Hey everyone and welcome back. In the previous nugget we had discussed some of the core concepts
behind asymmetric cryptography as well as the idea of creating a certificate that can
either be verified by a certificate authority or have a self signed certificate. Now in this
nugget right here what we're actually going to do is we're going to be able to configure
our server to use SSL but in our case it's going to be a self signed certificate. So we can
actually deliver our services in that encrypted forum but anyone who was using our service would
not actually have a way to verify that indeed that we are who we say we are. Now for production
grades encryption whereby you're deploying to real clients you certainly want to go through the
process of having a signed certificate by some type of authority but for the purposes of our
little demo and for understanding the objectives of the examination creating a self signed certificate
is going to be absolutely okay for us. So with that said let's dive in and get to it then shall
we. So what I'm going to do here is I first want to show you the certificate configuration file
okay. So if I do cd and I go into my exe directory and I go into Apache 2 and I do an ls I can go
into my sites available folder okay. Now if I do an ls you will notice we actually have this default
ssl.conf file so if we have a peak within this file right here and I'll type in my passwords okay so
in here we actually have some key configurations. Now one that we absolutely want to be aware of is
this one right here the ssl engine keyword this is going to allow us to either toggle on or toggle off
our ssl configuration. So by saying ssl engine on we are enabling ssl i.e encryption for this
particular service. Now if we scroll on down we're going to see these two different keywords here
now right now they actually happen to be populated with some values but we're going to remove them
and regenerate our own certificate and private key but ultimately this is where we're going to
put this. Now this key right here or rather this keyword should I say ssl certificate file this is
going to point to our certificate that we're going to generate now again this certificate is not going
to be signed by a certificate authority but nonetheless this is where we're going to point to
so we'll generate our certificate and we'll place that value right in here or that path should I say
right in here. Now this one right here the ssl certificate key file this is going to point to
our private key now as always I really must stress when you have a private key you absolutely do not
share it with anyone you don't share it with a certificate authority you don't share it with a
friend or or anyone just don't share your private key for encryption okay that's supposed to be
private to you. Now when you happen to be dealing with certificate authorities you can also use this
ssl certificate chain file but for now we're not going to concern ourselves too much with that
right now what we're going to do is we're going to generate our public certificate as well as our
private key and we can do this using a tool known as open ssl so if I go back to my command
line right here what I'm going to do is I'm going to issued a particular command now this command
is certainly not something you're going to have to memorize just understand that using the tool
open ssl is how we can generate this and I'll walk you through what exactly it is I'm doing so I'm
going to say sudo open ssl which is the tool and then I'm going to say req for a request and then
I'm going to say dash x5 o9 now x5 o9 this is ultimately specifying that we want to have a
self signed certificate as opposed to one that would have a signing request we're just going to sign
it ourselves I'm going to say dash notes I'm then going to say days and this is how many days we want
our certificate to be valid for so I could just maybe say like a hundred days and after a hundred
days the certificate will expire it will no longer be valid now I will say new key this means that I'm
going to create a certificate as well as a new key and what I want to do is to specify the type of
key I want so I'm going to say RSA which is a type of encryption for public key cryptography this is
the revest shamir and aethelman cryptographic system and then I want to specify how large I want my
key to be so the larger the number you make the more secure the key happens to be I would just say
2048 bits and then going to say key out which is whereabouts do I want my key to reside i.e.
where will the key actually be generated I'll just put it in it's a Apache 2 and I'll call this my
private key dot key and then I will say dash out to specify whereabouts I want to create my
certificate again I'll just put it in the same location it's the Apache 2 and I'll just call
this my cert dot crt and once I hit enter it's going to ask me a bunch of questions so what is the
country name give it a code this could be us or uk I'll just see uk state of the province I'll just
hit enter city I'll just say I don't know Glasgow whatever organization name I'll just say CBTN
unit number I'll just hit enter the common name this is one we actually do want to be
remembering this is actually an important one this is where we're going to specify
the value of our server IE the domain name or the IP address of the server so I'm just going to type
in the server's IP address which is 192 1680.44 and I'll say the email address I'll just maybe say
John at ipv0.com if it may be I'm just making this up and there we go so the information I really
want to be remembering here is this part right here the common name as well as my email address here
and of course the locations of these particular files my private key as well as my cert so what I
now need to do is to tell Apache to use these SSL configurations so if I do an LS and I go back
into default SSL.conf so I'll say the server admin this is going to be John at ipv0.com doesn't
matter that this address doesn't actually exist in real life and our SSL engine is on as we can see
right here now what I'm going to add here is I'm actually going to add server name and I'll type in
the IP address of my server so 192 1680.44 now the SSL certificate file remember this is where
our certificate is going to be so I will say etse apache 2 and I think it was my cert.crt I believe
and the key file will be the private key this will be etse apache 2 if I just mashed the keypad
apache 2 and that should be my private key I believe .key okay so I'll save this and I'll go back out
so now what I want to do is I want to enable my headers modules as well as SSL so the command
that I'm going to use I'm going to say sudo and I'll say a2enmod SSL and we can see here we are
enabling module SSL I'm now going to say sudo a2enmod headers and we are enabling our module headers
clear the screen I'm now going to say sudo a2encite default hyphen SSL to enable my SSL virtual host
so now what I want to do is I want to restart my server so I'll say sudo system ctl and I will
restart apache 2 okay okay so what I will do now is I will actually go to my browser then
okay so let's log in right here type in my passwords let's go to my browser up here so if I just try
to reach over regular HTTP the unencrypted and I type in my web address we can see here we're
actually receiving the content of that web address hey there welcome to ipv0 site however if I click
on this little lock here it says the connection is not secure this is unencrypted so anyone watching
this connection could actually see what I was actually reading on this website all of this
stuff right here would be able to become visible to that attacker so this is obviously a problem
let's say I was doing banking transfers for example I don't want that to be readable so I'll try to
reach this over HTTPS if I do that add to enter notice here it's saying we have a potential security
risk ahead now this is because our browser cannot verify our certificate via a certificate authority
because like I say we happen to be using a self-signed certificate but because we happen to know this
is a self-signed certificate we did it ourselves we can just say go to advanced now we can actually
see here it says this certificate isn't trusted because it is self-signed now we can actually view
the certificate if we so wish and we can see here the information relating to the certificate the
country this is the information we actually filled in all the stuff here we can see the key the algorithm
is rsa the key size is 2048 and you know we created this certificate we know this is the one we are
expecting so what we'll do is we'll actually go back and we'll say accept the risk and continue
so now we're actually receiving the same information on this website and whilst its validity is not
absolutely secure due to the fact that this is a self-signed certificate the reality is that this
information is being served over to us using encryption it is using SSL so anyone who happens
to be eavesdropping on this communication could actually see that I was visiting this website
they could see the actual metadata so to speak but they couldn't actually see what it is I was
doing on this website they couldn't actually see say for example this message here hey there welcome
to ipv0 site that would be fully encrypted same way if I was sending bank details or whatever it may
be all of that data is going to be now encrypted okay so that is us for our basics of SSL configuration
on Apache I hope this has been informative for you and I'd like to thank you for viewing