{"id":4590,"date":"2019-11-01T23:09:41","date_gmt":"2019-11-01T20:09:41","guid":{"rendered":"https:\/\/kifarunix.com\/?p=4590"},"modified":"2024-03-12T23:23:10","modified_gmt":"2024-03-12T20:23:10","slug":"configure-apache-with-ssl-tls-certificates-on-centos-8","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/configure-apache-with-ssl-tls-certificates-on-centos-8\/","title":{"rendered":"Configure Apache with SSL\/TLS Certificates on CentOS 8"},"content":{"rendered":"\n<p>Follow through this guide to learn how to configure Apache with SSL\/TLS Certificates on CentOS 8.<\/p>\n\n\n\n<p>Are you using Nginx instead? Check our guide on setting up Nginx with SSL\/TLS certificates by following the link below;<\/p>\n\n\n\n<p><a rel=\"noreferrer noopener\" aria-label=\" (opens in a new tab)\" href=\"https:\/\/kifarunix.com\/configure-nginx-with-ssl-tls-certificates-on-centos-8\/\" target=\"_blank\">Configure Nginx with SSL\/TLS certificates on CentOS 8<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Configuring Apache with SSL\/TLS Certificates on CentOS 8<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Run System Update<\/h3>\n\n\n\n<p>Update your system package by executing;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>dnf update<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Install Apache and SSL\/TLS module on CentOS 8<\/h3>\n\n\n\n<p>Apache HTTP server is provided by the <strong>httpd<\/strong> package while&nbsp;<strong><code>mod_ssl<\/code><\/strong>&nbsp;packages provides the  Apache SSL\/TLS module. Both packages can be installed by running;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>dnf install httpd mod_ssl<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Running Apache<\/h4>\n\n\n\n<p>Start and enable Apache to run on system boot.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>systemctl enable --now httpd<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Allow HTTPS on Firewall<\/h4>\n\n\n\n<p>To allow external access to Apache over HTTPS, open 443 (HTTPS) depending on the traffic to server.<\/p>\n\n\n\n<p>In this guide, since we configuring Nginx to the TLS certificates, we are opening port 443\/tcp.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>firewall-cmd --add-port=443\/tcp --permanent<\/code><\/pre>\n\n\n\n<p>If you are looking at redirecting the HTTP traffic to HTTPS, open port 80 too.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>firewall-cmd --add-port=80\/tcp --permanent<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>firewall-cmd --reload<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Generate SSL\/TLS Certificates<\/h3>\n\n\n\n<p>There are multiple options to choose from when you want to secure Apache with SSL\/TLS certificates.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>You can use self-signed certificates for test purposes.<\/li>\n\n\n\n<li>You can order for a commercially trusted server certificate from your preferred CA<\/li>\n\n\n\n<li>You can use the <strong>free<\/strong>,&nbsp;<strong>automated<\/strong>, and&nbsp;<strong>open<\/strong>&nbsp;CA, <a href=\"https:\/\/letsencrypt.org\/getting-started\/\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\"Let&#039;s Encrypt (opens in a new tab)\">Let&#8217;s Encrypt<\/a>.<\/li>\n<\/ul>\n\n\n\n<p>Well, in this guide, we are using the first option of self-signed SSL\/TLS certificates for demonstration purposes.<\/p>\n\n\n\n<p>So how do you generate the self-signed SSL\/TLS certificates on CentOS 8? Openssl command is used to generate the SSL\/TLS certificates as shown below;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>openssl req -newkey rsa:4096 -nodes -keyout \/etc\/pki\/tls\/private\/<strong>kifarunix-demo<\/strong>.key -x509 -days 365 -out \/etc\/pki\/tls\/certs\/<strong>kifarunix-demo<\/strong>.crt<\/code><\/pre>\n\n\n\n<p>So what are the openssl command line options used above?<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code><strong>req<\/strong><\/code>: It is used to create CSR as well as the  self signed certificates.<\/li>\n\n\n\n<li><strong><code>-newkey rsa:4096<\/code><\/strong>: This option creates a new certificate request and a 4096 bits RSA key at the same time.<\/li>\n\n\n\n<li><strong><code>-nodes<\/code><\/strong>: When this option is specified then if a private key is created it will not be encrypted.<\/li>\n\n\n\n<li><strong><code>-keyout<\/code><\/strong> <strong><code>\/etc\/pki\/tls\/private\/kifarunix-demo.key<\/code><\/strong>:  Writes the newly created private key to the specified filename. Replace the filename accordingly.<\/li>\n\n\n\n<li><strong><code>-x509<\/code><\/strong>: This option outputs a self signed certificate instead of a certificate request.<\/li>\n\n\n\n<li><strong><code>-days 365<\/code><\/strong>: Used to specify the validity period for the self signed certificate generated. This therefore is valid for 365 days.<\/li>\n\n\n\n<li><strong><code>-out \/etc\/pki\/tls\/certs\/kifarunix-demo.crt<\/code><\/strong>: Specifies the output filename to write the self signed certificate to.<\/li>\n<\/ul>\n\n\n\n<p>When the command runs, you are prompted to provide certificate identification details such the <strong>Country Name<\/strong> of your organization, the <strong>State<\/strong>, the <strong>Locality<\/strong>, the name of <strong>Organization<\/strong>, the <strong>Organization Unit<\/strong>, the <strong>Common Name<\/strong> (This is the most important detail), optional email.<\/p>\n\n\n\n<p>You can as well be able to provide these details on the command line using the <strong><code>-subj<\/code><\/strong> option of the <strong><code>openssl-req<\/code><\/strong> command as shown below;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>-subj \"\/C=<strong>CN<\/strong>\/ST=<strong>STATE<\/strong>\/L=<strong>CITY<\/strong>\/O=<strong>ORG NAME<\/strong>\/OU=<strong>Department<\/strong>\/CN=<strong>DOMAIN_NAME<\/strong>\/emailAddress=<strong>name@domain<\/strong>\"<\/code><\/pre>\n\n\n\n<p>For example to generate a self-signed SSL\/TLS certificate for the domain, kifarunix-demo.com and all its sub-domains (Common name will be written as <strong>*.kifarunix-demo.com<\/strong>), you can  openssl-req command as;<\/p>\n\n\n\n<p>(Replace the domain names accordingly)<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>openssl req -newkey rsa:4096 -nodes -keyout \/etc\/pki\/tls\/private\/<strong>kifarunix-demo<\/strong>.key -x509 -days 365 -out \/etc\/pki\/tls\/certs\/<strong>kifarunix-demo<\/strong>.crt \\\n<strong>-subj<\/strong> \"\/C=US\/ST=Oregon\/L=Springfield\/O=kifarunix-demo\/OU=IT\/CN=*.kifarunix-demo.com\/emailAddress=admin@kifarunix-demo.com\"<\/code><\/pre>\n\n\n\n<p>Well, there you go. Your private key has been written to <code>\/etc\/pki\/tls\/private\/<\/code><strong><code>kifarunix-demo<\/code><\/strong><code>.key<\/code> while your certificate has been written to <code>\/etc\/pki\/tls\/certs\/<\/code><strong><code>kifarunix-demo<\/code><\/strong><code>.crt<\/code>.<\/p>\n\n\n\n<p>Well, want to use commercially signed certificates? Generate the CSR and submit it to your favourite CA to order for trusted certificates.<\/p>\n\n\n\n<p>The command below can get you a CSR. Make due substitution.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>openssl req -new -newkey rsa:4096 -nodes -keyout domain.key -out domain.csr \\\n-subj \"\/C=<strong>CN<\/strong>\/ST=<strong>STATE<\/strong>\/L=<strong>CITY<\/strong>\/O=<strong>ORG NAME<\/strong>\/OU=<strong>Department<\/strong>\/CN=<strong>DOMAIN_NAME<\/strong>\/emailAddress=<strong>name@domain<\/strong>\"<\/code><\/pre>\n\n\n\n<p>Be sure to keep the key safe as you will need when installing the certificates.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Configure Apache to Use SSL\/TLS Certificates<\/h3>\n\n\n\n<p>Now that you have your SSL\/TLS private key and certificate (sel-signed in this case), proceed to configure Apache to use them.<\/p>\n\n\n\n<p>Open Apache SSL configuration file for editing.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>vim \/etc\/httpd\/conf.d\/ssl.conf<\/code><\/pre>\n\n\n\n<p>Apart from installing the SSL\/TLS certificates, there are some ciphers provided by <a rel=\"noreferrer noopener\" aria-label=\"Cipherli.st (opens in a new tab)\" href=\"https:\/\/cipherli.st\/\" target=\"_blank\">Cipherli.st<\/a> that aims to provide Strong&nbsp;SSL&nbsp;Security for all modern browsers. We will also add these ciphers to Apache SSL configuration.<\/p>\n\n\n\n<p>In this guide, we are making changes to the default SSL virtual host configuration.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>## Redirect HTTP Traffic to HTTPS\n&lt;VirtualHost *:80&gt;\n    DocumentRoot \/var\/www\/html\n    ServerName centos8.kifarunix-demo.com\n    RewriteEngine On\n    RewriteCond %{HTTPS} off\n    RewriteRule ^(.*)$ https:\/\/%{HTTP_HOST}%{REQUEST_URI} &#91;R=301,L]\n&lt;\/VirtualHost&gt;\n\n## Begin SSL configuration\n\nListen 443 https\nSSLPassPhraseDialog exec:\/usr\/libexec\/httpd-ssl-pass-dialog\nSSLSessionCache         shmcb:\/run\/httpd\/sslcache(512000)\nSSLSessionCacheTimeout  300\nSSLCryptoDevice builtin\n\n\n&lt;VirtualHost _default_:443&gt;\nErrorLog logs\/ssl_error_log\nTransferLog logs\/ssl_access_log\nLogLevel warn\nSSLEngine on\nSSLProtocol -all +TLSv1.3 +TLSv1.2\nSSLOpenSSLConfCmd Curves X25519:secp521r1:secp384r1:prime256v1\nSSLHonorCipherOrder on\nSSLCipherSuite EECDH+AESGCM:EDH+AESGCM\nSSLCertificateFile \/etc\/pki\/tls\/certs\/kifarunix-demo.crt\nSSLCertificateKeyFile \/etc\/pki\/tls\/private\/kifarunix-demo.key\n&lt;FilesMatch \"\\.(cgi|shtml|phtml|php)$\"&gt;\n    SSLOptions +StdEnvVars\n&lt;\/FilesMatch&gt;\n&lt;Directory \"\/var\/www\/cgi-bin\"&gt;\n    SSLOptions +StdEnvVars\n&lt;\/Directory&gt;\nBrowserMatch \"MSIE &#91;2-5]\" \\\n         nokeepalive ssl-unclean-shutdown \\\n         downgrade-1.0 force-response-1.0\nCustomLog logs\/ssl_request_log \\\n          \"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \\\"%r\\\" %b\"\nHeader always set Strict-Transport-Security \"max-age=63072000; includeSubDomains; preload\"\nHeader always set X-Frame-Options DENY\nHeader always set X-Content-Type-Options nosniff\nSSLCompression off\n#SSLUseStapling on\n#SSLStaplingCache \"shmcb:logs\/stapling-cache(150000)\"\nSSLSessionTickets Off\n&lt;\/VirtualHost&gt;<\/code><\/pre>\n\n\n\n<p>The Online Certificate Status Protocol (<em>OCSP<\/em>)&nbsp;stapling is disabled since we are using self-signed certificates.<\/p>\n\n\n\n<p>Save the configuration file and check for any configuration syntax.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>apachectl configtest<\/code><\/pre>\n\n\n\n<p>or<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>httpd -t<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>Syntax OK<\/code><\/pre>\n\n\n\n<p>Create sample Apache test page on the default root directory;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>vim \/var\/www\/html\/index.html<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;!DOCTYPE html&gt;\n&lt;html&gt;\n&lt;body&gt;\n&lt;h1&gt;centos8.kifarunix-demo.com&lt;\/h1&gt;\n&lt;p&gt;Configuring Apache to use SSL\/TLS certificates on CentOS 8&lt;\/p&gt;\n&lt;\/body&gt;\n&lt;\/html&gt;<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Running Apache with SSL\/TLS enabled<\/h3>\n\n\n\n<p>You can now restart Apache to effect the changes.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>systemctl restart httpd<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Testing Apache SSL\/TLS configuration<\/h3>\n\n\n\n<p>It is now time to test whether Apache is able to server HTTPS requests as well as redirect HTTP traffic to HTTPS traffic. Access it using the server&#8217;s IP address of hostname, <strong>https:\/\/server-IP-or-Hostname<\/strong>.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2019\/11\/apache-https.png\"><img loading=\"lazy\" decoding=\"async\" width=\"632\" height=\"178\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2019\/11\/apache-https.png\" alt=\"Configure Apache with SSL\/TLS Certificates on CentOS 8\" class=\"wp-image-4595\" title=\"\"><\/a><\/figure>\n\n\n\n<p>Even if you try with <strong>http:\/\/server-IP-or-Hostname<\/strong>, it will be redirected to HTTPS.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Related Tutorials<\/h3>\n\n\n\n<p><a rel=\"noreferrer noopener\" aria-label=\" (opens in a new tab)\" href=\"https:\/\/kifarunix.com\/install-redmine-with-apache-and-mariadb-on-centos-8\/\" target=\"_blank\">Install Redmine with Apache and MariaDB on CentOS 8<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/install-apache-with-self-signed-certificate-on-freebsd-12\/\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\" (opens in a new tab)\">Install Apache with Self-signed Certificate on FreeBSD 12<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/install-phpmyadmin-with-apache-on-fedora-30\/\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\" (opens in a new tab)\">Install phpMyAdmin with Apache on Fedora 30<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/remove-apache-test-page-on-fedora-30-29\/\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\" (opens in a new tab)\">Remove Apache Test Page on Fedora 30\/29<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Follow through this guide to learn how to configure Apache with SSL\/TLS Certificates on CentOS 8. Are you using Nginx instead? Check our guide on<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_lock_modified_date":false,"footnotes":""},"categories":[121,254,34,1187,253],"tags":[202,1189,1190,1142,1102],"class_list":["post-4590","post","type-post","status-publish","format-standard","hentry","category-howtos","category-apache","category-security","category-ssl-tls","category-web-servers","tag-apache","tag-apache-ssl-tls","tag-apache-ssl-tls-on-centos-8","tag-centos-8","tag-self-signed-ssl","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50"],"_links":{"self":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/4590"}],"collection":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/comments?post=4590"}],"version-history":[{"count":5,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/4590\/revisions"}],"predecessor-version":[{"id":21274,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/4590\/revisions\/21274"}],"wp:attachment":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media?parent=4590"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/categories?post=4590"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/tags?post=4590"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}