Apache Web Server Ssl

| Posted on by



An easy-to-use secure configuration generator for web, database, and mail software. Simply select the software you are using and receive a configuration file that is both safe and compatible. Mozilla SSL Configuration Generator. SSL provides for secure communication between client and server by allowing mutual authentication, the use of digital signatures for integrity and encryption for privacy. The protocol is designed to support a range of choices for specific algorithms used for cryptography, digests and signatures.

Secure WebSocket over TLS is strongly recommended for use in production environments and prevents data sniffing or modification from the time the data is submitted through the WebSocket protocol to the time it's received by the end-user.

Apache web server self signed certificate

This article will step you through the process of setting up secure WebSockets through HTTPS using an Apache webserver.

Create and Install your SSL Certificate

An SSL certificate is required for the WebSocket WSS (WebSocket Security) protocol to work in production environments that use the HTTPS protocol for the website. If your website uses an SSL certificate, you'll be required to use the WSS protocol for secure communications. There is no way around this.

Make sure that you create and install your SSL certificate first. If you've already completed this step, you can move onto the remaining WebSocket setup steps below.

Configure a Secure WebSocket in Apache

Thankfully, Apache has made this super simple to set up performing a few quick configuration updates and the ProxyPass and ProxyPassReverse directives.

To start, we'll need to enable the mod_proxy module in Apache with the following command-line command:

Next, we'll need to load up the Apache configuration file that contains your virtual hosts. This is generally located in the following server directory:

Once you've found and opened the Apache configuration file, we'll need to load the mod_proxy module somewhere above your listing of virtual hosts:

Map the Secure WebSocket to a Proxy

Finally, we'll be using the ProxyPass and ProxyPassReverse directives to map the WebSocket data transferred to the correct location for anyone within your website or application that's listening.

Let's assume that our WebSocket connection will take place at the following URL:

Since the /wss directory technically doesn't exist on our server, we'll need to map it to a secure port using a proxy inside our Apache virtual host node for our website:

You'll notice that a port is assigned to the ProxyPass and ProxyPassReverse directive URL's. Make sure that the port you select is available for use and that there are no restrictions to that port on your server. Some hosting providers close off most of your server's ports by default for security reasons and will require you to manually set up or request to allow access.

Restart Your Apache Webserver

To restart your Apache webserver, use the following command-line command:

If no errors were found in your Apache configuration during the webserver restart, you should not see any error messages reported in the command-line console and all should be working as expected.

Conclusion

At this point, our secure WebSocket for HTTPS configuration should be set up successfully on our server.

As an example, you can tie this configuration together by creating a chat room with JavaScript to see how the client-side and server-side pieces work together.

Ubuntu with Apache is the easiest way to accomplish this. If anyone needs instructions on how to set this up in a Windows environment, let me know and I'll put something together.

Here is a short note on how to configure Apache to use a certificate file for SSL or How to enable https in Apache httpd server. After you enable SSL in the web server configuration, you should be able to access the application using https.

Install The mod_ssl Plugin

1. Make sure that mod_ssl is installed.

2. If mod_ssl is not installed, install it using yum:

Edit SSL Certificate And Keys

1. Edit /etc/httpd/conf.d/ssl.conf with the filenames of the server name and SSL Certificate information. The parameters to be edited are
a. ServerName
b. SSLCertificateFile
c. SSLCertificateKeyFile

Install Apache Web Server Windows

Here,
– The ServerName must match the Common Name (CN) of the SSL certificate, or client browsers will get a “domain mismatch” message. To view the certificate Common Name (CN):

Apache Web Server Download

– The SSLCertificateKeyFile is the private key associate with the certificate (the public key).
– Verify that the Listen directive in ssl.conf is correct for your setup. For example, if an IP address is specified, it needs to match the ip address the httpd service is bound to.

Restart the Apache webserver

For the changes to take effect we must restart the Apache webserver.
For CentOS/RHEL 5,6

For CentOS/RHEL 7

Verify SSL connectivity from the command line

There are several tools available to test the SSL connectivity. Depending on what needs to be tested, use any of the methods described below.

1. OpenSSL s_client

Use ‘openssl s_client -connect TARGET:PORT‘ to test & troubleshoot SSL/TLS connections to a target server. To test a webserver on the standard port:

Apache Web Server Tutorial

2. cURL

Apache Web Server Setup

This tool is often the first choice as it allows you to quickly change between the http and https protocols.