Installing SSL Certificate for Apache - Quick HOWTO

Here is the steps for installing the SSL Certificate and CA Bundle (gd_bundle.crt) Implementing a PKCS12 Keystore for Apache:

  

1. Copy your SSL certificate file and the certificate bundle file to your Apache server. Generate the certificate file and key file using openssl  pcks12 command

openssl pkcs12 -in <domainname>.pfx -out <domainname>.c

From the generated output( <domainname>.c ), using vi copy only private key and save it as a different file ( <domainname>.key ) and the same way copy the root certificate and save it as a different file ( your-company-name.crt ) 

2. Now using the gd_bundle.crt , <domainname>.key, <domainname>.crt – Generate a keystore file. Use the following command:

openssl pkcs12 -export -chain -CAfile gd_bundle.crt -in <domainname>.crt -inkey <domainname>.key -out keystore.tomcat -name tomcat -passout pass:changeit

3. Edit your Apache configuration to reference these files.  Locate the following directives. If one or more of them are currently commented out, uncomment them by removing the '#' character from the beginning of the line. Set the values of these directives to the absolute path and filename of the appropriate file:

SSLCertificateFile /path/to/your/certificate/file

SSLCertificateKeyFile /path/to/your/key/file

SSLCertificateChainFile /path/to/intermediate/bundle/file

4. Save your configuration file and restart Apache.

Configuring SSL for Web Server (Apache)

Using SSL(Secure Socket Layer) with web server provides the Secure and Encrypted communications between web server and client. Here we are going to use OpenSSL for this.

Requirements:

  1. httpd

  2. openssl

  3. mod_ssl

  4. crypto-utils (genkey) 

crypto-utils is used to generate certificates/private keys/CSRs and also used to create a self-signed certificate.                

Steps:

  1. Install the requirements

     

     a. Install mod_ssl - module for Apache, which provides SSL support

        

         #yum -y install mod_ssl

         /etc/httpd/conf.d/ssl.conf - includes key SSL directives

     b. Install crypto-utils - provies /usr/bin/genkey

         

         #yum -y install crypto-utils

  2. Generate SSL usage keys using genkey

      

         #genkey site.example.com

     The above command creates text-gui interface. Follow the steps in the interface.

  3. Update /etc/httpd/conf.d/ssl.conf to reference the new keys (public/private)

  4. Restart the HTTPD server

      #service httpd restart

      #httpd -S

  5. Test HTTPS connectivity

      https://<Server-Name>

Note: For mutliple SSL sites, copy the: /etc/httpd/conf.d/ssl.conf file to distinct files, that match your distinct IP-based Virtual Hosts