Sweshi's Tutorials

Installing and configuring HTTPS in the Apache Web Server (HTTPD) in Centos 9 Linux and below

What HTTPS (Hypertext Transfer Protocol Secure)?

HTTPS is an extension of the Hypertext Transfer Protocol (HTTP) used for secure communication over a computer network, typically the internet. It adds a layer of security by using encryption protocols such as Transport Layer Security (TLS) or its predecessor, Secure Sockets Layer (SSL). This encryption ensures that the data exchanged between the user's web browser and the website's server is encrypted and secure from potential eavesdroppers.

SSL Certificates

SSL (Secure Sockets Layer) certificates are digital certificates that provide authentication for a website and enable encrypted communication between the user's browser and the web server. These certificates are issued by Certificate Authorities (CAs), which are trusted third-party entities responsible for verifying the identity of the certificate holder.

SSL Certificates contain the following information:
  • Public Key: This is used for encrypting the data sent between the server and web browser.
  • Certificate Holder's Identity: Information about the organization or individual to whom the certificate is issued.
  • Certificate Issuer: The Certificate Authority that issued the certificate.
  • Validity Period: The period during which the certificate is considered valid.
Why SSL Certificates Need to Be Signed

The process of signing an SSL certificate involves you or the Certificate Authority digitally signing the certificate with its private key. In this tutorial, we show how to self sign the certificate but it is recommended to use a Certificate Authority as it is more secure. Web browsers are also likely to throw warning messages when certificates are self signed so for a production web server, use a Certificate Authority to sign the certificate or even completely generate it for you. This creates a digital signature that can be verified using the CA's public key. The act of signing serves several crucial purposes:

  • Authentication:When a user's browser connects to a website, it receives the SSL certificate. The browser can verify the authenticity of the certificate by checking the digital signature against the public key of the issuing CA. This ensures that the website is who it claims to be.
  • Integrity: The digital signature also ensures the integrity of the certificate. If any part of the certificate is tampered with during transmission, the signature verification will fail, indicating potential foul play.
  • Trust: By relying on trusted Certificate Authorities, users can trust that the information in the SSL certificate is accurate. Browsers come pre-installed with a list of trusted CAs, and certificates signed by these CAs are automatically trusted.