Changes between Version 2 and Version 3 of Securing_a_website

Timestamp:

09/09/2023 08:58:34 AM (20 months ago)

Author:

thomas

Comment:

--

Securing_a_website

@@ -142 +142 @@
 6 15 * * * /usr/bin/uacme -c /etc/uacme.d -h /usr/share/uacme/uacme.sh issue www.yourdomain.tld
 }}}
-  The argument `-h /usr/share/uacme/uacme.sh` makes uacme using a hook script to handle the output. With this, uacme can run unattended which is required when running as a cronjob.
+  The argument `-h /usr/share/uacme/uacme.sh` makes uacme using a hook script to handle the output. With this, uacme can run unattended which is required when running as a cronjob. To automate reloading any service which uses the certificates, reload them if the call to uacme terminates with result code 0:
+{{{
+6 15 * * * /usr/bin/uacme -c /etc/uacme.d -h /usr/share/uacme/uacme.sh issue www.yourdomain.tld && /path/to/reload-script.sh
+}}}
+
+== Configure Apache http
+When certificates are created they are stored in 
+- /etc/uacme.d/www.yourdomain.tld/ when using `uacme`, or
+- ??? when using `certbot`
+Apache needs to be configured to use those certificates in order to enable access to the site via `https`.
+
+Enable SSL at all by loading the ssl_module in `/etc/httpd/httpd.conf`:
+{{{
+LoadModule ssl_module /usr/lib/httpd/modules/mod_ssl.so
+...
+Include /etc/httpd/extra/httpd-ssl.conf
+...
+<IfModule ssl_module>
+SSLRandomSeed startup builtin
+SSLRandomSeed connect builtin
+</IfModule>
+}}}
+
+Now, setup SSL for the virtual hosts in `/etc/httpd/extra/httpd-ssl.conf`:
+{{{
+<VirtualHost _default_:443>
+
+#   General setup for the virtual host
+DocumentRoot "/srv/www"
+ServerName www.yourdomain.tld:443
+...
+
+#   SSL Engine Switch:
+#   Enable/Disable SSL for this virtual host.
+SSLEngine on
+
+#   Server Certificate:
+#   Point SSLCertificateFile at a PEM encoded certificate.  If
+#   the certificate is encrypted, then you will be prompted for a
+#   pass phrase.  Note that a kill -HUP will prompt again.  Keep
+#   in mind that if you have both an RSA and a DSA certificate you
+#   can configure both in parallel (to also allow the use of DSA
+#   ciphers, etc.)
+#   Some ECC cipher suites (http://www.ietf.org/rfc/rfc4492.txt)
+#   require an ECC certificate which can also be configured in
+#   parallel.
+SSLCertificateFile "/etc/uacme.d/www.yourdomain.tld/cert.pem"
+
+#   Server Private Key:
+#   If the key is not combined with the certificate, use this
+#   directive to point at the key file.  Keep in mind that if
+#   you've both a RSA and a DSA private key you can configure
+#   both in parallel (to also allow the use of DSA ciphers, etc.)
+#   ECC keys, when in use, can also be configured in parallel
+SSLCertificateKeyFile "/etc/uacme.d/private/www.yourdomain.tld/key.pem"
+...
+</VirtualHost>
+}}}
+After restarting Apache by issuing
+{{{
+/etc/rc.d/init.d/httpd restart
+}}}
+or
+{{{
+systemctl restart httpd
+}}}
+access to the website via `https` should be ok and the browser should not complain any longer about self-signed certs or something like that.