation
  • Listen 443 : Apache daemon will listen on the standard HTTPS port, 443
  • DocumentRoot : where the files of your site reside
  • ... : this is the definition of the options for your web site's directory (there are a lot more, the mentioned ones here are the basic one to allow access from any IP on the Internet).
  • ServerName : to serve only URL containing this name
  • SSLEngine on : activate the SSL features on this website.
  • SSLCertificateFile : path the X.509 certificate of the private key created for this server.
  • SSLCertificateKeyFile : path to the private key created for this server.
  • SSLVerifyClient require : enforce the server to ask the client for a valid certificate
  • SSLVerifyDepth 1 : must be directly signed by the CA mentioned in the next instruction
  • SSLCACertificateFile : path the X.509 certificate of the CA that signs the certificates used by the clients.

The certificates

You will have to get valid certificates, one for your server and many other for the clients.

For the server
Install OpenSSL tool, if not yet done : sudo apt-get install openssl.

With this tool, you can create the private key of the server :

openssl genrsa -des3 -out server.pass.key 2048

The above command creates a private key with a password. To be loaded automatically by your server, you have to remove the password :

openssl rsa -in server.pass.key -out server.key

You have now a valid server private key in a file, this is the file pointed by the SSLCertificateKeyFile Apache directive.

From this private key, you will create a Certificate Signed Request (CSR) :

openssl req -nodes -new -key server.key -out server.csr

You are going to be prompted to enter a set of elements (country, organization, ...). The most important one will be the Common Name (CN), it must match the hostname of your webserver, the one used in the URL. So in my example it is www.example.com.

Then, you have to submit this CSR file to your certificate provider. Any public CA is good. After they've approved your requested, they will send you the famous X.509 certificate file for your server. This file will be pointed by the SSLCertificateFile Apache's directive.

For the client
You will have to provide valid certificate to the client too.
Based on the client type (Linux, Windows, MAC, ...) the process may differ.

Sometimes, for the client certificates, all the operation can be done directly from the web browser by visiting the page of the CA registration. If done directly from the web browser, than you are sure that the certificate is automatically registered into the certificate DB of the web browser.

If done by an external means (like openssl on Linux), you will have to import the private key and certificate file into the certificate store of your web browser.

5
  • Hey Ben... Done with this configuration.. But still in client its not asking for any certificate...when I click proceed anyways its goes to the website
    – Rshrth
    Aug 14, 2014 at 10:13
  • You have configured SSLCACertificateFile, don't you ?
    – Benoit
    Aug 14, 2014 at 10:49
  • Nope.. But in client its does not ask for anything....
    – Rshrth
    Aug 14, 2014 at 11:02
  • .I am really new to this SSL thing.. Please let me how this needs to be done..if u can please share me some document Ben
    – Rshrth
    Aug 14, 2014 at 11:08
  • Don't have other configuration directive elsewhere in your Apache config that would override the Virtual Host setting ? Check in /etc/apache2/site-enabled and /etc/apache2/conf-enabled.
    – Benoit
    Aug 14, 2014 at 11:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .