Many online articles discuss setting up HTTPS for Apache HTTPD on cloud virtual machines like AWS EC2 or GCP Compute Engine. However, beginners often find gaps in the explanation, particularly regarding acquiring a free SSL certificate from Let's Encrypt, the "Certificate Authority CA", and configuring it on Apache HTTPD. The following step-by-step instructions aim to bridge this knowledge gap.
Setup for Apache "httpd" web server
NOTE: the following should work for both AWS EC2 or GCP Compute Engine; (tested Jun, 2024)
Install Apache httpd - AWS EC2 - Amazon Linux 2023 AMI
By default, the Apache "httpd" web server enable only the unencrypted "http" after installation. Additional steps are needed to enable the "https". These steps include installing the Apache "mod_ssl" extension module and possibly additional steps.
The Apache "mod_ssl" extension module provides strong cryptography using the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, ensuring secure connections between the server and clients, safeguarding sensitive data transmitted over the network.
NOTE: to be confirmed via testing; the additional steps may not be needed as it is enabled automatically during installation of the "mod_ssl". For example, on the AWS EC2 with Amazon Linux 2023, the additional steps are not needed if the default SSL certificates are acceptable. (Tested: Jun 2024)
sudo echo "<h1>Hello from Region us-west-2a</h1>" > /var/www/html/index.html
Create self-signed certificate
On the AWS EC2 with Amazon Linux 2023, the default SSL certificates are generated automatically during installation, and the "https" is also enabled.
To validate: open the browser and enter the following URL: https://<public_ip_address_assigned_to_ec2_instace>/index.html
The auto-generated SSL certificates can be found at:
// SSL private key
ls -al /etc/pki/tls/private
[...]
-rw-------. 1 root root 1704 Jun 14 01:38 localhost.key
// SSL Self-Signed Certificate
ls -al /etc/pki/tls/certs
[...]
-rw-r--r--. 1 root root 4309 Jun 14 01:38 localhost.crt
Configuration of the Apache httpd to enable "https" and to use the auto-generated self-signed certificates can be found in the /etc/httpd/conf.d/ssl.conf as follow:
[Alternative] If the SSL certificates were not generated OR you want to create your own self-signed certificates, then follow the instructions below:
[Alternative] Check that openssl already installed; it should have been installed with mod_ssl; otherwise install it;
yum list openssl
Amazon Linux 2023 repository 48 MB/s | 25 MB 00:00
Amazon Linux 2023 Kernel Livepatch repository 52 kB/s | 10 kB 00:00
Installed Packages
openssl.x86_64 1:3.0.8-1.amzn2023.0.12
// Otherwise, install
sudo yum update -y
sudo yum install -y openssl
Last metadata expiration check: 0:27:19 ago on Wed Jun 12 02:47:55 2024.
Package openssl-1:3.0.8-1.amzn2023.0.12.x86_64 is already installed.
Dependencies resolved.
Nothing to do.
Complete!
[Alternative] Generate Private Key - this will be used to create the SSL self-signed certificate; the following command generates a 2048-bit RSA private key and saves it to a file named server.key. You can change the filename if desired.
cd ~
openssl genrsa -out server.key 2048
[Alternative] Generate Certificate Signing Request (CSR): using the private key generated above; the following command will prompt you to enter information such as: your organization details, common name (domain name), etc. It will then generate a CSR and save it to a file named server.csr.
openssl req -new -key server.key -out server.csr
[Alternative] Finally, Generate Self-Signed Certificate: using the private key and CSR files; the command creates a self-signed certificate valid for 365 days and saves it to a file named server.crt.
[Alternative] Copy the generated self-signed certificates to the commonly used folder for Apache httpd: /etc/pki/tls/, as shown below:
cd ~
sudo mv server.crt /etc/pki/tls/certs/
sudo mv server.key /etc/pki/tls/private/
[Alternative] Restart the Apache httpd server
sudo systemctl restart httpd
Please note that while self-signed certificates provide encryption, they are not inherently trusted by web browsers and may trigger security warnings that need to be manually bypassed. For production environments, it is recommended to use SSL certificates from a trusted Certificate Authority (CA) to avoid these warnings and ensure a seamless user experience.
The certificates (fullchain.pem) and the key (privkey.pem) from the CA will replace the (localhost.crt & localhost.key) or the (server.crt & server.key) discussed above.
Create SSL certificates from FREE trusted Certificate Authority (CA)
"Let's Encrypt" is the trusted Certificate Authority (CA) that issues FREE SSL certificate, see website. The step-by-step instructions using "certbot" shell client can be found here that can be customized based on the web server and OS type. The following instructions are for AWS Linux 2023 and Apache httpd web server; and based on python certbot module.
NOTE: the following instructions are for AWS EC2 using Amazon Linux 2023 AMI.
Installing Certbot through pip is only supported on a best effort basis and when using a virtual environment. Instructions for installing Certbot through pip can be found HERE; and by selecting your server software and then choosing “pip” in the “System” dropdown menu. (Or see custom Instructions: https://certbot.eff.org/instructions?ws=apache&os=pip). Source: https://eff-certbot.readthedocs.io/en/stable/install.html#alternative-2-pip
Install python3 and other modules
sudo dnf install python3 augeas-libs
OUTPUT:
Last metadata expiration check: 2:43:43 ago on Fri Jun 14 21:01:56 2024.
Package python3-3.9.16-1.amzn2023.0.8.x86_64 is already installed.
Dependencies resolved.
========================================================================================================================================= Package Architecture Version Repository Size
=========================================================================================================================================Installing:
augeas-libs x86_64 1.13.0-1.amzn2023.0.2 amazonlinux 408 k
Transaction Summary
=========================================================================================================================================Install 1 Package
Total download size: 408 k
Installed size: 1.2 M
Is this ok [y/N]: y
Downloading Packages:
augeas-libs-1.13.0-1.amzn2023.0.2.x86_64.rpm 3.0 MB/s | 408 kB 00:00
-----------------------------------------------------------------------------------------------------------------------------------------Total 2.1 MB/s | 408 kB 00:00
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
Preparing : 1/1
Installing : augeas-libs-1.13.0-1.amzn2023.0.2.x86_64 1/1
Running scriptlet: augeas-libs-1.13.0-1.amzn2023.0.2.x86_64 1/1
Verifying : augeas-libs-1.13.0-1.amzn2023.0.2.x86_64 1/1
Installed:
augeas-libs-1.13.0-1.amzn2023.0.2.x86_64
Complete!
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Enter email address (used for urgent renewal and security notices)
(Enter 'c' to cancel): thendean@gmail.com
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.4-April-3-2024.pdf. You must agree in
order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: N
Account registered.
Please enter the domain name(s) you would like on your certificate (comma and/or
space separated) (Enter 'c' to cancel): aiworking.online
Requesting a certificate for aiworking.online
Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/aiworking.online/fullchain.pem
Key is saved at: /etc/letsencrypt/live/aiworking.online/privkey.pem
This certificate expires on 2024-09-12.
These files will be updated when the certificate renews.
NEXT STEPS:
- The certificate will need to be renewed before it expires. Certbot can automatically renew the certificate in the background, but you may need to take steps to enable that functionality. See https://certbot.org/renewal-setup for instructions.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
* Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
* Donating to EFF: https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/aiworking.online/fullchain.pem
Key is saved at: /etc/letsencrypt/live/aiworking.online/privkey.pem
Config Apache httpd; update /etc/httpd/conf.d/ssl.conf with the following:
