Chapter 14. Web Servers

1. Make sure all module names are correct, since they may have changed. Adjust the LoadModule directive for each module that has been renamed.
2. Recompile all third party modules before attempting to load them. This typically means authentication and authorization modules.
3. If you use the mod_userdir module, make sure the UserDir directive indicating a directory name (typically public_html) is provided.
4. If you use the Apache HTTP Secure Server, see Section 14.1.8, “Enabling the mod_ssl Module” for important information on enabling the Secure Sockets Layer (SSL) protocol.

Configuring mod_nss

1. Install mod_nss as root:

   ~]# yum install mod_nss

   This will create the mod_nss configuration file at /etc/httpd/conf.d/nss.conf. The /etc/httpd/conf.d/ directory is included in the main Apache HTTP Server configuration file by default. For the module to be loaded, restart the httpd service as described in Section 14.1.3.3, “Restarting the Service”.

2. As root, open the /etc/httpd/conf.d/nss.conf file and search for all instances of the Listen directive.

   Edit the Listen 8443 line as follows:

   Listen 443

   Port 443 is the default port for HTTPS.

3. Edit the default VirtualHost default:8443 line as follows:

   VirtualHost default:443

   Edit any other non-default virtual host sections if they exist. Save and close the file.

4. Mozilla NSS stores certificates in a server certificate database indicated by the NSSCertificateDatabase directive in the /etc/httpd/conf.d/nss.conf file. By default the path is set to /etc/httpd/alias, the NSS database created during installation.

   To view the default NSS database, issue a command as follows:

   ~]# certutil -L -d /etc/httpd/alias
   
   Certificate Nickname                     Trust Attributes
                                  SSL,S/MIME,JAR/XPI
   
   cacert                            CTu,Cu,Cu
   Server-Cert                         u,u,u
   alpha                            u,pu,u

   In the above command output, Server-Cert is the default NSSNickname. The -L option lists all the certificates, or displays information about a named certificate, in a certificate database. The -d option specifies the database directory containing the certificate and key database files. See the certutil(1) man page for more command line options.

5. To configure mod_nss to use another database, edit the NSSCertificateDatabase line in the /etc/httpd/conf.d/nss.conf file. The default file has the following lines within the VirtualHost section.

   #  Server Certificate Database:
   #  The NSS security database directory that holds the certificates and
   #  keys. The database consists of 3 files: cert8.db, key3.db and secmod.db.
   #  Provide the directory that these files exist.
   NSSCertificateDatabase /etc/httpd/alias

   In the above command output, alias is the default NSS database directory, /etc/httpd/alias/.

6. To apply a password to the default NSS certificate database, use the following command as root:

   ~]# certutil -W -d /etc/httpd/alias
   Enter Password or Pin for "NSS Certificate DB":
   Enter a password which will be used to encrypt your keys.
   The password should be at least 8 characters long,
   and should contain at least one non-alphabetic character.
   
   Enter new password:
   Re-enter password:
   Password changed successfully.

7. Before deploying the HTTPS server, create a new certificate database using a certificate signed by a certificate authority (CA).

   Example 14.3. Adding a Certificate to the Mozilla NSS database

   The certutil command is used to add a CA certificate to the NSS database files:

   certutil -d /etc/httpd/nss-db-directory/ -A -n "CA_certificate" -t CT,, -a -i certificate.pem

   The above command adds a CA certificate stored in a PEM-formatted file named certificate.pem. The -d option specifies the NSS database directory containing the certificate and key database files, the -n option sets a name for the certificate, -t CT,, means that the certificate is trusted to be used in TLS clients and servers. The -A option adds an existing certificate to a certificate database. If the database does not exist it will be created. The -a option allows the use of ASCII format for input or output, and the -i option passes the certificate.pem input file to the command.

   See the certutil(1) man page for more command line options.

8. The NSS database should be password protected to safeguard the private key.

   Example 14.4. Setting a Password for a Mozilla NSS database

   The certutil tool can be used set a password for an NSS database as follows:

   certutil -W -d /etc/httpd/nss-db-directory/

   For example, for the default database, issue a command as root as follows:

   ~]# certutil -W -d /etc/httpd/alias
   Enter Password or Pin for "NSS Certificate DB":
   Enter a password which will be used to encrypt your keys.
   The password should be at least 8 characters long,
   and should contain at least one non-alphabetic character.
   
   Enter new password:
   Re-enter password:
   Password changed successfully.

9. Configure mod_nss to use the NSS internal software token by changing the line with the NSSPassPhraseDialog directive as follows:

   ~]# vi /etc/httpd/conf.d/nss.conf
   NSSPassPhraseDialog file:/etc/httpd/password.conf

   This is to avoid manual password entry on system start. The software token exists in the NSS database but you can also have a physical token containing your certificates.

10. If the SSL Server Certificate contained in the NSS database is an RSA certificate, make certain that the NSSNickname parameter is uncommented and matches the nickname displayed in step 4 above:

    ~]# vi /etc/httpd/conf.d/nss.conf
    NSSNickname Server-Cert

    If the SSL Server Certificate contained in the NSS database is an ECC certificate, make certain that the NSSECCNickname parameter is uncommented and matches the nickname displayed in step 4 above:

    ~]# vi /etc/httpd/conf.d/nss.conf
    NSSECCNickname Server-Cert

    Make certain that the NSSCertificateDatabase parameter is uncommented and points to the NSS database directory displayed in step 4 or configured in step 5 above:

    ~]# vi /etc/httpd/conf.d/nss.conf
    NSSCertificateDatabase /etc/httpd/alias

    Replace /etc/httpd/alias with the path to the certificate database to be used.

11. Create the /etc/httpd/password.conf file as root:

    ~]# vi /etc/httpd/password.conf

    Add a line with the following form:

    internal:password

    Replacing password with the password that was applied to the NSS security databases in step 6 above.

12. Apply the appropriate ownership and permissions to the /etc/httpd/password.conf file:

    ~]# chgrp apache /etc/httpd/password.conf
    ~]# chmod 640 /etc/httpd/password.conf
    ~]# ls -l /etc/httpd/password.conf
    -rw-r-----. 1 root apache 10 Dec 4 17:13 /etc/httpd/password.conf

13. To configure mod_nss to use the NSS the software token in /etc/httpd/password.conf, edit /etc/httpd/conf.d/nss.conf as follows:

    ~]# vi /etc/httpd/conf.d/nss.conf

14. Restart the Apache server for the changes to take effect as described in Section 14.1.3.3, “Restarting the Service”

1. You are changing the IP address or domain name.

   Certificates are issued for a particular IP address and domain name pair. If one of these values changes, the certificate becomes invalid.

2. You have a certificate from VeriSign, and you are changing the server software.

   VeriSign, a widely used certificate authority, issues certificates for a particular software product, IP address, and domain name. Changing the software product renders the certificate invalid.

1. Review the target locations in which the key and certificate will be stored.

   Figure 14.1. Running the genkey utility

   

   Use the Tab key to select the Next button, and press Enter to proceed to the next screen.

2. Using the up and down arrow keys, select a suitable key size. Note that while a larger key increases the security, it also increases the response time of your server. The NIST recommends using 2048 bits. See NIST Special Publication 800-131A.

   Figure 14.2. Selecting the key size

   

   Once finished, use the Tab key to select the Next button, and press Enter to initiate the random bits generation process. Depending on the selected key size, this may take some time.

3. Decide whether you want to send a certificate request to a certificate authority.

   Figure 14.3. Generating a certificate request

   

   Use the Tab key to select Yes to compose a certificate request, or No to generate a self-signed certificate. Then press Enter to confirm your choice.

4. Using the Spacebar key, enable ([*]) or disable ([ ]) the encryption of the private key.

   Figure 14.4. Encrypting the private key

   

   Use the Tab key to select the Next button, and press Enter to proceed to the next screen.

5. If you have enabled the private key encryption, enter an adequate passphrase. Note that for security reasons, it is not displayed as you type, and it must be at least five characters long.

   Figure 14.5. Entering a passphrase

   

   Use the Tab key to select the Next button, and press Enter to proceed to the next screen.

   Important

   Entering the correct passphrase is required in order for the server to start. If you lose it, you will need to generate a new key and certificate.

6. Customize the certificate details.

   Figure 14.6. Specifying certificate information

   

   Use the Tab key to select the Next button, and press Enter to finish the key generation.

7. If you have previously enabled the certificate request generation, you will be prompted to send it to a certificate authority.

   Figure 14.7. Instructions on how to send a certificate request

   

   Press Enter to return to a shell prompt.