CentOS might well be one of the finest Linux distributions for a server environment. It is basically a mimic of Red Hat Enterprise Linux without the proprietary software and the price attached to it. With that in mind, it makes perfect sense to set CentOS up as your go-to Web server. It's reliable, it's stable, it's extensible, and it's secure.
But setting up a secure web server isn't complete without the inclusion of SSL and certificates. If you are wanting to serve up sercure web pages you will certainly want your audience to be able to send them to https instead of http. So...with CentOS how do you do that? I will show you how.
Installing all of the packages
I will assume you already have CentOS installed as well as the Apache Web Server. Make sure you are able to go to the default Apache web page (or any web page on your CentOS web server), before you set up SSL. When you have all of that working you will need to install a couple of packages. This is done with the following steps:
yum install mod_ssl openssl
.With SSL installed and ready, it's time to create your certificates for usage.
Creating your certificate
You will now have everything on your server to create CAs. You need to generate a private key, a csr, a self-signed key, and then you need to copy these files to the correct location. This is done with the following steps.
openssl genrsa -out ca.key 1024
.openssl req -new -key ca.key -out ca.csr
.openssl x509 -req -days 365 -in ca.csr -signkey ca.key -out ca.crt
.cp ca.crt /etc/pki/tls/certs
.cp ca.key /etc/pki/tls/private/ca.key
.cp ca.csr /etc/pki/tls/private/ca.csr
.Edit the Apache SSL configuration
Open the file /etc/httpd/conf.d/ssl.conf and look for the section SSLCertificateFile. Make sure that line reads:
SSLCertificateFile /etc/pki/tls/certs/ca.crt
Now look for the SSLCertificateKeyFile and make sure that section reads:
SSLCertificateKeyFile /etc/pki/tls/private/ca.key
Save that file and you are ready to restart Apache.
Restart and test
Before you try to test Apache's new SSL feature, you must restart the daemon. To do this issue the command /etc/rc.d/init.d/httpd restart. Hopefully you will see no warnings or errors. If not, then point your browser to https://ADDRESS_TO_SERVER Where ADDRESS_TO_SERVER is either the IP Address or the domain. You should then see a warning from your browser about the certificate for the site. If you see this warning congratulations, your Apache server is now ready for secure connections.
Remember, though, you created a self-signed certificate. To get the most out of SSL you might want to purchase a CA from a trusted name like Verisign (There are, of course, plenty of other places where you can purchase those certifiacates).
AdvertisementPlease click on the following link to open the newsletter signup page: Ghacks Newsletter Sign up
Ghacks is a technology news blog that was founded in 2005 by Martin Brinkmann. It has since then become one of the most popular tech news sites on the Internet with five authors and regular contributions from freelance writers.
Thanks, Jack, the section on creating the certificate is excellent.
Hi there
I followed this all the way, through but get failure messages when restarting Apache, Any ideas?
[Fri Feb 18 19:36:21 2011] [error] Unable to configure RSA server private key
[Fri Feb 18 19:36:21 2011] [error] SSL Library Error: 185073780 error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch
————-
#
# Installation.
yum install mod_ssl openssl
#
# Generate the private key
openssl genrsa -out ca.key 1024
#
# Generate the csr.
openssl req -new -key ca.key -out ca.csr
#
# Generate the self-signed key.
openssl x509 -req -days 365 -in ca.csr -signkey ca.key -out ca.crt
#
# Move the self-signed key.
cp ca.crt /etc/pki/tls/certs
#
# Move the private key.
cp ca.key /etc/pki/tls/private/ca.key
#
# Move the csr.
cp ca.csr /etc/pki/tls/private/ca.csr
#
# Edit the Apache SSL configuration.
vi /etc/httpd/conf.d/ssl.conf
#
# Change path of file.
– SSLCertificateFile /etc/pki/tls/certs/localhost.crt
+ SSLCertificateFile /etc/pki/tls/certs/ca.crt
#
# Restart Apache.
service httpd restart
Apols… left one command out ..
# Change path of server private Key.
– SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
+ SSLCertificateKeyFile /etc/pki/tls/private/ca.key
This is now in place, but I can’t get Apache to restart – just fails :-(