{"id":323,"date":"2019-07-02T14:30:19","date_gmt":"2019-07-02T14:30:19","guid":{"rendered":"https:\/\/silviamarin.ro\/?p=57"},"modified":"2019-07-02T14:30:19","modified_gmt":"2019-07-02T14:30:19","slug":"securizarea-serverului-apache-cu-ssl-2","status":"publish","type":"post","link":"https:\/\/marinelvis.xyz\/index.php\/2019\/07\/02\/securizarea-serverului-apache-cu-ssl-2\/","title":{"rendered":"SECURIZAREA SERVERULUI APACHE CU SSL"},"content":{"rendered":"

Generarea certificatelor SSL<\/strong><\/em>
\nSe creeaza folderul unde se vor pastra certificatele si cheia privata:<\/p>\n

mkdir \/var\/SSL && cd \/var\/SSL<\/pre>\n
Se genereaza cheia privata (domeniu.com.key<\/span><\/span>) cu OpenSSL in terminalul serverului domeniului sau in Control Panel<\/p>\n
openssl genrsa -out \/var\/SSL\/domeniu.com.key<\/span><\/span> 2048<\/pre>\n
Se creeaza fisierul \u201cdomeniu.com<\/span>.csr\u201d<\/p>\n
openssl req -new -sha256 -key \/var\/SSL\/domeniu.com<\/span>.key -out \/var\/SSL\/domeniu.com<\/span>.csr<\/pre>\n
Country: RO<\/em>
\nState or Province: Galati<\/em>
\nCity or Locality: Galati<\/em>
\nOrganization Name: Home<\/em>
\nOrganizational Unit: IT<\/em>
\nCommon Name: domeniu.com<\/em>
\nPassword chalenge ramane gol (Enter)<\/em><\/p><\/blockquote>\n
Se verifica certificatul CSR:<\/p>\n
openssl req -noout -text -in \/var\/SSL\/domeniu.com<\/span>.csr<\/pre>\n
Acum exista cheia privata (domeniu.com<\/span>.key<\/em>) care va ramane instalata pe serverul domeniului si certificatul\u00a0 (domeniu.com<\/span>.csr<\/em>) care va fi transmis catre autoritatea comerciala de certificare (Comodo,VeriSign, GoDaddy,etc.) pentru a genera cheia publica care va avea extensia .crt<\/p>\n
GoDaddy<\/strong> genereaza 2 fisiere: fa87f784d9b6ea29.crt<\/em> si gd_bundle-g2-g1.crt<\/em>. Primul este certificatul domeniu.com<\/span>.csr<\/em> semnat digital de GoDaddy si se redenumeste domeniu.com<\/span>.crt<\/em> iar al doilea este certificatul intermediar al autoritatii de certificare si se redenumeste intermediate.crt<\/em>. Ambele fisiere se salveaza in \/var\/SSL<\/em>
\nSe concateneaza cele doua fisiere:<\/p>\n
cat domeniu.com<\/span>.crt intermediate.crt > domeniu.com<\/span>.chained.crt<\/pre>\n
Comodo<\/strong> genereaza 4 fisiere: Root (AddTrustExternalCARoot.crt<\/em> si
\nCOMODORSAAddTrustCA.crt<\/em>), Intermediate2 (COMODORSADomainValidationSecureServerCA.crt<\/em>), si Primary Certificates (domeniu.com<\/span>.crt<\/em>).
\nSe concateneeaza cele 4 fisiere in ordinea: Primary, Intermediate, Root:<\/p>\n
cat domeniu.com<\/span>.crt COMODORSADomainValidationSecureServerCA.crt COMODORSAAddTrustCA.crt AddTrustExternalCARoot.crt > domeniu.com<\/span>.pem<\/pre>\n
Fisierele concatenate obtinute arata asa:<\/p>\n
\u2014\u2013BEGIN CERTIFICATE\u2014\u2013<\/em>
\nMIIFNjCCBB6gAwIBAgIJAPqH94TZtuopMA0GCSqGSIb3DQEBCwUAMIG0MQswCQYDVQQGEwJVUzEQMA4GA1UECBMHQXJpem9uYTETMBEGA1UEBxMKU2NvdHRzZGFsZTEaMBgGA1UEChMRR29EYWRkeS5jb20sIEluYy4xLTArBgNVBAsTJGh0dHA6Ly9jZXJ0cy5nb2RhZGR5LmNvbS9yZXBvc2l0b3J5LzEzMDEGA1UEAxMqR28gRGFkZHkgU2VjS0NIRftLNXpgFWeGeqZpW9Tdh7prvvsy78cGo+aqAIVUNe0tMWAV2RupaSaWajr7s7uEWBWGWRVFDyAXGOyx\/ytwa6SrxDq7<\/em>
\n\u2014\u2013END CERTIFICATE\u2014\u2013<\/em>
\n\u2014\u2013BEGIN CERTIFICATE\u2014\u2013<\/em>
\nRzLmdvZGFkZHkuY29tL3JlcG9zaXRvcnkvMTMwMQYDVQQD<\/em>
\nEypHbyBEYWRkeSBTZWN1cmUgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC54MsQ1K92vdSTYuswZLiBCGzDBNliF44v\/z5lz4\/OYuY8UhzaFkVLVat4a2ODYpDOD2lsmcgaFItMzEUz6ojcnqOvK\/6AYZ15V8TPLvQ\/MDxdR\/yaFrzDN5ZBUY4RS1T4KL7QjL7wMDge87Am+GZHY23ecSZHjzhHU9FGHbTj3ADqRay9vHHZqm8A29vNMDp5T19MR\/<\/em>
\n\u2014\u2013END CERTIFICATE\u2014\u2013<\/em>
\n\u2014\u2013BEGIN CERTIFICATE\u2014\u2013<\/em>
\nY29tLCBJbmMuMTEwLwYDVQQDEyhHbyBEYWRkeSBSb290IENlcnRpZmljYXRlIEF1dGhvcml0eSAtIEcyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv3FiCPH6WTT3G8kYo\/eASVjpIoMTpsUgQwE7hPHmhUmfJ+r2hBtOoLTbcJjHMgGxBT4HTu70+k8vWTAi56sZVmvigAf88xZ1gDlRe+X5NbZ0TqmNghPktj+pA4P6or6KFWp\/3gvDthkUBcrqw6gElDtGfDIN8wBmIsiNaW02jBEYt9OyHGC0OPoCjM7T3UYH3go+6118yHz7sCtTpJJiaVElBWEaRIGMLKlDliPfrDqBmg4pxRyp6V0etp6eMAo5zvGI<\/em>
\n\u2014\u2013END CERTIFICATE\u2014\u2013<\/em>
\n\u2014\u2013BEGIN CERTIFICATE\u2014\u2013<\/em>
\nFJ2+qN1j3hybX2C32qRe3H3I2TqYXP2WYktsqbl2i\/ojgC95\/5Y0V4evLOtXi<\/em>
\nEqITLdiOr18SPaAIBQi2XKVlOARFmR6jYGB0xUGlcmIbYsUfb18aQr4CUWWoriMYavx4A6lNf4DD+qta\/KFApMoZFv6yyO9ecw3ud72a9nmYvLEHZ6IVDd2gWMZEewo+YihfukEHU1jPE44dMX4\/7VpkI+EdOqXG68CAQOjgcAwgb0wHQYDVR0OBBYEFNLEsNKR1EwRcbNhyz2h\/t2oatTjMIGNBgNVHSMEgYUwgYKAFNLEsNKR1EwRcbNhyz2h\/t2oatTjoWekZTBjMQswCQYDVQQGEwJVUzEhMB8GA1UEChMYVGhlIEdvIERhZGR5=<\/em>
\n\u2014\u2013END CERTIFICATE\u2014\u2013<\/em><\/p><\/blockquote>\n
Configurarea serverului Apache<\/strong><\/em><\/p>\n
cd \/etc\/apache2\/sites-available\u00a0\ncp 000-default.conf 000-default.conf.orig\u00a0\nnano 000-default.conf<\/pre>\n
Se inlocuieste continutul fisierului cu urmatorul:<\/p>\n
<VirtualHost *:80>\u00a0\u00a0<\/em>
\nServerName domeniu.com<\/span>\u00a0\u00a0<\/em>
\nRedirect permanent \/ https:\/\/domeniu.com<\/span>\/\u00a0\u00a0<\/em>
\nErrorLog ${APACHE_LOG_DIR}\/error.log\u00a0\u00a0<\/em>
\nCustomLog ${APACHE_LOG_DIR}\/access.log combined<\/em>
\n<\/VirtualHost><\/em>
\n<VirtualHost *:443><\/em>
\nServerName www.domeniu.com<\/span><\/em>
\nServerAdmin webmaster@localhost<\/em>
\nDocumentRoot \/var\/www\/html\u00a0\u00a0<\/em>
\nSSLEngine on\u00a0\u00a0<\/em>
\nSSLCertificateFile \/var\/SSL\/domeniu.com<\/span>.crt\u00a0\u00a0<\/em>
\nSSLCertificateKeyFile \/var\/SSL\/domeniu.com<\/span>.key\u00a0\u00a0<\/em>
\nSSLCACertificateFile \/var\/SSL\/intermediate.crt<\/em>
\nErrorLog ${APACHE_LOG_DIR}\/error.log<\/em>
\nCustomLog ${APACHE_LOG_DIR}\/access.log combined<\/em>
\n<\/VirtualHost<\/em>><\/p><\/blockquote>\n
Se activeaza modulul SSL al serverului Apache<\/p>\n
a2enmod ssl<\/pre>\n
Se activeaza suportul pentru „perfect forward secrecy” in modulul ssl;<\/p>\n
nano\u00a0\/etc\/apache2\/mods-available\/ssl.conf<\/pre>\n
Se activeaza \u00a0„SSLHonorCipherOrder on”<\/em> si se inlocuieste „SSLCipherSuite HIGH:!aNULL”<\/em> cu<\/p>\n
SSLCipherSuite ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:DHE-RSA-CAMELLIA128-SHA:AES128-SHA:RC4-SHA:HIGH:!aNULL:!MD5:!ADH<\/em><\/p><\/blockquote>\n
Se salveaza fisierul si se reporneste serverul Apache<\/p>\n
systemctl restart apache2.service<\/pre>\n
Se verifica domeniul:
\nhttps:\/\/domeniu.com<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
Generarea certificatelor SSL Se creeaza folderul unde se vor pastra certificatele si cheia privata: mkdir \/var\/SSL && cd \/var\/SSL Se genereaza cheia privata (domeniu.com.key) cu OpenSSL in terminalul serverului domeniului sau in Control Panel openssl genrsa -out \/var\/SSL\/domeniu.com.key 2048 Se creeaza fisierul \u201cdomeniu.com.csr\u201d openssl req -new -sha256 -key \/var\/SSL\/domeniu.com.key -out \/var\/SSL\/domeniu.com.csr Country: RO State or […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-323","post","type-post","status-publish","format-standard","hentry","category-fara-categorie"],"_links":{"self":[{"href":"https:\/\/marinelvis.xyz\/index.php\/wp-json\/wp\/v2\/posts\/323","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/marinelvis.xyz\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/marinelvis.xyz\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/marinelvis.xyz\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/marinelvis.xyz\/index.php\/wp-json\/wp\/v2\/comments?post=323"}],"version-history":[{"count":0,"href":"https:\/\/marinelvis.xyz\/index.php\/wp-json\/wp\/v2\/posts\/323\/revisions"}],"wp:attachment":[{"href":"https:\/\/marinelvis.xyz\/index.php\/wp-json\/wp\/v2\/media?parent=323"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/marinelvis.xyz\/index.php\/wp-json\/wp\/v2\/categories?post=323"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/marinelvis.xyz\/index.php\/wp-json\/wp\/v2\/tags?post=323"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}