Apache Web Server (HTTPD) on Centos 9 Linux
Installing and configuring HTTPS in the Apache Web Server (HTTPD) in Centos 9 Linux and below
How to Self-Sign the SSL Certificate
NB: This tutorial assumes you have already installed the Apache web server (HTTPD). If not, follow the step In this section
HTTPS is an extension of the Hypertext Transfer Protocol (HTTP) used for secure communication over a computer network, typically the internet. It adds a layer of security by using encryption protocols such as Transport Layer Security (TLS) or its predecessor, Secure Sockets Layer (SSL). This encryption ensures that the data exchanged between the user's web browser and the website's server is encrypted and secure from potential eavesdroppers.
openssl x509 -in key.crt -out main.cert.crt -req -signkey main.cert.key -days 365
This command takes a certificate signing request (key.crt), signs it with a specified private key (main.cert.key), and generates an X.509 certificate (main.cert.crt) with a validity period of 365 days. The resulting certificate can be used, in SSL/TLS configurations for securing web servers.
Make sure that the private key (main.cert.key) used for signing is kept secure, as compromising the private key could lead to security issues. Additionally, verify that the input file (key.crt) is indeed a valid CSR before using it to generate a certificate.
We first stop the httpd service from running because we want to edit it’s configuration file. The command “service httpd stop” stops the httpd service from running.
Make a backup of the “ssl.conf”. This will make sure that if we make a mistake in the “ssl.conf” we can simply delete it and start afresh from the backup file.
Open the “ssl.conf” using “vim /etc/httpd/conf.d/ssl.conf” and set it as shown in the figure. Make sure to find the “<VirtualHost _default_:443>” section. In there, uncomment the “DocumentRoot”, “ServerName” and the “SSLProtocol all -SSLv3” sections.
Still in the “ssl.conf” find the section with the option name “SSLCertificateFile” and put the path to where ever you stored your “main.cert.key”. Also do this for the option named “SSLCertificateKeyFile”. In this example, I generated them in the “var/www/html”. In practice, store them somewhere away from the DocumentRoot.
service httpd start
Start the httpd service using the command "service httpd start". If you get an error messsage, run the command "journalctl -xeu httpd.service". Read through and see where the configuration might not be okay. Verify that that it is using the /etc/httpd/conf.d/ssl.conf and that the configuration is as mine.
If you resolve the issues, open your browser and try a localhost connection “https://localhost” and see if it is able to open. Most browsers will throw a warning letting you know that you are connecting to a website with a self signed certificate. Click on advanced and accept the connection. This should open the connection in HTTPS using your own SSL certificate.