Background:<\/h3>\n
Now, its time to configure your TLS\/SSL certificate. Why would you want to configure your own certificate, when you can get Amazon to issue a free TLS\/SSL certificate<\/a>? Well, there are more than a few use-cases that we have come across.<\/p>\n And at least a dozens other use-cases that comes to my mind, but leaving out for brevity.<\/p>\n Firstly, enable apache\u00a0 in your EC2 Instance and install\/enable ssl. – Go to\u00a0\/etc\/pki\/tls\/private\/\u00a0 and generate a new private key Assumption: It is assumed, you have launched an EC2 instance with a valid Key, configured the Security groups, Installed Apache\/Nginx and have deployed your app. Background: Now, its time to configure your TLS\/SSL certificate. Why would you want to configure your own certificate, when you can get Amazon to issue a free TLS\/SSL certificate? Well, … <\/p>\n\n
Getting Started<\/h3>\n
Self-Signed Certificates:<\/h4>\n
\n(As usual, I’ll try to give the instruction for both RPM and DEB package based distributions)<\/em>
\n[shell]sudo systemctl is-enabled httpd[\/shell]
\nThis should return “enabled” if not, enable it by typing the following,
\n[shell]sudo systemctl start httpd && sudo systemctl enable httpd [shell]sudo yum update -y [shell]sudo yum install -y mod_ssl[\/shell]
\nAnd Follow the on-screen instructions, You would have answered some basic questions like domain Name, Country, Email ID etc. And if you accepted the default locations from the prompt, you would have generated 2 files in the following locations.
\n\/etc\/pki\/tls\/private\/localhost.key – This is an auto-generated\u00a02048-bit RSA private key for your Amazon EC2 host. You can also use this key to generate a certificate signing request (CSR)\u00a0to submit to a certificate authority (CA).<\/strong>
\n\/etc\/pki\/tls\/certs\/localhost.crt – This is a self-signed X.509<\/strong> certificate for your server host. This certificate is useful only where you can control the “client” environment, like a testing or staging server.
\nNow, restart the apache
\n[shell]sudo systemctl restart httpd[\/shell]
\nAnd try https:\/\/your-aws.public.dns or https:\/\/[yourpublicip].
\nSince you’re accessing your site with a self-signed, untrusted host certificate, your browser may display a series of security warnings. But, once you added it to the exception list, you should be good to go. This would be the end of it, if you’re only looking for a certificate to be used for staging\/other controlled environments. If you want a public facing SSL, so your users\/customer can login and access this new service,<\/p>\nCA-Signed Certificate<\/h4>\n
\n[shell]sudo openssl genrsa -out virtualserver1.key 2048[\/shell]
\nThis generates an RSA key that is identical to the default key. You can generate a 4096-bit key, not use RSA<\/a>\u00a0altogether and depend on some other mathematical models as well. But those are beyond the scope of this post.
\n[bash]sudo chown root.rootvirtualserver1.key
\nsudo chmod 600 virtualserver1.key
\nls -alvirtualserver1.key [\/bash]
\nNow, you can use this key to generate a Certificate Signing Request<\/a>
\n[shell]sudo openssl req -new -keyvirtualserver1.key -out csr.pem[\/shell]
\nWhen you do this,\u00a0OpenSSL will open a series of prompts for all sorts of data, the “CommonName” is one thing which is Mandatory for your to get a certificate. All other data requested by it are optional. Once you’re done with that, you should have generated a csr.pem.<\/strong>
\nSubmit the CSR to a CA. This usually consists of opening your CSR file in a text editor and copying the contents into a web form. At this time, you may be asked to supply one or more subject alternate names (SANs) to be placed on the certificate.
\nRemove or rename the old self-signed host certificate\u00a0localhost.crt<\/code><\/strong>\u00a0from the\/etc\/pki\/tls\/certs<\/code>\u00a0directory and place the new CA-signed certificate there (along with any intermediate certificates).
\nOnce you’ve copied the contents of the .key file in the form and submitted it with your CA, you would have received an Email confirming the “Issue” of the certificate. Once its done, you can check your application in Https, now it should be with a “green padlock”. Meaning fully secure.
\nHowever, you can run a security test on your SSL, just go to SSLLabs<\/a>\u00a0and start a test by giving your URL. After about 2-5 mins, you would receive a rating and details. SOmthing similar to the following image.
\n![\"\"](\"http:\/\/35.177.175.1.xip.io\/wp-content\/uploads\/2018\/03\/Screen-Shot-2018-03-14-at-3.41.40-PM-300x119.png\")
<\/a>
\nThat’s It! You’re done.<\/p>\n","protected":false},"excerpt":{"rendered":"