Diferencia entre revisiones de «Módulo SSL en Apache 2.4»
Ir a la navegación
Ir a la búsqueda
| Línea 18: | Línea 18: | ||
apache2 -M | grep ssl | apache2 -M | grep ssl | ||
| − | = | + | = Xenerar certificado autoasinado = |
sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/apache-selfsigned.key -out /etc/ssl/certs/apache-selfsigned.crt | sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/apache-selfsigned.key -out /etc/ssl/certs/apache-selfsigned.crt | ||
| + | |||
| + | ; openssl | ||
| + | : This is the command line tool for creating and managing OpenSSL certificates, keys, and other files. | ||
| + | ; req -x509 | ||
| + | : This specifies that we want to use X.509 certificate signing request (CSR) management. X.509 is a public key infrastructure standard that TLS adheres to for key and certificate management. | ||
| + | ; -nodes | ||
| + | : This tells OpenSSL to skip the option to secure our certificate with a passphrase. We need Apache to be able to read the file, without user intervention, when the server starts up. A passphrase would prevent this from happening, since we would have to enter it after every restart. | ||
| + | ; -days 365 | ||
| + | : This option sets the length of time that the certificate will be considered valid. We set it for one year here. Many modern browsers will reject any certificates that are valid for longer than one year. | ||
| + | ; -newkey rsa:2048 | ||
| + | : This specifies that we want to generate a new certificate and a new key at the same time. We did not create the key that is required to sign the certificate in a previous step, so we need to create it along with the certificate. The rsa:2048 portion tells it to make an RSA key that is 2048 bits long. | ||
| + | ; -keyout: | ||
| + | This line tells OpenSSL where to place the generated private key file that we are creating. | ||
| + | ; -out | ||
| + | : This tells OpenSSL where to place the certificate that we are creating. | ||
= Configurar virtual host para acceso seguro = | = Configurar virtual host para acceso seguro = | ||
Revisión del 11:07 26 sep 2024
Sumario
Introdución
Podemos usar o 'protocolo HTTPS (HyperText Transfer Protocol Secure) para aumentar a seguridade; basesase nunha capa de software protexida, SSL (Secure Socket Layer) ou TLS (Transport Layer Secure, sucesor de SSL), para a comunicación entre o cliente e o servidor Apache.
O protocolo de seguridade toma en conta a autenticación dos participantes a través dos certificados, o cifrado e o control da integridade dos datos intercambiados.
Emprega o well-known port 443, a diferencia de http que emprega o 80.
Habilitar módulo SSL
sudo a2enmod ssl sudo a2enmod headers
O módulo que xestiona o protocolo SSL é mod_ssl. Ten que estar configurado para ser cargado no ficheiro de configuración do servidor HTTP Apache.
NOTA. Comprobar que o módulo está instalado: apache2 -M | grep ssl
Xenerar certificado autoasinado
sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/apache-selfsigned.key -out /etc/ssl/certs/apache-selfsigned.crt
- openssl
- This is the command line tool for creating and managing OpenSSL certificates, keys, and other files.
- req -x509
- This specifies that we want to use X.509 certificate signing request (CSR) management. X.509 is a public key infrastructure standard that TLS adheres to for key and certificate management.
- -nodes
- This tells OpenSSL to skip the option to secure our certificate with a passphrase. We need Apache to be able to read the file, without user intervention, when the server starts up. A passphrase would prevent this from happening, since we would have to enter it after every restart.
- -days 365
- This option sets the length of time that the certificate will be considered valid. We set it for one year here. Many modern browsers will reject any certificates that are valid for longer than one year.
- -newkey rsa
- 2048
- This specifies that we want to generate a new certificate and a new key at the same time. We did not create the key that is required to sign the certificate in a previous step, so we need to create it along with the certificate. The rsa:2048 portion tells it to make an RSA key that is 2048 bits long.
- -keyout
This line tells OpenSSL where to place the generated private key file that we are creating.
- -out
- This tells OpenSSL where to place the certificate that we are creating.
Configurar virtual host para acceso seguro
/etc/apache2/sites-available/default-ssl.conf
<IfModule mod_ssl.c>
<VirtualHost _default_:443>
ServerAdmin your_email@example.com
ServerName server_domain_or_IP
DocumentRoot /var/www/html
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
SSLEngine on
SSLCertificateFile /etc/ssl/certs/apache-selfsigned.crt
SSLCertificateKeyFile /etc/ssl/private/apache-selfsigned.key
<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory /usr/lib/cgi-bin>
SSLOptions +StdEnvVars
</Directory>
</VirtualHost>
</IfModule>
Desactivar SSLv2 e SSLv3 (opcional)
Podemos desactivar as versións 2 e 3 de SSL por estar obsoletas:
SSLProtocol all -SSLv2 -SSLv3
Reiniciar servicio
sudo systemctl restart apache2
Uso
Acceder por https: https://server_domain_or_IP
