RHCE 8 Quazi Mahmudul Huq
HTTPs with mod_ssl RHEL8
The mod_ssl module provides SSL v3 and TLS v1.x support for the Apache HTTP Server. This article provides you
with a basic step by step mod_ssl configuration on RHEL 8 / CentOS 8 Linux server with httpd Apache
webserver.
1. Install mod_ssl module.
The first step is to install mod_ssl module using dnf command:
2. # dnf install mod_ssl -y
3. Enable mod_ssl module.
In case that you have just installed mod_ssl , the module may not be enabled yet. To test whether mod_ssl is
enabled execute:
4. # apachectl -M | grep ssl
In case you see no output from the above command your mod_ssl is not enabled. To enable
the mod_ssl module restart your httpd Apache webserver:
# systemctl restart httpd
# apachectl -M | grep ssl
ssl_module (shared)
5. Open TCP port 443 to allow incoming traffic with htttps protocol:
6. # firewall-cmd –-zone=public –-permanent --add-service=http
7. # firewall-cmd --zone=public --permanent --add-service=https
8. success
9. # firewall-cmd --reload
success
NOTE
At this point you should be able to access your Apache webserver via HTTPS protocol. Navigate your browser
to [Link] or [Link] to confirm mod_ssl configuration.
10. Generate SSL certificate.
In case you do not already posses a proper SSL certificates for your server use the below command to generate
new self-signed certificate.
For example let's generate a new self-signed certificate for host rhel8 with 365 days expiry:
11. # openssl req -newkey rsa:2048 -nodes -keyout
/etc/pki/tls/private/[Link] -x509 -days 365 -out
/etc/pki/tls/certs/[Link]
12. Generating a RSA private key
13. ................+++++
14. ..........+++++
15. writing new private key to '/etc/pki/tls/private/[Link]'
16. -----
17. You are about to be asked to enter information that will be incorporated
18. into your certificate request.
19. What you are about to enter is what is called a Distinguished Name or a DN.
20. There are quite a few fields but you can leave some blank
21. For some fields there will be a default value,
22. If you enter '.', the field will be left blank.
23. -----
24. Country Name (2 letter code) [XX]:BD
25. State or Province Name (full name) []:Dhaka
26. Locality Name (eg, city) [Default City]:Dhaka
27. Organization Name (eg, company) [Default Company Ltd]:[Link]
28. Organizational Unit Name (eg, section) []:
29. Common Name (eg, your name or your server's hostname) []:serverX
30. Email Address []:
RHCE 8 Quazi Mahmudul Huq
After successful execution of the above command the following two SSL files will be created:
# ls -l /etc/pki/tls/private/[Link] /etc/pki/tls/certs/[Link]
-rw-r--r--. 1 root root 1269 Jan 29 16:05 /etc/pki/tls/certs/[Link]
-rw-------. 1 root root 1704 Jan 29 16:05 /etc/pki/tls/private/[Link]
# mv /etc/pki/tls/private/[Link] /etc/pki/tls/private/[Link]
# mv /etc/pki/tls/certs/[Link] /etc/pki/tls/certs/[Link]
31. Configure Apache web-server with new SSL certificates.
To include your newly created SSL certificate into the Apache web-server configuration open
the /etc/httpd/conf.d/[Link] file with administrative privileges and change the following lines:
[root]@server0 ~] # vim /etc/httpd/conf.d/[Link]
<Directory “/var/www/html/”>
require all granted
</Directory>
<Virtualhost [Link]>
ServerName [Link]
DocumentRoot /var/www/html/
SSLEngine on
all -SSLv3
SSLProtocol
SSLHonorCipherOrder on
SSLCipherSuite PROFILE=SYSTEM
SSLProxyCipherSuite PROFILE=SYSTEM
SSLCertificateFile /etc/pki/tls/certs/[Link]
SSLCertificateKeyFile /etc/pki/tls/private/[Link]
</VirtualHost>
Once ready reload the httpd Apache web-server:
# systemctl reload httpd
32. Test your mod_ssl configuration by navigating the web browser to [Link]
ip or [Link] URL.
33. As an optional step redirect all HTTP traffic to HTTPS.
To do so add following content in your configuration file:
<VirtualHost [Link]>
Servername [Link]
Redirect permanent / [Link]
</VirtualHost>
To apply the change reload the httpd daemon:
# systemctl reload httpd
The above configuration will redirect any incoming traffic
from [Link] to [Link] URL.