SSL, Secure Socket Layer is a protocol created in order to place normal traffic between server and client in encrypted and protected wrapper, without any possibility of traffic being intercepted in between of transmission. SSL certificates encrypt a site information and create more secure and trusted connection. Certificates can show server's identification information to site visitors. Certificates Authorities like DigiCert , GoDaddy can issue the self-signed SSL certificates that verify the server information. In this guide I will cover how to create a self-signed SSL certificates for Apache on an Ubuntu Server which will encrypt traffic to your server. As we are generating SSL certificates are for testing purpose and not issued by any Certificates Authorities it will not provide third party validation of your server identity, but still it will help you to transfer information securely.
Prerequisites:
You need a Ubuntu server and a user with root / sudo privileges. You also need a Apache web server installed if its not there you can use following command to install Apache.
$ sudo apt-get update
$ sudo apt-get install apache2
Step 1: Enable SSL module in Apache:
In order to setup SSL certificates in Apache web server we need to enable the pre-installed Apache module. To enable SSL module in Apache use below command.
$ sudo a2enmod ssl
Once you enable the module we need to restart the Apache server for changes to be applied. Use below command to restart Apache:
$ sudo service apache2 restart
Now our server is ready to setup SSL.
Step 2: Generate a Self-Signed Certificates:
We will create a new directory where we will store server key and certificates.
$ sudo mkdir /etc/apache2/ssl
First you generate the keys for the Certificate Signing Request (CSR)
$ cd /etc/apache2/ssl
$ sudo openssl genrsa -des3 -out yourdomain.pkey 2048
It will prompt you to enter passphrase. Its up to you to enter a passphrase or not. If you do, every time you restart the Apache service you will ask for this passphrase. We will enter a passphrase and then will create a 'insecure' key from 'secure' one. Create a insure key without a passphrase form a secure key yourdomain.pkey.
$ sudo openssl rsa -in yourdomain.pkey -out yourdomain.key
And now we will create a CSR from the key file. With the CSR and key file a self-signed certificate can be generated.
$ sudo openssl req -new -key yourdomain.key -out yourdomain.csr
Once enter will ask you number of questions one most important is Common Name use your domain or IP of you server as a value.
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:US
State or Province Name (full name) [Some-State]:New York
Locality Name (eg, city) []:NYC
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Organization Pvt. Ltd
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:yourdomain.com
Email Address []:webmaster@yourdomain.com
Once we have CSR and key file now we can generate a self-signed certificate using following command
$ sudo openssl x509 -req -days 365 -in yourdomain.csr -signkey yourdomain.key -out yourdomain.crt
Now that we have all our necessary certificates and key file available, now we can configure Apache to use these in VirtualHost. Next, add an entry to /etc/apache2/ports.conf for the domain you'll be using to host your SSL-enabled site.
NameVirtualHost yourdomain.com:443
Now create a Apache configuration file with VirtualHost entry for your site. Create a file yourdomain-ssl with below contain in /etc/apache2/site-available/folder of Apache.
<VirtualHost yourdomain.com:443>
SSLEngine On
SSLCertificateFile /etc/apache2/ssl/yourdomain.crt
SSLCertificateKeyFile /etc/apache2/ssl/yourdomain.key
ServerName http://www.yourdomain.com
ServerAlias yourdomain.com
DocumentRoot /var/www/yourdomain
<Directory /var/www/yourdomain>
Options Indexes FollowSymLinks MultiViews
AllowOverride All
Order allow,deny
allow from all
</Directory>
</VirtualHost>
Step 4 : Permanent Redirection to https :
To redirect your site permanently to https we will edit the VirtualHost entry for for 80 port which is in a file yourdominin /etc/apache2/site-available folder of Apache, or else create one with below contain.
<VirtualHost *:80>
ServerName http://www.yourdomain.com
ServerAlias yourdomain.com
DocumentRoot /var/www/yourdomain
Redirect / https://www.yourdomain.com
</VirtualHost>
Or else you can create .htaccess file in your site root folder for permanent redirection to https with below contain
RewriteEngine On
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} ^yourdomain\.com$ [NC]
RewriteRule ^ https://www.yourdomain.com%{REQUEST_URI} [L,R=301]
Step 5 : Test your Apache config and activate the VirtualHost :
It is always a good practice to check your Apache configuration for any error before we activate the VirtualHost and restart the Apache service, cause Apache will not start if your configuration file has some errors. Run below command to test configuration
$ apachectl configtest
If your configuration is right then activate the VirtualHost using below command
$ sudo a2ensite yourdomain // Simple http configuration file
$ sudo a2ensite yourdomain-ssl // SSL configuration file
Now, restart the Apache service for changes to take effect
$ sudo service apache2 restart
Step 5 : Test your Setup :
Now, that we have everything prepared and done you can try visiting your server domain name or public IP using the https protocol like this https://yourdomin.com. You will get a security warning from browser regarding your server identity because we are using self-signed certificates and it has been not signed by any certificate authority that browser trust.
Since this is expected you can move ahead, hit 'Proceed Anyway' button. Once Added Security Exception for your browser you will taken to the your site this time with encrypted traffic, check the SSL configuration by clicking on lock icon in address bar.
Hope you find this tutorial helpful. Feel free to ask questions! Don't forget to like or to leave a comment if its really help you.
