Free Software – sponsorable.co Download Configure Apache To Use Https

Configure Apache To Use Https

Configure apache for wordpress

These directives are placed at global scope (i.e., not within a virtual host definition) wherever other global SSL configuration directives are placed, such as in conf/extra/httpd-ssl.conf for normal open source builds of httpd, /etc/apache2/mods-enabled/ssl.conf for the Ubuntu or Debian-bundled httpd, etc.

SSL certificates. CAST highly recommends the use of a trusted CA (Certificate Authority) SSL certificate when configuring Apache Tomcat for secure https access. You can use a self-signed SSL certificate, however, it is not recommended since unpredictable results may occur when using CAST dashboards with this type of certificate. Configure Apache Configuration files for Apache are located within the /etc/httpd/conf.d/ directory. Any file with the.conf extension is processed in alphabetical order in addition to the module configuration files in /etc/httpd/conf.modules.d/, which contains any configuration files necessary to load modules.

–>

By Shayne Boyer

Using this guide, learn how to set up Apache as a reverse proxy server on CentOS 7 to redirect HTTP traffic to an ASP.NET Core web app running on Kestrel server. The mod_proxy extension and related modules create the server”s reverse proxy.

Prerequisites

  • Server running CentOS 7 with a standard user account with sudo privilege.
  • Install the .NET Core runtime on the server.
    1. Visit the Download .NET Core page.
    2. Select the latest non-preview .NET Core version.
    3. Download the latest non-preview runtime in the table under Run apps – Runtime.
    4. Select the Linux Package manager instructions link and follow the CentOS instructions.
  • An existing ASP.NET Core app.

At any point in the future after upgrading the shared framework, restart the ASP.NET Core apps hosted by the server.

Publish and copy over the app

Configure the app for a framework-dependent deployment.

If the app is run locally and isn”t configured to make secure connections (HTTPS), adopt either of the following approaches:

  • Configure the app to handle secure local connections. For more information, see the HTTPS configuration section.
  • Remove https://localhost:5001 (if present) from the applicationUrl property in the Properties/launchSettings.json file.

Run dotnet publish from the development environment to package an app into a directory (for example, bin/Release/<target_framework_moniker>/publish) that can run on the server:

The app can also be published as a self-contained deployment if you prefer not to maintain the .NET Core runtime on the server.

Copy the ASP.NET Core app to the server using a tool that integrates into the organization”s workflow (for example, SCP, SFTP). It”s common to locate web apps under the var directory (for example, var/www/helloapp).

Note

Under a production deployment scenario, a continuous integration workflow does the work of publishing the app and copying the assets to the server.

Configure a proxy server

A reverse proxy is a common setup for serving dynamic web apps. The reverse proxy terminates the HTTP request and forwards it to the ASP.NET app.

A proxy server forwards client requests to another server instead of fulfilling requests itself. A reverse proxy forwards to a fixed destination, typically on behalf of arbitrary clients. In this guide, Apache is configured as the reverse proxy running on the same server that Kestrel is serving the ASP.NET Core app.

Because requests are forwarded by reverse proxy, use the Forwarded Headers Middleware from the Microsoft.AspNetCore.HttpOverrides package. The middleware updates the Request.Scheme, using the X-Forwarded-Proto header, so that redirect URIs and other security policies work correctly.

Any component that depends on the scheme, such as authentication, link generation, redirects, and geolocation, must be placed after invoking the Forwarded Headers Middleware.

Forwarded Headers Middleware should run before other middleware. This ordering ensures that the middleware relying on forwarded headers information can consume the header values for processing. To run Forwarded Headers Middleware after diagnostics and error handling middleware, see Forwarded Headers Middleware order.

Invoke the UseForwardedHeaders method at the top of Startup.Configure before calling other middleware. Configure the middleware to forward the X-Forwarded-For and X-Forwarded-Proto headers:

Configure apache tomcat to use https

If no ForwardedHeadersOptions are specified to the middleware, the default headers to forward are None.

Proxies running on loopback addresses (127.0.0.0/8, [::1]), including the standard localhost address (127.0.0.1), are trusted by default. If other trusted proxies or networks within the organization handle requests between the Internet and the web server, add them to the list of KnownProxies or KnownNetworks with ForwardedHeadersOptions. The following example adds a trusted proxy server at IP address 10.0.0.100 to the Forwarded Headers Middleware KnownProxies in Startup.ConfigureServices:

For more information, see Configure ASP.NET Core to work with proxy servers and load balancers.

Install Apache

Update CentOS packages to their latest stable versions:

Install the Apache web server on CentOS with a single yum command:

Sample output after running the command:

Note

In this example, the output reflects httpd.86_64 since the CentOS 7 version is 64 bit. To verify where Apache is installed, run whereis httpd from a command prompt.

Configure Apache

Configuration files for Apache are located within the /etc/httpd/conf.d/ directory. Any file with the .conf extension is processed in alphabetical order in addition to the module configuration files in /etc/httpd/conf.modules.d/, which contains any configuration files necessary to load modules.

Create a configuration file, named helloapp.conf, for the app:

The VirtualHost block can appear multiple times, in one or more files on a server. In the preceding configuration file, Apache accepts public traffic on port 80. The domain www.example.com is being served, and the *.example.com alias resolves to the same website. For more information, see Name-based virtual host support. Requests are proxied at the root to port 5000 of the server at 127.0.0.1. For bi-directional communication, ProxyPass and ProxyPassReverse are required. To change Kestrel”s IP/port, see Kestrel: Endpoint configuration.

The VirtualHost block can appear multiple times, in one or more files on a server. In the preceding configuration file, Apache accepts public traffic on port 80. The domain www.example.com is being served, and the *.example.com alias resolves to the same website. For more information, see Name-based virtual host support. Requests are proxied at the root to port 5000 of the server at 127.0.0.1. For bi-directional communication, ProxyPass and ProxyPassReverse are required. To change Kestrel”s IP/port, see Kestrel: Endpoint configuration.

Configure Apache2 To Use Https

Warning

Failure to specify a proper ServerName directive in the VirtualHost block exposes your app to security vulnerabilities. Subdomain wildcard binding (for example, *.example.com) doesn”t pose this security risk if you control the entire parent domain (as opposed to *.com, which is vulnerable). For more information, see rfc7230 section-5.4.

Logging can be configured per VirtualHost using ErrorLog and CustomLog directives. ErrorLog is the location where the server logs errors, and CustomLog sets the filename and format of log file. In this case, this is where request information is logged. There”s one line for each request.

Save the file and test the configuration. If everything passes, the response should be Syntax [OK].

Restart Apache:

Monitor the app

Apache is now set up to forward requests made to http://localhost:80 to the ASP.NET Core app running on Kestrel at http://127.0.0.1:5000. However, Apache isn”t set up to manage the Kestrel process. Use systemd and create a service file to start and monitor the underlying web app. systemd is an init system that provides many powerful features for starting, stopping, and managing processes.

Create the service file

Create the service definition file:

An example service file for the app:

In the preceding example, the user that manages the service is specified by the User option. The user (apache) must exist and have proper ownership of the app”s files.

Use TimeoutStopSec to configure the duration of time to wait for the app to shut down after it receives the initial interrupt signal. If the app doesn”t shut down in this period, SIGKILL is issued to terminate the app. Provide the value as unitless seconds (for example, 150), a time span value (for example, 2min 30s), or infinity to disable the timeout. TimeoutStopSec defaults to the value of DefaultTimeoutStopSec in the manager configuration file (systemd-system.conf, system.conf.d, systemd-user.conf, user.conf.d). The default timeout for most distributions is 90 seconds.

Some values (for example, SQL connection strings) must be escaped for the configuration providers to read the environment variables. Use the following command to generate a properly escaped value for use in the configuration file:

Colon (:) separators aren”t supported in environment variable names. Use a double underscore (__) in place of a colon. The Environment Variables configuration provider converts double-underscores into colons when environment variables are read into configuration. In the following example, the connection string key ConnectionStrings:DefaultConnection is set into the service definition file as ConnectionStrings__DefaultConnection:

Colon (:) separators aren”t supported in environment variable names. Use a double underscore (__) in place of a colon. The Environment Variables configuration provider converts double-underscores into colons when environment variables are read into configuration. In the following example, the connection string key ConnectionStrings:DefaultConnection is set into the service definition file as ConnectionStrings__DefaultConnection:

Save the file and enable the service:

Start the service and verify that it”s running:

With the reverse proxy configured and Kestrel managed through systemd, the web app is fully configured and can be accessed from a browser on the local machine at http://localhost. Inspecting the response headers, the Server header indicates that the ASP.NET Core app is served by Kestrel:

View logs

Since the web app using Kestrel is managed using systemd, events and processes are logged to a centralized journal. However, this journal includes entries for all of the services and processes managed by systemd. To view the kestrel-helloapp.service-specific items, use the following command:

For time filtering, specify time options with the command. For example, use --since today to filter for the current day or --until 1 hour ago to see the previous hour”s entries. For more information, see the man page for journalctl.

Data protection

The ASP.NET Core Data Protection stack is used by several ASP.NET Core middlewares, including authentication middleware (for example, cookie middleware) and cross-site request forgery (CSRF) protections. Even if Data Protection APIs aren”t called by user code, data protection should be configured to create a persistent cryptographic key store. If data protection isn”t configured, the keys are held in memory and discarded when the app restarts.

If the key ring is stored in memory when the app restarts:

  • All cookie-based authentication tokens are invalidated.
  • Users are required to sign in again on their next request.
  • Any data protected with the key ring can no longer be decrypted. This may include CSRF tokens and ASP.NET Core MVC TempData cookies.

To configure data protection to persist and encrypt the key ring, see:

Secure the app

Configure firewall

Firewalld is a dynamic daemon to manage the firewall with support for network zones. Ports and packet filtering can still be managed by iptables. Firewalld should be installed by default. yum can be used to install the package or verify it”s installed.

Use firewalld to open only the ports needed for the app. In this case, ports 80 and 443 are used. The following commands permanently set ports 80 and 443 to open:

Reload the firewall settings. Check the available services and ports in the default zone. Options are available by inspecting firewall-cmd -h.

HTTPS configuration

Configure the app for secure (HTTPS) local connections

The dotnet run command uses the app”s Properties/launchSettings.json file, which configures the app to listen on the URLs provided by the applicationUrl property (for example, https://localhost:5001;http://localhost:5000).

Configure the app to use a certificate in development for the dotnet run command or development environment (F5 or Ctrl+F5 in Visual Studio Code) using one of the following approaches:

  • Replace the default certificate from configuration (Recommended)
  • Replace the default certificate from configuration (Recommended)

Configure the reverse proxy for secure (HTTPS) client connections

Warning

The security configuration in this section is a general configuration to be used as a starting point for further customization. We”re unable to provide support for third-party tooling, servers, and operating systems. Use the configuration in this section at your own risk. For more information, access the following resources:

  • Apache SSL/TLS Encryption (Apache documentation)

To configure Apache for HTTPS, the mod_ssl module is used. When the httpd module was installed, the mod_ssl module was also installed. If it wasn”t installed, use yum to add it to the configuration.

To enforce HTTPS, install the mod_rewrite module to enable URL rewriting:

Modify the helloapp.conf file to enable secure communication on port 443.

Add Https To Apache

The following example doesn”t configure the server to redirect insecure requests. We recommend using HTTPS Redirection Middleware. For more information, see Enforce HTTPS in ASP.NET Core.

Note

For development environments where the server configuration handles secure redirection instead of HTTPS Redirection Middleware, we recommend using temporary redirects (302) rather than permanent redirects (301). Link caching can cause unstable behavior in development environments.

Adding a Strict-Transport-Security (HSTS) header ensures all subsequent requests made by the client are over HTTPS. For guidance on setting the Strict-Transport-Security header, see Enforce HTTPS in ASP.NET Core.

Note

This example is using a locally-generated certificate. SSLCertificateFile should be the primary certificate file for the domain name. SSLCertificateKeyFile should be the key file generated when CSR is created. SSLCertificateChainFile should be the intermediate certificate file (if any) that was supplied by the certificate authority.

Apache HTTP Server version 2.4.43 or newer is required in order to operate a TLS 1.3 web server with OpenSSL 1.1.1.

Note

The preceding example disables Online Certificate Status Protocol (OCSP) Stapling. For more information and guidance on enabling OCSP, see OCSP Stapling (Apache documentation).

Save the file and test the configuration:

Restart Apache:

Additional Apache suggestions

Restart apps with shared framework updates

After upgrading the shared framework on the server, restart the ASP.NET Core apps hosted by the server.

Additional headers

To secure against malicious attacks, there are a few headers that should either be modified or added. Ensure that the mod_headers module is installed:

Secure Apache from clickjacking attacks

Clickjacking, also known as a UI redress attack, is a malicious attack where a website visitor is tricked into clicking a link or button on a different page than they”re currently visiting. Use X-FRAME-OPTIONS to secure the site.

To mitigate clickjacking attacks:

  1. Edit the httpd.conf file:

    Add the line Header append X-FRAME-OPTIONS "SAMEORIGIN".

  2. Save the file.

  3. Restart Apache.

MIME-type sniffing

The X-Content-Type-Options header prevents Internet Explorer from MIME-sniffing (determining a file”s Content-Type from the file”s content). If the server sets the Content-Type header to text/html with the nosniff option set, Internet Explorer renders the content as text/html regardless of the file”s content.

Edit the httpd.conf file:

Add the line Header set X-Content-Type-Options "nosniff". Save the file. Restart Apache.

Load Balancing

This example shows how to setup and configure Apache on CentOS 7 and Kestrel on the same instance machine. To not have a single point of failure; using mod_proxy_balancer and modifying the VirtualHost would allow for managing multiple instances of the web apps behind the Apache proxy server.

In the configuration file shown below, an additional instance of the helloapp is set up to run on port 5001. The Proxy section is set with a balancer configuration with two members to load balance byrequests.

Smart tv with sky go app android

Rate Limits

Using mod_ratelimit, which is included in the httpd module, the bandwidth of clients can be limited:

The example file limits bandwidth as 600 KB/sec under the root location:

Long request header fields

Proxy server default settings typically limit request header fields to 8,190 bytes. An app may require fields longer than the default (for example, apps that use Azure Active Directory). If longer fields are required, the proxy server”s LimitRequestFieldSize directive requires adjustment. The value to apply depends on the scenario. For more information, see your server”s documentation.

Warning

Don”t increase the default value of LimitRequestFieldSize unless necessary. Increasing the value increases the risk of buffer overrun (overflow) and Denial of Service (DoS) attacks by malicious users.

Additional resources

Create a CSR using OpenSSL & install your SSL certificate on your Apache server

Use the instructions on this page to use OpenSSL to create your certificate signing request (CSR) and then to install your SSL certificate on your Apache server.

Restart Note: After you”ve installed your SSL/TLS certificate and configured the server to use it, you must restart your Apache instance.

For Ubuntu instructions, see Ubuntu Server with Apache2: Create CSR & Install SSL Certificate (OpenSSL). For other OS/platform instructions, see Create a CSR (Certificate Signing Request).

You can use these instructions to create OpenSSL CSRs and install all types of DigiCert SSL certificates on your Apache server: Standard SSL, EV SSL, Multi-Domain SSL, EV Multi-Domain SSL, and Wildcard SSL.

  1. To create your certificate signing request (CSR), see Apache: Creating Your CSR with OpenSSL.

    Para un tutorial en español visite la página Apache Crear CSR.

  2. To install your SSL certificate, see Apache: Installing & Configuring Your SSL Certificate.

    Visite nuestras instrucciones en español para Apache Instalar Certificado SSL.

I. Apache: Creating Your CSR with OpenSSL

Use the instructions in this section to create your own shell commands to generate your Apache CSR with OpenSSL.

Recommended: Save yourself some time. Use the DigiCert OpenSSL CSR Wizard to generate an OpenSSL command to create your Apache CSR. Just fill out the form, click Generate, and then paste your customized OpenSSL command into your terminal.

How to Generate a CSR for Apache Using OpenSSL

If you prefer to build your own shell commands to generate your Apache CSR, follow the instructions below.

  1. Log in to your server via your terminal client (ssh).

  2. Run Command

    At the prompt, type the following command:

    Note: Make sure to replace server with the name of your server.

  3. Generate Files

    1. You”ve now started the process for generating the following two files:

      • Private-Key File: Used to generate the CSR and later to secure and verify connections using the certificate.
      • Certificate Signing Request (CSR) file: Used to order your SSL certificate and later to encrypt messages that only its corresponding private key can decrypt.
    2. When prompted for the Common Name (domain name), type the fully qualified domain (FQDN) for the site that you are going to secure.

      Note: If you”re generating an Apache CSR for a Wildcard certificate, make sure your common name starts with an asterisk (e.g., *.example.com).

    3. When prompted, type your organizational information, beginning with your geographic information.

      Note: You may have already set up default information.

    4. Now, your OpenSSL .csr file is created.

  4. Order Your SSL/TLS Certificate

    1. Open the .csr file you created with a text editor.

    2. Copy the text, including the —–BEGIN NEW CERTIFICATE REQUEST—– and —–END NEW CERTIFICATE REQUEST—– tags, and paste it in to the DigiCert order form.

      The film knives out

  5. Save Private Key

    Save (back up) the generated .key file. You need it later to install your SSL certificate.

  6. Install Certificate

    After you”ve received your SSL certificate from DigiCert, you can install it on your server.

II. Apache: Installing & Configuring Your SSL Certificate

If you still need to create a certificate signing request (CSR) and order your certificate, see Apache: Creating Your CSR with OpenSSL.

After we”ve validated and issued your SSL certificate, you can install it on your Apache server (where the CSR was generated) and configure the server to use the certificate.

Configure Apache Server On Mac

How to Install and Configure Your SSL Certificate on Your Apache Server

  1. Copy the certificate files to your server.

    1. Log in to your DigiCert account and download the intermediate (DigiCertCA.crt) and your primary certificate (your_domain_name.crt) files.

    2. Copy these files, along with the .key file you generated when creating the CSR, to the directory on the server where you keep your certificate and key files.

      Note: Make them readable by root only to increase security.

  2. Find the Apache configuration file (httpd.conf) you need to edit.

    The location and name of the configuration file can vary from server to server—especially if you”re using a special interface to manage your server configuration.

    • Apache”s main configuration file is typically named httpd.conf or apache2.conf. Possible locations for this file include /etc/httpd/ or /etc/apache2/. For a comprehensive listing of default installation layouts for Apache HTTPD on various operating systems and distributions, see Httpd Wiki – DistrosDefaultLayout.

    • Often, the SSL certificate configuration is located in a <VirtualHost> block in a different configuration file. The configuration files may be under a directory like /etc/httpd/vhosts.d/, /etc/httpd/sites/, or in a file called httpd-ssl.conf.

    One way to locate the SSL Configuration on Linux distributions is to search using grep, as shown in the example below.

    Run the following command:

    Note: Make sure to replace /etc/httpd/ with the base directory for your Apache installation.

  3. Identify the SSL <VirtualHost> block you need to configure.

    If your site needs to be accessible through both secure (https) and non-secure (http) connections, you need a virtual host for each type of connection. Make a copy of the existing non-secure virtual host and configure it for SSL as described in step 4.

    If your site only needs to be accessed securely, configure the existing virtual host for SSL as described in step 4.

  4. Configure the <VirtualHost> block for the SSL-enabled site

    1. Below is a very simple example of a virtual host configured for SSL. The parts listed in blue are the parts you must add for SSL configuration. How to clear space on internal storage android.

    2. Make sure to adjust the file names to match your certificate files.

      • SSLCertificateFile is your DigiCert certificate file (e.g., your_domain_name.crt).

      • SSLCertificateKeyFile is the .key file generated when you created the CSR (e.g., your_private.key).

      • SSLCertificateChainFile is the DigiCert intermediate certificate file (e.g., DigiCertCA.crt)

        Note: If the SSLCertificateChainFile directive does not work, try using the SSLCACertificateFile directive instead.

  5. Test your Apache configuration file before restarting.

    As a best practice, check your Apache configuration file for any errors before restarting Apache.

    Caution: Apache won”t start again if your configuration files have syntax errors.

    Run the following command to test your configuration file (on some systems, it”s apache2ctl):

  6. Restart Apache.

    You can use apachectl commands to stop and start Apache with SSL support.

    Restart Notes:

    If Apache doesn”t restart with SSL support, try using apachectl startssl instead of apachectl start. If SSL support only loads with apachectl startssl, we recommend you adjust the apache startup configuration to include SSL support in the regular apachectl start command. Otherwise, your server may require to manually restart Apache using apachectl startssl in the event of a server reboot. This usually involves removing the <IfDefine SSL> and </IfDefine> tags that enclose your SSL configuration.

  7. Congratulations! You”ve successfully installed your SSL certificate.

Testing Your SSL/TLS Certificate Installation

  1. Browser Test

    1. For best results, make sure to close your web browser first and then re-launch it.

    2. Visit your site with the secure https URL (i.e., go to https://www.example.com not http://www.example.com).

    3. Be sure to test your site with more than just Internet Explorer. IE downloads missing intermediate certificates; whereas, other browsers give an error if all the certificates in the certificate chain aren”t installed properly.

  2. DigiCert® SSL Installation Diagnostic Tool

    If your site”s publicly accessible, use our Server Certificate Tester to test your SSL/TLS certificate installation; it detects common installation problems.

Troubleshooting

Enable Https On Apache

  1. If your web site”s publicly accessible, our SSL Certificate Tester tool can help you diagnose common problems.

  2. If you receive a “not trusted” warning, view the certificate details to see if it”s the certificate you expect. Check the Subject, Issuer, and Valid To fields.

    1. If it”s the certificate you expect and the SSL certificate is issued by DigiCert, then your SSLCertificateChainFile is not configured correctly.

    2. If you don”t see the certificate you expect, then you may have another SSL <VirtualHost> block before the one you recently configured.

      Name based virtual hosts aren”t possible with https unless you use the same certificate for all virtual hosts (e.g., a Wildcard or a Multi-Domain SSL certificate).

      This is not an Apache limitation, but an SSL protocol limitation. Apache must send a certificate during the SSL handshake before it receives the HTTP request that contains the Host header. Therefore, Apache always sends the SSLCertificateFile from the first <VirtualHost> block that matches the IP and port of the request.

  3. For help moving your certificates to additional servers or across server platforms, see our OpenSSL export instructions.

  4. If you need to disable SSL version 2 compatibility in order to meet PCI Compliance requirements, add the following directive to your Apache configuration file:

    If the directive already exists, you may need to modify it to disable SSL version 2.

  5. For instructions on how to fix common errors and for additional tips, see Troubleshooting Apache SSL Certificate Errors.

Apache Setup

Apache Server Configuration

For information about Apache server configurations that can strengthen your SSL environment, see the following resources:

  • For Instructions on disabling the SSL v3 protocol, see Apache: Disabling the SSL v3 Protocol.

  • For information about enabling perfect forward secrecy, see Enabling Perfect Forward Secrecy.