Having signed our certificate request and sent it back to the Ubuntu system, we
can now work on Ubuntu. We can copy the ubuntu certificate and the myca.crt into
the correct location for Apache, so etc/ssl/certs. This is the directory that we
were using before for the public keys.
We can also then copy the myca.crt, just the CA certificate, through
to our usr/local/share/ca‑certificates directory.
This is the location that we use on Ubuntu systems to update our
certificate database. Once we've added the file in there, we run
the update‑ca‑certificates command.
We don't need any additional options. And on Ubuntu, this
works in a much more verbose manner,
giving us some feedback about the updates it's actually carried out.
With that done and dusted, our clients then running on the system are
able to trust the certificate authority.
And remember, every client should trust a certificate authority.
The final stage is to update the HTTPS configuration.
We've already set the SSLCertificateFile,
the SSLCertificateKeyFile, but we now need to set the SSLCertificateChainFile.
This should then have all of the trusted certificates that
are being used. For us, it's only the CA, but if it were
the CA and the intermediary, they must be combined into a single file.
Having configured the change, we restart the apache2 web server, and we
should be good to go. Because our client now trusts the certificate
authority, we're able then to use our command line browser to browse
through to our website uninterrupted by errors saying that we do not trust
their certificates because we now do.
And it's at this stage we must bid goodbye to the slides and start
moving out configuring HTTPS on Ubuntu, so reconfiguring the SSL file on
Ubuntu to use the certificate authority and making sure then that our
client database is updated so that any of our clients, such as w3m,
trust our certificate authority.
Finally, we can restart Apache and test. And congratulations
and welcome through to our command line.
We're working as root on the Ubuntu system.
We know we've copied the files across, but if we go through and list
the temp directory we can see then the myca.crt.
And we're more interested in the ubuntu.crt, the signed certificate.
We need to copy these two CRT files.
We can go through and use /tmp/ubuntu.crt /tmp/myca.crt. And we're going to
put them into the etc directory structure, ssl/certs.
This is the directory that we're using before.
So they've been copied across.
And that's where we've configured our Apache server to
look for the Ubuntu certificate.
We need to also configure it to look for the CA certificate in this directory.
But any of our clients need the trust relationship set up. The correct
location for the CA certificate on Ubuntu is slightly different to where
we had it on our AlmaLinux system. We can copy this across, so
/tmp/myca.crt, CA certificate, and we're going to add it through to
/usr/local/share/ca‑certificates.
So this is where we put the raw files. We can copy across into this location
once they've been copied across. As before, we need to then update the
database. To do that, it's the same command update‑ca‑certificate, but we
don't need to worry about any options for this.
And also, it's a little bit more friendly and it gives feedback.
The RedHat‑based command didn't give feedback, but we can see now
that we've added one additional file through to the database, so at
least we've got this positive feedback that something good has
happened. And we added one file.
We're expecting one file to be added.
So this is really good.
I like this. Next though,
even though we've copied the files into the right location,
we need to tell our web server to use the trusted root certificate.
So if we go through and open up the SSL configuration, so
etc/apache2, looking in our sites‑available and the default‑ssl
site is the one that we were using. We can see that we had left off
before on our SSLCertificateKeyFile, but if we move down,
we can see that there's an SSLCertificateChainFile.
This should have all of the trust relationships that's in place. Now for
us, we're not using any intermediaries, so it's very easy then to just add
in the certificate from the root authority, so /etc/ssl/certs/myca.crt.
With that done and dusted, we can go through and save the file and restart
our Apache web server.
This then should be everything complete.
Our Apache configuration is complete and our client trust relationship is there,
which means then that we can use w3m to browse through to our HTTPS website on
ubuntu. We're using the correct hostname, and we can see that we get straight
in using SSL without having to accept any warning about the self‑signed
certificate and the untrusted relationship.
We now have a CA signed certificate and a CA that is trusted by this client.
But remember, we do need to make sure that all of the clients
accessing this will have the trusted root certificate, which
is then good for internal hosts.
Not so good if public people need to access the website because it's
not so easy to update their client database. But certainly a great
option and definitely a feasible option for an internal HTTPS website
such as we're using here. Now we've concentrated on command line
configuration; however,
there are some very good graphical tools available on openSUSE, and we're going to take a quick look at those now.