Installing an SSL certificate on Apache

May 5, 2023

Hey folks!! Today I’ll show you how to create self-signed Apache certificates. This is very important when we’re setting up our web systems and want to add an SSL certificate to our web server. In this tutorial, I’m using Ubuntu 22.04.

Creating the certificate

In the first step, we’ll create our certificate. Open your terminal and run the following command:

sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/apache-selfsigned.key -out /etc/ssl/apache-selfsigned.crt

After running the command above, some information will be displayed for you to fill in:

Now, run the command below:

sudo openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048

Configuring SSL on Apache

To use SSL on Apache, first let’s edit the ssl-params.conf file. To do that, run:

$ sudo nano /etc/apache2/conf-available/ssl-params.conf

Now, add the following snippet to the ssl-params.conf file:

# from https://cipherli.st/
# and https://raymii.org/s/tutorials/Strong_SSL_Security_On_Apache2.html
SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
SSLProtocol All -SSLv2 -SSLv3
SSLHonorCipherOrder On
# Disable preloading HSTS for now. You can use the commented out header line that includes
# the "preload" directive if you understand the implications.
#Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"
Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains"
Header always set X-Frame-Options DENY
Header always set X-Content-Type-Options nosniff
# Requires Apache >= 2.4
SSLCompression off
SSLSessionTickets Off
SSLUseStapling on
SSLStaplingCache "shmcb:logs/stapling-cache(150000)"
SSLOpenSSLConfCmd DHParameters "/etc/ssl/certs/dhparam.pem"

Back up the file /etc/apache2/sites-available/default-ssl.conf with the command:

$ sudo cp /etc/apache2/sites-available/default-ssl.conf /etc/apache2/sites-available/default-ssl.conf.bak

Now, open the file:

$ sudo nano /etc/apache2/sites-available/default-ssl.conf

Change the following information:

<IfModule mod_ssl.c>
    <VirtualHost _default_:443>
        ServerAdmin [email protected]
        ServerName server_domain_or_IP
        DocumentRoot /var/www/html
        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined
        SSLEngine on
        SSLCertificateFile /etc/ssl/apache-selfsigned.crt
        SSLCertificateKeyFile  /etc/ssl/apache-selfsigned.key
        <FilesMatch "\.(cgi|shtml|phtml|php)$">
            SSLOptions +StdEnvVars
        </FilesMatch>
        <Directory /usr/lib/cgi-bin>
            SSLOptions +StdEnvVars
        </Directory>
        BrowserMatch "MSIE [2-6]" \
            nokeepalive ssl-unclean-shutdown \
            downgrade-1.0 force-response-1.0
     </VirtualHost>
</IfModule>

Change the virtual host to redirect to HTTPS automatically, with the command:

$ sudo nano /etc/apache2/sites-available/000-default.conf

<VirtualHost *:80>
    . . .
    Redirect "/" "https://your_domain_or_IP/"
    . . .
</VirtualHost>

Apply the Apache configurations with the commands:

$ sudo a2enmod ssl
$ sudo a2enmod headers
$ sudo a2ensite default-ssl
$ sudo a2enconf ssl-params
$ sudo apache2ctl configtest

If everything is correct, this message will appear:

Now just restart Apache and run the test:

$ sudo systemctl restart apache2

💬 Comentários

Demystifying Unit Tests How to install multiple PHP versions on Ubuntu