HTTP is a clear text protocol, which means that it's not secure. Anyone between the source and the destination 1
can sniff the traffic and see confidential data. 2
In this lecture, I'll show you how to secure Apache and enable HTTPS to encrypt the communication 3
between the server and the clients using OpenSSL and digital certificates. HTTPS means HTTP over SSL 4
which is HTTP Secure 5
This set up consists of two parts: getting a digital certificate from a certificate authority for the 6
server and configuring the Apache web server to use the certificate and encrypt the connections 7
to the clients using OpenSSL and other cryptographic protocols. 8
There are many certificate authorities known as CA, that facilitated the obtaining of a digital certificate 9
for your web or e-mail server. 10
In this lab, we’ll use Let’s Encrypt as a Certificate Authority because it offers a free certificate 11
for your website. 12
It also simplifies the process by providing a software client called the Cerbot that attempts 13
to automate the most of the required steps. 14
Currently, the entire process of obtaining and installing a certificate is fully automated on both 15
a Apache and Ngnix. 16
I'm opening a second ssh connection to the server in a new terminal window. 17
Let's get started by installing a Certbot and a Python plugin. 18
So apt update && apt install certbot and python3-certbot 19
-apache 20
The later package integrates certbot with Apache making it possible to obtain a new certificate 21
and to configure HTTPS on the server automatically. 22
OK, I've misspelled its name its certbot. 23
Once the installation process is finished, I'll run a command to request the Certificate Authority 24
to issue a certificate for our domain crystalmind.academy. 25
So certbot -d and the domain 26
The name of the domain should be the one set up in the Apache virtual host file. 27
The domain specified in this file! 28
This will use the Apache plug in; the entire process of getting the certificate and configuring Apache 29
to use it is fully automatic. 30
The wizard will prompt us to answer a series of questions in order to configure the SSL certificate. 31
First, it will ask us for a valid email address that will be used for the renewal notifications as 32
well. 33
I haven't set up an e-mail server for the domain yet, so I'm writing a random email address: webmaster 34
@crystal 35
mind.academy 36
In the next step, we have to agree to " Let’s Encrypt terms of service" 37
Next, we’ll be asked if we would like to share the email with the Electronic Frontier Foundation 38
to receive news and other information. 39
And it's generating the certificate and configuring Apache. 40
This is a very important step. 41
We are prompted to select whether or not we want HTTP traffic redirected to HTTPS. 42
In practice, that means when someone visits our website through an unencrypted connection using http, 43
they will be automatically redirected to the https address of our website. 44
It's a good idea to redirect http to https because the user will access the website using its http address 45
when he writes the name of the domain in the address bar of the browser. Almost no one writes https 46
by hand. 47
So I'm choosing the second option. 48
Redirect. 49
And it's done! If there are any errors, see the logs, in /var/ log/ let'sencryp/ let's 50
encrypt. 51
log, this is the log file. 52
Certbot has requested the certificate, created a new virtual host file for Apache to use https, loaded 53
the certificate into Apache and reloaded it. 54
It did a lot of work. 55
Let's reload the website using https; I'm writing https by hand. 56
So https:// 57
And it's working! We see a lock before the domain name in the address bar which indicates HTTPS. If 58
you want to see the certificate, click on the lock certificate 59
and details and you see here all the details about the certificate. 60
Who is the issuer, 61
when was it issued, its validity and many more. 62
Now, let's access the http version of the website to check that it's directed correctly to htts. So I am writing 63
http:// and the name of the domain. 64
So I'm not writing https by hand. 65
And it was redirected to https. 66
We see the lock. 67
And we notice that even though we've accessed the hhtp version of the website, Apache redirected us 68
to https. 69
This is https because we see this padlock. 70
The connection is secure. 71
Let's take a look at what the Certbot script has done. 72
So it has created this virtual host file for the https domain. 73
This one! Let's see its contents! 74
We see that the port used is 443 and the digital certificate and the private key 75
are found in these files. 76
It has also enabled the OpenSSL module. The configuration directives are in this file. 77
The script has also enabled the virtual host, which means creating a sym link in site- enabled. 78
Look, this is the sym link! 79
At the end of this lecture, let's check if auto renewal is configured correctly. By default, Let’s Encrypt 80
certificates are only valid for 90 days. 81
This is to ensure that the misused certificates or stolen keys will expire at some point. 82
The Certbot tool we’ve just run takes care of the renewal process by including a service that runs 83
twice a day and renews any certificates that expire. To check the status of this service and make sure 84
it's active and running run systemctl 85
status certbot.timer and it's activ. 86
And to test the renewal proces run certbot renew 87
--dry 88
-run 89
It's only testing the renewal process. 90
And all renewals succeeded. 91
OK, that's all! In this lecture 92
we've seen how to get a digital certificate from Let's Encrypt, enable OpenSSL on Apache and configure 93
HTTPS to encrypt the connections between the clients and the server.