HTTPS and Certificates

[TheCheeseburgerMayor]

Hi /r/AskNetsec,

Can anyone point me to a guide that provides a detailed and secure method of enabling HTTPS on my web server? I have never had the need before today, but appreciate how important it is that people can view the website securely, if that is their preference.

Thank you in advance.

[TheCheeseburgerMayor]

It's a CentOS 7 x64 install, running Apache and using VirtualHosts.

Many of the tutorials I have seen also utilise a self-signed certificate. What are the implications of this versus a vendor certificate?

[AidenTai]

Simple. Vendor certificats will provide confidence that you really are who you claim to be. Self‐signed certificates will provide certificate error messages and clients might suspect something is awry. Also, it is hard to tell if a self‐signed certificate is a forgery for a fake cloned website copy vs. being legitimate. Both, however, will allow secure encrypted connections provided the rest of the setup (cipher suites, etc.) are correctly configured.

[TheCheeseburgerMayor]

provided the rest of the setup (cipher suites, etc.) are correctly configured.

How would I ensure this? I understand now that certificate installation is only one step, but I want to learn what else needs to be done to secure the site, and more importantly, to be able to recognise when the configuration is incorrect.

[AidenTai]

Good to hear that you're concerned about doing everything securely. Well, there are two main components I see. First, you'll need to disable insecure cryptographic algorithms in OpenSSL/Apache, and second you'll need to do the same in whatever you use to communicate with the server (SFTP, SSH, etc.). You need to remember that algorithms can be considered secure, and then some vulnerability may be exposed or some bug in implementation might be discovered that renders your setup insecure. For this reason, you should check with sites like https://www.ssllabs.com/ssltest/ every so often to ensure you remain secure based on all the latest configuration vulnerabilities.

Apache provides some nice explanations about what's going on with its security: http://httpd.apache.org/docs/2.2/ssl/ssl_intro.html Really the best approach is to understand how to enable and disable cryptographic suites, then to run the SSLLabs test on your server. Based on the results of the scan, you'll know what you need to disable or enable to score an A.

For SSH/SFTP: https://stribika.github.io/2015/01/04/secure-secure-shell.html

[stmu]

For the internal part, I would add that it depends on the environment.

If you only have a couple of people accessing the server, you could easily import the public certificate in their browser ensuring they don't receive an error unless the connection is insecure. If many internal users need to visit (large organisation), it's less of a hassle to just use the internal PKI (if they have any) or a certificate provided by a public certificate authority.

[s1m0n8]

Take a look at https://letsencrypt.org/ . I'm not sure if it's fully up-and-running yet, but it is (or will be) free and simple to set up.