8.8.2. Enabling Secure Connections to the Web Server (Optional)

Engineering Knowledge Manager

Installation Guide | Chapter 8: Installing a Front-End Web Server | 8.8. Overview of Client-Web Server Communications |

8.8.1. SSL/TLS Certificates: Background |  | 8.8.3. Enabling Secure Connections to JBoss for Single-Node EKM Server (Optional)
Prev |  | Next

### 8.8.2. Enabling Secure Connections to the Web Server (Optional)

When communications between the client browser and the front-end web server need to travel over an untrusted network such as the Internet, it is highly advisable to use secure connections between the client browser and the front-end web server. This section presents instructions for enabling secure connections to EKM, using the Apache web server.

- Creating an In-House Certificate Authority

- Creating and Installing a Test Certificate

- Generating a Certificate Signing Request (CSR)

- Signing the CSR

- Installing the Certificate on the Web Server

#### 8.8.2.1. Creating an In-House Certificate Authority

SSL/TLS certificates are typically purchased from well-known Certificate Authorities. Using a certificate from a well-established and widely recognized CA confers several benefits to the web server operator. These include increased credibility and convenience because the root certificates for popular CAs are prepackaged into major browsers, eliminating the need to distribute anything to client browsers that will connect to the web site.

If a web server is to be used solely internally within an organization, then the benefits of using a certificate from a well-recognized Certificate Authority may not be important. Any valid SSL/TLS certificate can be used to encrypt traffic between client browser and web server as long as the client browser accepts the certificate. For internal production use, and certainly for test use, it is often sufficient to create and use an in-house Certificate Authority that can sign SSL/TLS certificates for these use cases.

A certificate that is signed by the same party that created it is known as a self-signed certificate. When an internally-generated certificate is signed using an in-house Certificate Authority, then a self-signed certificate is created. Self-signed certificates are perfectly usable for enabling HTTPS connections to a web server. However, when a browser encounters a certificate that has been signed by an unknown certificate authority, it will present the user with a warning, such as the following:

Figure 8.3: Browser Warning: Unknown CA (Firefox)

Once a user accepts the certificate, the HTTPS connection can proceed.

You can create a self-signed SSL/TLS certificate for testing or internal purposes by creating an in-house Certificate Authority using OpenSSL. Follow the procedure described below. User inputs are highlighted in bold.

1. Obtain and install OpenSSL distribution for your operating system (OS).

   - Linux Binaries: Install from your OS distribution’s installation media or software repository

   - Windows Binaries: `http://www.slproweb.com/products/Win32OpenSSL.html`

   - Source Code: `http://www.openssl.org/`

   Once you have installed OpenSSL, you are ready to proceed with the creation of an in-house Certificate Authority.

   Note: Certificates and private keys should be secured against unauthorized access.

2. Create a directory structure for the in-house CA. Be sure to secure these directories appropriately.

   Windows Example:

   Base directory:

   `c:\ssl`

   Directory for CA root certificate and private key:

   `c:\ssl\CA`

   Directory for certificates that the CA signs:

   `c:\ssl\certs`

   Directory for certificate signing requests (CSRs):

   `c:\ssl\requests`

3. Create a private key for the CA. You will be asked for a passphrase for the CA key. Remember what you type here.

       c:\ssl\CA>openssl genrsa -des3 -out CA.key 1024
       Loading 'screen' into random state - done
       Generating RSA private key, 1024 bit long modulus
       ..........................................++++++
       ...++++++
       e is 65537 (0x10001)
       Enter pass phrase for CA.key:
       Verifying - Enter pass phrase for CA.key:

4. Create a root certificate for the CA.

   You will be asked to provide the passphrase for the CA private key, and for details about the CA that you are creating a new root certificate for. Enter suitable values for your site and server. This Certificate Authority will only be used for creating test and in-house certificates, so the values you enter here aren’t of critical importance, but they should be meaningful.

   The CA private key will be used later on to sign a Certificate Signing Request (CSR) for the front-end web server.

       C:\ssl\CA>openssl req -new -key CA.key -x509 -days 1895 -out  CA.crt
       Enter pass phrase for CA.key:
       You are about to be asked to enter information that will be incorporated
       into your certificate request.
       What you are about to enter is what is called a Distinguished Name or a
       DN.
       There are quite a few fields but you can leave some blank
       For some fields there will be a default value,
       If you enter '.', the field will be left blank.
       -----
       Country Name (2 letter code) [AU]:Your Country Code
       State or Province Name (full name) [Some-State]:Your State
       Locality Name (eg, city) []:Your Locality Name
       Organization Name (eg, company) [Internet Widgits Pty Ltd]:Your
       Organization Name
       Organizational Unit Name (eg, section) []:
       Common Name (eg, YOUR name) []:ekm.yourdomain.com
       Email Address []:

#### 8.8.2.2. Creating and Installing a Test Certificate

In order to test the capability of connecting to the front-end web server over HTTPS, a self-signed test SSL/TLS certificate can be installed on the web server and signed by the in-house Certificate Authority.

The steps for generating and installing a SSL/TLS certificate are as follows:

1. Generate a CSR (Certificate Signing Request) for the web server.

2. Sign the CSR with the local CA to produce a signed SSL/TLS certificate.

3. Install the signed certificate on the web server.

##### 8.8.2.2.1. Generating a Certificate Signing Request (CSR)

Follow the instructions below to generate a certificate signing request (CSR) on the Apache web server. User inputs are highlighted in bold.

###### Apache

1. Create the directory: `APACHE_HOME/conf/keystore`. The web server’s private key and certificate will be stored in this directory:

       cd APACHE_HOME/conf
       mkdir keystore

2. In the `APACHE_HOME/conf/keystore` directory, generate a private key for the web server:

       APACHE_HOME/conf/keystore>openssl genrsa -out server.key 1024
       Loading 'screen' into random state - done
       Generating RSA private key, 1024 bit long modulus
       ............++++++
       ................++++++
       e is 65537 (0x10001)

   The `keystore` directory will now contain the private key for the Apache server, in the file `server.key`.

3. In the `APACHE_HOME/conf/keystore` directory, generate a CSR for the web server. When completed, the `keystore` directory will contain the CSR for the Apache server in the file: `server.csr`:

       APACHE_HOME/conf/keystore>openssl req -new -key server.key -out server.csr
       You are about to be asked to enter information that will be incorporated
       into your certificate request.
       What you are about to enter is what is called a Distinguished Name or a DN.
       There are quite a few fields but you can leave some blank
       For some fields there will be a default value,
       If you enter '.', the field will be left blank.
       -----
       Country Name (2 letter code) [AU]:Your Contry Code
       State or Province Name (full name) [Some-State]:Your State
       Locality Name (eg, city) []:Your Locality Name
       Organization Name (eg, company) [Internet Widgits Pty Ltd]:Your Organization Name
       Organizational Unit Name (eg, section) []:
       Common Name (eg, YOUR name) []:ekm.yourdomain.com
       Email Address []:
       Please enter the following 'extra' attributes
       to be sent with your certificate request
       A challenge password []:
       An optional company name []:

   Note: The Common Name is the host name that is used to connect to the web server. This is usually the Fully Qualified Domain Name (FQDN) of the server, for example: `ekm.yourdomain.com`. A certificate is valid only for the common name it is issued for; if the name that is used to connect to the web server is changed, then a new certificate for the new common name will need to be issued.

##### 8.8.2.2.2. Signing the CSR

Follow the instructions below to “sign” a certificate signing request (CSR). User inputs are highlighted in bold.

1. If necessary, copy the CSR file you created in the previous step into the requests directory of the in-house Certificate Authority.

2. Sign the Certificate Signing Request using the in-house Certificate Authority:

       C:\ssl>openssl x509 -req -days 1825 -in requests\server.csr -CA CA\CA.crt
        -CAkey CA\CA.key -CAcreateserial -out certs\server.crt
       Loading 'screen' into random state - done
       Signature ok
       subject=/CN=ekm.yourdomain.com/OU=none/O=Your Organization Name/L=Your
       Locality Name/ST=Your State/C=US
       Getting CA Private Key
       Enter pass phrase for CA\CA.key:

The self-signed SSL/TLS certificate produced by this command is named `server.crt` and is located in the `certs` directory of the in-house CA. This certificate is now ready to install on your web server.

##### 8.8.2.2.3. Installing the Certificate on the Web Server

Follow the instructions below to install a certificate on the Apache web server. User inputs are highlighted in bold.

###### Apache

1. Copy the self-signed certificate to the `keystore` directory that was created for the web server in a previous step.

   Windows:

   `copy c:\ssl\certs\server.crt APACHE_HOME\conf\keystore`

   Linux:

   `cp ssl/certs/server.crt APACHE_HOME/conf/keystore`

2. Configure Apache to enable SSL and use your self-signed certificate. Edit `APACHE_HOME/conf/httpd.conf` as follows:

   1. Listen on both port 80 (HTTP) and port 443 (HTTPS):

          Listen 80
          Listen 443

   2. Enable the SSL module.

          LoadModule ssl_module modules/mod_ssl.so

   3. Create a VirtualHost entry to listen on port 443 (HTTPS) on the IP address of your web server. This VirtualHost has SSL enabled, using the self-signed certificate and private key of the server:

          <VirtualHost 192.168.1.2:443>
                ServerName ekm.yourdomain.com
                SSLEngine on
                SSLCertificateFile conf/keystore/server.crt
                SSLCertificateKeyFile conf/keystore/server.key
          </VirtualHost>

3. Restart the web server to pick up the configuration changes.

Contains proprietary and confidential information of ANSYS, Inc. and its subsidiaries and affiliates.

Prev | Up / Contents | Next

Release 18.2 - © ANSYS, Inc. All rights reserved.