So, yes, a really big and important demonstration now coming up,
where we start configuring SSL.
So we're going to be creating that self‑signed certificate,
modifying the default, and restarting the web server.
Essentially we're looking at everything that we saw on that slide,
but of course we're able now to break it down a little bit more.
The idea of having the slide as well,
is it gives you that written information that you
could always make reference to.
So here we are, and we're still root on our Ubuntu server,
and we need to go through and start taking a look at our configuration.
Now to understand the Ubuntu configuration of Apache,
I've already gone ahead and installed the tree command. And the
tree command gives me an easy way to be able to list the
hierarchy of the Apache configuration,
which is quite immense when we look at it on Ubuntu.
So listing then etc and apache2, we can see that we've got a myriad of files.
To understand this perhaps a little bit better,
although we won't get the color output, if I just look at,
say, the end of this,
we can see we've got a sites‑available directory and a sites‑enabled,
and it's in the enabled directories that we have symbolic links to sites
which have been configured in the available directory.
Now this is carried forward into the way that we see it within,
let's say, our modules and configurations as well.
They're all configurations to a degree, but they just break them up separately.
Now the way these links are managed within Ubuntu is that we use the a2,
apache2, enmod, enable a module configuration,
and then the name of the configuration, so this is ssl.
We don't need to worry with .conf or anything like that at the end.
So we can then go through and see what we need to do,
and it tells me we need to restart the apache2 server.
I'm going to leave that at the moment, so we're going to make further changes.
But this process will have gone through and created a
symbolic link from the modules‑enabled directory back
through to our modules‑available.
I can go through and take a look at this with the ls etc and apache,
and if we look in the mods‑enabled, we have a whole heap of symbolic links.
Now, of course,
just the straightforward listing is not showing me where they're pointing to,
but I can go through and add in the ls ‑l,
and this will do a long listing, and of course in my long listing,
I'm able to see where the files are pointing to.
And we've got the ssl.conf and the ssl.load,
and that's then pointing through to the files within
the mods‑available subdirectory,
so it becomes a relatively simple mechanism for getting this up and running.
However, we of course need to do a little bit of work,
and the first start of our work is digging into our openssl command.
We're making a certificate request, req,
using an x509 certificate request, ‑nodes.
It's not nodes, it's no‑des, so we're not putting a password on our private key.
The idea of that is the server wouldn't be able to add it in on startup.
We can specify the number of days that we want this to be valid for.
We're putting 365 days a year.
Be wary of putting anything longer than a year.
Many browsers won't take a certificate that lasts longer than a year.
So a brand‑new key that we are creating,
and we're creating it to the standards of a 2048‑bit RSA key,
and we're generating that key, so the ‑keyout,
this is the private key,
and we're pointing it through to /etc/ssl and the private subdirectory.
We can give it any name that we want, but we're going to call it ubuntu.key.
We're just going to extend onto a new line so it's easier to read.
And then we have ‑out, so this is then our signed certificate request.
This acts as our public key.
It's self‑signed, signed by our own private key,
and we can go through and see that we're putting this into /etc/ssl/certs,
and ubuntu.crt.
We can hit the big Enter key on this,
and we're then prompted with our little wizard.
The only thing we really need to be aware of with this,
especially when we're using it for our own benefit,
is just making sure we have the correct Common Name,
so this is going to be the name that is used by our clients to access it.
So we're then putting in ubuntu, and I'm not bothering with anything else.
I can leave them at the default or empty.
With that done,
if I go through and take a look inside of my ssl and private directory,
we can see then the ubuntu.key, but along with it we have the ssl‑cert‑snakeoil,
the default private key.
Looking inside the certs directory, there's a lot more,
because I have certificate authority public keys here,
as well as the public key for the ubuntu.crt that I generated and the
snakeoil public key which was generated by the system.
Now we do need to do a little bit of editing.
Use whichever editor you want.
I happen to be using Vim.
And we're going through into then etc and apache2
and sites‑available, so, again, concentrating on the available directory,
because that's where the actual files that we will
link to are going to be created.
There is the default‑ssl.conf, and we can then move down,
and the first thing that we're going to add into this is make
sure that we've got the ServerName directive.
Our ServerName, then again, is going to be the name based around our certificate.
Often it's going to be a fully qualified domain name,
but we're just putting in our name of ubuntu.
I can tidy up some of this information,
so I'm just going to delete some of these lines that are
commented so it's easier for us to see.
So we can see I'm just deleting lines.
These are all commented.
The comments are not necessarily bad, but they're representing default settings.
I'm going to leave it at this now because I've come to the two
lines that I want to be able to work with, our
SSLCertificateFile and our CertificateKeyFile.
Again, we can see they are pointing through to the default, snakeoil.
We can then go through and remove that snakeoil.
That's a good idea, isn't it?
Would you trust snakeoil?
So we're going to go through and put in ubuntu.crt as our
certificate file, that's the public key. And for our private
key, we can go through and put our ubuntu.key. And that's it,
that's our configuration done.
Obviously there's more configuration that can be done, but we'll look
at this as we go through, but it's more going to relate to when we have
a certificate authority working with us.
Now we've then changed the original file, so we need to enable the site
to create the symbolic link back to this file in the sites‑enabled
directory. And we can then just put default‑ssl as a site to enable.
That's created a symbolic link for me. It's saying to reload the apache2
server, but it doesn't know that we have to restart from the changes
that we made before.
Now when we go through and do a listing of ports, we can see that
port 80 is up and running, along with port 443. So that's the change
that we can see. The apache now is listening on the https port. We
can verify that that is working.
If I go through to ubuntu and 443, we have to accept the
self‑signed certificate and we have to say yes twice.
Some browsers won't allow you to connect to self‑signed certificates, so
just be careful. Firefox does, if you want to use a graphical browser. If I
put in, though, an invalid hostname, a hostname that doesn't match the
certificate, I get the same warning as self‑signed certificate, but my
secondary warning that I have to accept now, and I have to accept this, is
that we've got a bad cert identifier. The certificate has ubuntu, but we're
using the local hostname. So I get two warnings that I have to accept if I
go through two localhosts, so the importance of matching the common name to the hostname that we're going to use to access our system.