With a secure web server, clients can connect to your server
secure in the knowledge both that it is who it claims to be and that the
transaction is well-encrypted so their data is safe.
SSL (Secure Sockets Layer) is a protocol for
cryptographically securing transactions between a web browser and a web server.
In most cases, only the server end is authenticated, which means that the
client has a guarantee that the server is who it claims to be, but not vice
versa.
This article shows you how to launch a web server with SSL.
We choose Apache and Tomcat.
Creating a Certificate
The first step is certificate creation. To get a certificate
signed by a CA such as Verisign, you first need to create a keypair and a
certificate request:
$ openssl req -new -newkey rsa:4096 -keyout key.pem
-out csr.pem
The command will therefore generate a key (private key) and
certificate request (public key inside, pem format), but not a certificate.
Note
You can create your certificate either with or without a
passphrase. The major disadvantage of using a passphrase is that it must be
typed every time the web server starts up. So it won't start unattended or
automatically on boot, for example, after a power cut. Depending on your setup,
this may or may not be significant for you. To clear the passphrase, you can
use this command:
openssl rsa -in key.pem -out server.key
Note
PEM is a X.509 certificate (whose structure is defined using
ASN.1), encoded using the ASN.1 DER (distinguished encoding rules), then run
through Base64 encoding and stuck between plain-text anchor lines (BEGIN
ENCRYPTED PRIVATE KEY and END ENCRYPTED PRIVATE KEY, BEGIN CERTIFICATE REQUEST and
END CERTIFICATE REQUEST, BEGIN CERTIFICATE and END CERTIFICATE).
The next stage, then, is to send that csr.pem file to the
CA. The CA will sign your CSR and serve back the certificate. The certificate
is save as file server.crt.
Configuring Apache 2 with SSL
1.
Make sure the mod_ssl is installed in Apache. Please
check whether the file exists.
/etc/httpd/modules/mod_ssl.so
2.
If the OS is Centos, please run the following
command to install mod_ssl.
# yum install mod_ssl
3.
Upload your private key server.key and
certificate server.crt to your Linux server.
/etc/httpd/certs/server.crt
/etc/httpd/certs/server.key
4.
Edit /etc/httpd/conf.d/ssl.conf, change the path
of certificate and key.
Default settings:
SSLCertificateFile
/etc/pki/tls/certs/localhost.crt
SSLCertificateKeyFile
/etc/pki/tls/private/localhost.key
Change it to:
SSLCertificateFile /etc/httpd/certs/server.crt
SSLCertificateKeyFile
/etc/httpd/certs/server.key
5.
Restart the apache, and visit the site via
https://www.yourdomain.com/
Note
If your apache server is not dedicated server for one
domain/website, you need to configure the VirtualHost for each website. The
certificate of each website should be specified in <VirtualHost>. The
sample of
www.gtdreport.com is listed
below.
<VirtualHost 173.255.218.15:443>
DocumentRoot /var/www/gtd
ServerName www.gtdreport.com:443
SSLEngine on
SSLCertificateFile /etc/httpd/certs/server.crt
SSLCertificateKeyFile /etc/httpd/certs/server.key
ErrorLog logs/gtdreport-error_log
CustomLog logs/gtdreport-access_log combined
</VirtualHost>
Configuring Tomcat with SSL
It is very easy. Please edit this file:
TOMCAT_HOME/conf/server.xml. Add the content like this:
<Connector keystoreType="PKCS12"
port="443"
maxHttpHeaderSize="8192"
maxThreads="150"
minSpareThreads="25" maxSpareThreads="75"
enableLookups="false" disableUploadTimeout="true"
acceptCount="100" scheme="https"
secure="true"
clientAuth="false" sslProtocol="TLS"
keystoreFile="/etc/server.pkcs12"
keystorePass="changeit" />
The problem is how to get the file server.pkcs12. Please run
the following command:
$ openssl pkcs12 -export -in server.crt -inkey
key.pem -out server.pkcs12
You need to input password for key.pem, and input password (
keystorePass) that is used to protect server.pkcs12.
Self-Signed Certificate
Perhaps you cannot get a certificate signed by CA, you can also create self-signed certificate.
Please see this page:
Java-Rep2excel with SSL
The Java-Rep2excel v1.64 supports SSL.
Please edit the
rep2excel.properities, add the ssl configuration.
# Sample for SSL
# sslPort, optional.
# keystoreFile, required, path
of keystore file. for example: C:\\certificate-gtdreport\\server.jks
# keystoreType, required,
options: JKS/JCEKS/PKCS12/BKS/UBER
#
#sslPort=443
#keystoreFile=server.pkcs12
#keystorePass=changeit
#keystoreType=PKCS12
About the Author
Williams Voon, experienced java programmer. Chief system
analyst of the 3 software: Rep2excel, EasyHA System Monitoring Tool. GTD Excel
Report Server.
