My personal notes on all things technical and factual....

Wed, 16 Sep 2009

/Admin/Apache/HTTPS-SSL: Desktop Apache https Quick Start

I expect to be accessing some services on my laptop via Apache over an untrusted network in the near future, so I need to turn on SSL.

As usual, turn on the Apache SSL module:

cd /etc/apache2/mods-enabled/
ln -s ../mods-available/ssl.conf .
ln -s ../mods-available/ssl.load .

and the default SSL configuration:

cd /etc/apache2/sites-enabled/
ln -s ../sites-available/default-ssl 001-default-ssl

Now restart Apache and it just works!? Apparently there is a "snakeoil" certificate already in place to get the job done. Trivial. Thank you, Debian Apache packagers.

posted at: 08:23 | path: /Admin/Apache/HTTPS-SSL | permanent link to this entry

Wed, 01 Apr 2009

/Admin/Apache/HTTPS-SSL: SSL Certificates 101

Generally speaking, it would appear that a vanilla single root SSL certificate, self-signed or otherwise, is only good for exactly one domain that corresponds exactly to the "common name" used in creating the certificate.

Some vendors[1] sell something called a "wildcard" certificate, where the common name on the certificate takes the form of "*.domain.com", and can be used to secure multiple sub-domains. Such a "wildcard" certificate, not suprisingly, seems to be considerably more expensive then a single root certificate. Apache even provides a built-in mechanism using a document root wildcard[2] for mapping each sub-domain to a different document root.

Some vendors like Godaddy[3] sell multiple domain certificates which seem to provide a discount to purchasing the same number of single root certificates.

A good source for a free certificate is cacert.org[4]. cacert.org will sign a certificate for you for a domain if your e-mail address is in the whois record for the domain (this is an automated process on their end, they verify your identity by sending you a link in an e-mail ....) The Apache website[5] has a nice concise explanation of how to create a server key and certificate signing request for cacert.org (or anyone else....)

Basically the process is[7]:

Get an account on cacert.org.
In the domains section of your cacert.org account, add the domain that you wish to issue Apache certificates for.
Use the cacert.org way[8] to generate key try.key and certificate request try.csr (note that apache.org[5] suggests a multi-step method for the same process):
openssl req -nodes -new -keyout try.key -out try.csr
In the above, you only need to enter the "Common Name" exactly the same as the sub-domain that you want the certificate to work for. All other prompts may be ignored.
Double-check the certificate request:
openssl req -noout -text -in try.csr
On the cacert.org site, select "New" in the "Server Certificates" section, and paste the contents of the above .csr file into the input box.
Then create a new certificate file (.crt) file on your server, and paste the key output by cacert.org into this file.
In the appropriate Apache VirtualHost section in /etc/apache2/sites-available/, point SSLCertificateFile at the path of your new certificate, and point SSLCertificateKeyFile at the path of the key that it was generated from (the Certificate Signing Request [.csr] is no longer needed).

cacert.org certificates seem to be good for six months. They send you an e-mail in advance of expiry.

For a particular SSL-enabled Apache virtual host, force users to always use https by placing a redirect in http virtual host, ie.:

[1] http://www.sslshopper.com/best-ssl-wildcard-certificate.html
[2] http://phaseshiftllc.com/archives/2008/10/27/multiple-secure-subdomains-with-a-wildcard-ssl-certificate
[3] http://www.godaddy.com/gdshop/ssl/ssl.asp?ci=9039
[4] https://www.cacert.org/
[5] http://httpd.apache.org/docs/2.0/ssl/ssl_faq.html#realcert
[6] http://httpd.apache.org/docs/2.0/ssl/ssl_faq.html#removepassphrase
[7] http://www.cacert.org/help.php?id=6
[8] http://www.cacert.org/help.php?id=4

posted at: 23:57 | path: /Admin/Apache/HTTPS-SSL | permanent link to this entry

/Admin/Apache/HTTPS-SSL: Multiple SSL Certificates in Apache

As I noted in an earlier post, name-based virtual hosting "seemed" to be working. "Seemed". In fact, the virtual hosts were finding the correct web root and loading the correct site, but browsers were consistently giving an error to the effect that the domain name in the certificate and the domain name the browser was pointed to were not the same.

Someone on the cacert.org e-mail list[1] set me straight:

From: Pete Stephenson
To: cacert-support@lists.cacert.org
Subject: Re: Certificate somehow associated with wrong sub-domain?

Both subdomains share the same IP address.

SSL is IP-based, rather than name-based. Specifically, when a client
connects to a server, it establishes the SSL connection prior to
sending the HTTP Host header, so the server has no idea which specific
certificate to send. Depending on the server, it may send the first
certificate mentioned in the configuration file or do something else
entirely.

You can solve this by adding multiple SubjectAltNames to a certificate
(e.g. you'd have a SAN for apps.vancouversolidcomputing.com and
another one for vsc.vancouversolidcomputing.com all in a single
certificate) and telling your server to use the same certificate for
both subdomains.

More details, including a handy shell script which can generate the
required CSR (some options, like the RSA key length are manually
configurable in the shell script; it doesn't prompt the user for the
keylength), are available here:
http://wiki.cacert.org/wiki/VhostTaskForce

Cheers!
-Pete

So what I take from this is:

If one has more then one domain to which one wants / needs to assign more then one SSL certificate, then each domain / certificate needs its own IP address for IP-based virtual hosts.
If one uses just one certificate containing multiple SubjectAltNames one can get away with only one IP address and name-based virtual hosts.

This page[2] talks about the issue in general, and the various somewhat fuzzy and partially supported options -- "Currently the different browsers, servers and CAs all implement different and incompatible ways to use SSL certificates for several VHosts on the same server" -- this situation has not been entirely standardized yet!

This page[3] seems to recommend the cacert.org way to setup Apache with the right kind of multiple SubjectAltName certificate, complete with a script[4] for generating an appropriate Certificate Request and associated key. I used the script to generate the request, and sure enough:

out comes a Certificate Request with multiple SubjectAltNames.

I then replaced *all* certificates in my Apache virtual hosts with this new certificate, ie.

SSLEngine on
SSLCertificateFile /etc/apache2/ssl/vancouversolidcomputing_crt.pem
SSLCertificateKeyFile /etc/apache2/ssl/vancouversolidcomputing_privatekey.pem

in each virtual host block for each sub-domain / web root.

The certificate now works flawlessly in Iceape (which apparently contains the cacert.org Certificate Authority information) and Internet Explorer still complains about an untrusted Certificate Authority. Neither complains about domain names not matching, which was happening before.

[3] contained several other directives in each of the SSL virtual host blocks:

UseCanonicalName On
SSLCipherSuite HIGH
SSLProtocol all -SSLv2

but I have so far found these unnecessary.

[1] https://lists.cacert.org/wws/info/cacert-support
[2] http://wiki.cacert.org/wiki/VhostTaskForce
[3] http://wiki.cacert.org/wiki/CSRGenerator
[4] http://svn.cacert.org/CAcert/Software/CSRGenerator/csr

posted at: 23:30 | path: /Admin/Apache/HTTPS-SSL | permanent link to this entry

Sat, 14 Mar 2009

/Admin/Apache/HTTPS-SSL: Turn on SSL in Apache

Turn on the SSL module:

cd /etc/apache2/mods-enabled/
ln -s ../mods-available/ssl.conf .
ln -s ../mods-available/ssl.load .
/etc/init.d/apache2 restart

In Debian, /etc/apache2/mods-enabled/ports.conf should already have logic to listen on the default port 443 if the SSL module is loaded.

Now create a self-signed certificate (tinyca is a nice simple GUI that will do the job....) Just enter minimal information, and export the newly generated cert and key to files, being careful to set the expiration date nice and long, and export the key WITHOUT a password (otherwise you will have to provide a password every time apache is restarted).

Copy the exported certificate files to your server, into directory /etc/apache2/ssl. Now create an SSL block in the Apache Virtual Host where you would like SSL. The *:80 block will respond to normal http requests, and the *:443 block will respond to https (SSL) requests:

I am not sure why the 443 block requires a NameVirtualHost line and the 80 block does not. Interestingly enough, this[2] says "Name-based virtual hosting cannot be used with SSL secure servers because of the nature of the SSL protocol", which might have something to do with it? But despite this[3] I currently HAVE got name-based virtual hosting working on SSL, unless there is something I do not understand here.

Here is a useful reference[1], in addition to the installed apache docs.

[1] http://www.debian-administration.org/articles/349
[2] http://httpd.apache.org/docs/2.2/vhosts/name-based.html
[3] http://httpd.apache.org/docs/2.2/ssl/ssl_faq.html#vhosts

posted at: 01:01 | path: /Admin/Apache/HTTPS-SSL | permanent link to this entry

Home

Contact

Resumé / C.V.

Links

Categories:

Archives:

Subscribe XML RSS Feed

Wed, 16 Sep 2009

Wed, 01 Apr 2009

Sat, 14 Mar 2009