Now, let us see how to implement secure Apache Web server for that, we will be using third party
certificate when we have to create the certificate.
We have to relate that certificate with some domain name.
In our case, we will be relating that certificate with our ocloud.in domainname.
And because we are relating it with ocloud.in, we have to verify that domain name that it belongs to us.
So we will be looking step by step after we have downloaded the certificate.
We need to upload it into Apache Web server and then place filing certain places in that Apache server
that we will see how to do so in our cases.
First of all, we will go to the Apache and we will try to understand the directory structure, because
we know that in Apache we have just installed httpd.
But for that, for implementing SSL or https, we need to install certain packages so with pwd, we can check
where we are.
And with the cd command, what will happen?
it will take us to our home directory then with the tree command, because all the configuration
file for the apache server, they are in /etc/httpd directory.
once We are going to run this command.
It will say that command this can not find.
So you can always install yum -q mean quite -y install tree.
So this command is going to install tree command in silent mode.
Then we will say tree httpd.
So it is going to show files.
look at this, the configuration file for https, which is ssl.conf is not available for that.
We have to install certain packages and please remember for changing the color because that was not
very comfortable when I was using the putty.
So you have to just select in color use system color what will happen.
It will change the background of the color.
Let us see what happens then.
What we are going to do.
We will check whether rpm -q openssl is there and if it is not there, what we are going
to do, we are going to install this and other package you have to verify is rpm -q mod_
ssl.
And initially when we installed that instance, this is available, this is not available.
So how you are going to install yum -q install mod_ssl, so it will ask for the confirmation,
then you can verify it.
Then again, when we are going to run this command, what it is show it will show you that SSL is there
now let us do this step.
First of all, let me change that color in setting so we will go to the color.
We will say system color that mean now little bit more visible.
So in our case, because we have already installed this.
So what it will be showing.
Tree command is also there, so we are going to look at this directory, /etc/httpd.
So what it is showing, it is showing you certain things, which files are there, httpd.conf is there
But this is important that mean path is /etc/httpd/conf.d/ssl.conf is there because when we are going
to create the certificate, we have to download the certificate.
We have to put those certificates in certain directory, then we have to change the settings of this directory.
we will be looking at this now again, which packages we just wanted to confirm openssl.
It is installed then.
mod_ssl.
It is in our case, because we have already installed so it is showing that this package is available
now, let us again move to.
Then what we are going to do, we are going to search for the location of SSL certificates, so in that
case, what you can do cat, with cat command you can open the file /etc/httpd/conf.d,
ssl.conf grep then carrot symbol SSLCertificate.
When you are going to run this command, it will show you one file, one parameter SSLcertificate file.
This is the directory by default, it is showing one file, local.crt is there, then SSLcertificatekeyfile.
It is going to show that your private keys is in this directory /etc/pki/tls/private.
This is your file and what you can do?
You have to find another parameter cat /etc/httpd/conf.d/ssl.conf grep again.
carrot symbol hash SSL certificate.
When you are going to initially run this command, it is going to say hash mean this parameter has not been
enabled.
It will show you that SSL certificate chain file in /etc/pki/tls/certs
server-chain.crt.
why we are discussing this, because when we are going to create one certificate on the site,
third party site it is going to give us three files SSLCertificateFile, SSLCertificateKeyFile, SSLCertificate
ChainFile.
So we will when we are going to download and then upload in apache web server, we have to make changes here.
What is the name of that file?
What is the name of Private Key.
What is the name of.
And then we are going to uncomment.
this also now with ls command.
We can check this directory, we can check directly.
Initially, this directory is empty and here it is showing certain file see a ca-bundle.cert.
But those files are not there.
Which files localhost.crt
localhost.key and these are not available.
So what we are going to do now, we want these files.
So for our purposes, we will go to this site, www.sslforfree.com for getting a free certificate.
We will first register for our account.
In my case, I have already done this.
So with your e-mail you have to specify some password.
Very easy to register.
So we will register, after register.
What you can do.
You can specify a way for which domain you want SSL certificate.
We are going to specify you www.ocloud.in then what it will show it will take you to this dashboard
certificate dashboard.
Let us go first.
This is the site as sslforfree.com.
So first, what we are going to do, you can type the address here or what you can do login.
So log in with your email account, whatever it is.
And whatever is the password.
So we will.
Now, what we can do initially, this will be empty.
So what we have to do, we have to click on new certificate.
And you're going to specify new certificate, what are they going to show you on new certificate
If you are going to select this, then that means pro version that mean, then you have to pay.
So we will keep it here.
Then what are you going to do?
ocloud.
in
And please remember when we are going to enter this, what it will show that mean it is going to give
you the domain certificate for which domain ocloud.in also www.ocloud.in.
So that is good for us.
Then when we are going to say next, it will say whether a 90 day certificate or one year if you are
going to select this, then it will be paid then.
Next, it will automatically generate one CSR request, so our system is capable of securely creating private CSR
on your behalf.
So what we want.
We want to auto generate when we are going to say next.
Which thing we want in our case, we are going to select this when we are going to select this, when we
are going to say next we will see what will happen.
So in our case, we have already done this step.
So let us see.
So initially you will get this dashboard.
So in our case, it is showing you the step.
what is expiring soon, how many certificates your expiring?.
What is draft, how many has been issued, how many certificates of pending validation.
So what we are going to do, we are going to create a new certificate and please remember it allow you
to create three free certificate.
You can get it for 90 days that it is valid for 90 days.
We just want to experiment.
So 90 days are also sufficient for us.
So what we are going to do, this is the same that I've shown you.
Then it will ask whether 90 day, then we are going to say next step.
So we are going to select the by default, it is already saying selected and we are going to say next.
Now, when we are going to say next, what will happen.
We have to because this domain, might be belong to someone else.
So we have to do the verification.
So a lot of methods are there email verification
that mean, they will send you the email to this account and then you have to verify.
In our case, we are not using email verification.
We are using DNS name that mean it will ask to put certain records in our DNS server.
if the domain name belongs to us, we will be able to put then it will be able to verify.
So we are going to use this.
So when we say click on this what happened, it is saying that sign in to your DNS provider, typically
the register of your domain.
We have already done and put this name and what you should do points to.
And please remember sometimes if you're going to put this, it is going to show the error like in our
case, then please remove this .ocloud.in that mean you have to specify only this portion.
So sometimes even when the instructions are there, you have to adjust according to your where you are
implemented because they have just given generic instruction.
They are not specify how it will work with GoDaddy or some other provider.
So we have to adjust accordingly.
So in our case, we have to leave this .ocloud.in that mean we have to put. Now how we are going to
do, how we have done that mean.
Add record using GoDaddy DNS Manager.
So these five records were there.
So what we did, canonical name we selected from the record, host we specified that initially
whatever it has given, Points to.
Then we did say now what happened, it was showing us these records.
Then we said, please verify that domain..
So when we specify the verified domain name, when we clicked on that domain name, what happened.
It is saying we are unable to verify your cname entry, please check for error on your side.
So in our case, it was not working properly.
So what we did.
We go into the domain manager.
Let me show you.
So what we did in Hosts, we did not specify that ocloud.in, rest of the things were same.
Then again, when we saved that mean little bit adjustments we have to do again when we did that.
That means we've modified that address, that mean we did not specify ocloud.in here, then we saved it
that when we modified the entry and then what it said, congratulation, your domain has been verified.
This means that our system is issuing your certificate at the moment.
This page will refresh automatically every few seconds.
So after some times, it will give you one option download certificate.
So we downloaded the certificate.
We saved it into some directory, so in that directory we said, OK.
After what we have to do, we have to put that downloaded file into our Apache Web servers for that,
what we have to do and in our case, we created one https directory and we.
downloaded that ocloud.in there.
Then what we did, we used one utility secure copy.
Let me show you.
So in our case.
Let me show you the utility that we uses.
This was the utility WinSCP copy how it works.
We do not want new version.
So here we specify the hostname mean our address, it was 52.15.85.32.
And username is your ec2-user, and then we because that machine does not have any password so
advanced, so we authentication, privatelykey, vipingupta.
OK.
Login.
That means we try to access because we need to copy the data.
So what happened here on our desktop
We created one https folder.
then we clicked on this and we moved this here like, suppose, we have to move some file here,
how we can do we can do in this way.
So this file will go there,same way we did for each.
So what was happening?
This file was there.
It was view.
We were just showing that how this happened then we do not need this.
We can close.
Then again, that mean this was steps, how we perform, we specify this, this is our screen.
So then what we did, we moved this file here.
That file got there, then what we did, we use the unzip utility by using that utility what it did,
it extracted because this contained three files certificate.crt, ca_bundle.crt
and private key then with ls we can verify it now, we need to place these file into the right directory.
So what we command it. again this was for listing those directories.
Then what we did, we open that nano /etc/httpd/conf.d/ssl.conf, then what we did, we
moved those files.
Let me show you how we did.
unzip.
Then we've moved those files, how we moved
those files.
Let me show you.
So let us log in.
Now we are into this directory cd /home/.
ec2-user.
Those files was there and which command we run for moving those files.
Let me show you.
We use certain commands.
This was the command that means we use the command mv ca_bundle.crt certificate.crt,
where we move this, /etc/pki/tls/certs, when we are moving the command or may cutting paste.
So this file got move to this directory, then what was the the next command, we've moved the private
key.
So when we run these commands, like let me show you also.
Let me show you the command ls -l /etc/pki/tls/ one directory is .
your cerficate directory.
These are the moved file, certificate.crt and then you have got this ca_bundle command is.
there.
So we copied that ca_bundle and what was the second directory?
Private.
Then we can open with the vi, which file it /etc/ and with the Nano, two browsers are there, Nano.
http.
conf.d/
ssl.conf.
Now, here's what we did we chaned those file names that mean, let me show you how we did.
Now, look at this, we specified the SSLCertificateChainFile with the name of that file.
Then what about the other files?
This is your SSLCertificateKeyFile.
Then this is your SSLcertificate bundle.
And then this is your certificate file, we saved those.
Let me show you.
So this was the that mean when we viewed the files, then we open that file again, when we
checked that that mean all the files are at relevant place, then systemctl restart httpd.
Then you can verify whether everything is working properly or not.
And let us verify.
So what we can do, we can specify.
https://
Now, look at this secure site is running, you can verify that connection is secure, you can verify.
That mean all the details are there, so now we want to check with the whether ocloud.in
it will work or not.
That is also working that mean that is how we can implement, in our case, your webserver is running
on ec2 instance on AWS cloud, then we are relating that domainname that we have purchased
from GoDaddy.
We made entry there, then we created a certificate from SSL for free.
It was very simple way of creating that mean it was very easy.
So we have relate three different that mean AWS cloud, GoDaddy and then certificate and it is working perfectly.
And once you have done that, also what you can do.
Let me show you one thing and.
again Let me show you the in slides that means we were able to confirm.
And again, on that site, there was one option also, once the installation is complete, what you
can do it automatically verifies that also, let me show you.
That mean install certificate check installation after check installation, what will happen
once you have done the check installation, you will get this option.
Installation complete, congratulations, you have successfully installed your SSL certificate and then
you can create a new one.
This is the final screen that you are going to get 90 days SSL.
So what you can do, you can revoke this certificate if your certificate has got compromised so let
me cancel this.
So this is the certificate, what you can do if it is compromised.
You can download that also, but you can specify you can revoke that certificate.
Also, it is showing you the revoke option.
We do not want any help.
So it is showing download certificate.
So this is visible.
This is.
revoke certificate, but we are not going to do that because still it is valid certificate.
That is how we relate all the things if you do not want the machines, later on, what you can do.
Action in instance state, what you can do, you can terminate the instance.
And regarding domain manager, what you can do if you want to remove these record.
So when you are going to click on this, you can delete it here.
In sameway if you want to delete the entries or other things of this record, again, what you can do,
do it.
But we are not going to do this.
So again, these were optional videos.
Please, just for because on request, we are getting a lot of requests.
And so we created those.
Again, these are optional.
Go for these video.
Only if you are comfortable with using some cloud services, where you can host your domain name
then how to create the certificate.
But just for knowledge, even if you are going to view the videos, it will help you.
How you can do that practical.
And please remember, if you are going to look at again now, whatever we did in the local lab, it
was not much difference that.
Same way we were installing the software, same way we were creating and adding on that we were
not using the DNS server, we were using that you can say host file, which was acting as a DNS
type of server there.
Also, we created our secure site also.
So in the Internet a little bit things are different.
So that was our how to relate those.
You can say how to create your secure Web site by using third party software.