Hey, everyone.
And welcome back.
Now, in the earlier video we were discussing about the Https and the benefits that it offers.
So in today's video, we'll look into the Web server based configuration aspect related to Https.
Now, we were discussing that as soon as we open up the Https labs internal.com, automatically we have
the verified sign.
So let's look into how exactly things would work as far as the configuration is concerned.
So this is my website where the Labs internal.com site is hosted.
Now if you look into the configuration, so everything goes with the configuration because when you
open up https labs internal.com, your browser will send a request to the web server.
So in our case, the web server is enginex.
So upon the request, the Nginx web server also has to send a certificate back to the web browser in
order for web browser to be able to verify it.
So the certificate needs to be stored within your web server.
It can be Apache Nginx as well as IIS.
So if I quickly open up the Nginx.conf over here and if you go a bit down here, you have a server block.
So if you go a little down here, so you see this is the configuration specific to the TLS.
So you have the listen directive, which is listen on four, four, three.
So this is listen on four, four, three.
Then you have the SSL certificate over here.
So this is the path where your SSL certificate is stored.
Then you also have the SSL certificate key.
So this is the key because once the Web browser trusts the certificate and it basically sends your encrypted
packet with the public key, which was mentioned in the certificate, then your web server should also
be able to decrypt that message and it could only decrypt the message with the corresponding private
key.
So you also have to mention the corresponding private key path for your web server.
Now the third directive here is the include directive.
So basically this directive let me show you this.
So if I open this up, so here it basically contains SSL specific configuration.
So the SSL protocol.
So you have TLS version one, TLS version 1.1 and TLS version 1.2.
So these are the SSL protocols which your web browser will support.
So we already discussed that there are various SSL, TLS protocol.
Now you don't really want your web browser to support SSL 3.0 because the protocols which were part
of the SSL, are deemed to be unsafe.
That means the communication could be compromised, so you should never use the older protocols.
Now, even in this specific configuration, you have TLS version one, TLS version 1.1.
So when you talk about the industry, specifically the industry, which basically might take your sensitive
data, for example, credit card.
So generally when you have auditors who might be coming to your organization, if the auditor sees that
your web server basically allows even the TLS version one protocol, then they'll say, No, no, this
is not done.
You have to remove the support for the older protocols.
You should only use the latest protocol, maybe 1.2 as well as 1.3.
Nothing older than that.
So they are very strict in these fronts.
So you have to be careful there.
Now, we already discussed that the protocol SSL, TLS in turn contains various other cipher suites
that it supports.
So you also have to make sure that whatever cipher suites that are being supported are the correct ones.
So these are some of the configurations that you typically do within your web server.
So let's do one thing.
Let's open up Nginx.conf again and let's look into the certificate file.
So this is the Pem file.
So if you just do a Nano on the Pem file, you see this is the entire certificate.
So if you want to read it, you can do open SSL, you can do x509 hyphen in.
Then you have to basically specify the path of your certificate.
So in our case the path of certificate is this.
So I'll say hyphen txt and note.
So now you will be able to see what exactly is being supplied.
So similar thing.
So the details that you see over here, similar details you will be able to see within your web browser.
So as we had seen, if you just open this up.
And if you do a view certificate, web browser gives you a view about each and every thing which is
part of the certificate.
Now, the same thing is something that you will be able to see over here.
So if you see the issuer is let's encrypt, it has the validity, it has the subject subject is labs
internal.com.
Then you have the public key specific information and the ocsp and various other details associated
with the certificate.
Now, one last thing before we conclude this video.
If you open up the nginx.conf, So here within the server directive, you see it is listening on 80
as well as four, four, three.
So this is a web server configuration.
So what happens here is that if any user does not put Https within the browser, he will be redirected
to the Http based website.
If he puts Https within the browser, then he will be redirected to the https website.
So if you want to just check it out.
So if I just put the labs internal.com.
This is the Http based website.
You see, it does not really have that green lock sign.
If you open up https, you have the green lock sign.
So all of these configurations can be done from your web server.
Many auditors, they say that your website should only be based on Https.
It should not serve Http traffic or say if someone puts http dot labs internal.com, it should automatically
redirect to the https based website.
So there are a lot of configurations that you will be able to do at your web server level.
So this was just the configuration related to Nginx.
Similar configuration applies for Apache IIS and any other web server that might be used.
So that's the high level overview about the configuration block for SSL.
TLS within the Nginx, I hope this video has been informative for you and I look forward to see you
in the next video.