{"id":1969,"date":"2016-11-24T12:14:01","date_gmt":"2016-11-24T10:14:01","guid":{"rendered":"http:\/\/blog.sfsoft.it\/?p=1969"},"modified":"2016-11-24T12:14:01","modified_gmt":"2016-11-24T10:14:01","slug":"creare-un-certificato-ssl-per-apache-su-ubuntu-16-04","status":"publish","type":"post","link":"http:\/\/www.sfsoft.it\/blog\/2016\/11\/24\/creare-un-certificato-ssl-per-apache-su-ubuntu-16-04\/","title":{"rendered":"Creare un certificato SSL per Apache su Ubuntu 16.04"},"content":{"rendered":"<p>Si crea il certificato:<\/p>\n<pre class=\"lang:default decode:true\">openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout \/etc\/ssl\/private\/apache-selfsigned.key -out \/etc\/ssl\/certs\/apache-selfsigned.crt<\/pre>\n<ul>\n<li><strong>req -x509<\/strong>: indica quale certificato (CSR) utilizzare, in questo caso si usa lo standard X.509;<\/li>\n<li><strong>nodes<\/strong>: dice a OpenSSL di non usare una password per il certificato;<\/li>\n<li><strong>days 365<\/strong>: imposta la scadenza in giorni del certificato;<\/li>\n<li><strong>newkey rsa:2048<\/strong>: indica la lunghezza della chiave del certificato;<\/li>\n<li><strong>keyout<\/strong>: indica dove salvare la chiave privata;<\/li>\n<li><strong>out<\/strong>: indica dove salvare il certificato;<\/li>\n<\/ul>\n<p>Verranno ora richiesti i dati del certificato ( la parte pi\u00f9 importante \u00e8 la\u00a0<em>Common Name<\/em> dove si deve mettere il nome host o l&#8217;ip con cui si raggiunge il webserver ):<\/p>\n<ul>\n<li>Country Name (2 letter code) [AU]:IT<\/li>\n<li>State or Province Name (full name) [Some-State]:Lazio<\/li>\n<li>Locality Name (eg, city) []:Roma<\/li>\n<li>Organization Name (eg, company) [Internet Widgits Pty Ltd]:Blablabla S.p.a.<\/li>\n<li>Organizational Unit Name (eg, section) []:Reparto varie ed eventuali<\/li>\n<li>Common Name (e.g. server FQDN or YOUR name) []:nome-host-o-indirizzo-ip<\/li>\n<li>Email Address []:blabla@blablabla.bla<\/li>\n<\/ul>\n<p>Si generano i parametri Diffie-Hellman:<\/p>\n<pre class=\"lang:default decode:true\">sudo openssl dhparam -out \/etc\/ssl\/certs\/dhparam.pem 2048<\/pre>\n<p>Ora si deve configurare Apache ad usare le chiavi SSL appena create.<\/p>\n<p>Si abilita l&#8217;utilizzo dei parametri Diffie-Hellman:<\/p>\n<pre class=\"lang:default decode:true \">sudo nano \/etc\/apache2\/conf-available\/ssl-params.conf<\/pre>\n<p>Inserire le seguenti righe:<\/p>\n<pre class=\"lang:default decode:true\"># from https:\/\/cipherli.st\/\r\n# and https:\/\/raymii.org\/s\/tutorials\/Strong_SSL_Security_On_Apache2.html\r\n\r\nSSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH\r\nSSLProtocol All -SSLv2 -SSLv3\r\nSSLHonorCipherOrder On\r\n# Disable preloading HSTS for now.  You can use the commented out header line that includes\r\n# the \"preload\" directive if you understand the implications.\r\n#Header always set Strict-Transport-Security \"max-age=63072000; includeSubdomains; preload\"\r\nHeader always set Strict-Transport-Security \"max-age=63072000; includeSubdomains\"\r\nHeader always set X-Frame-Options DENY\r\nHeader always set X-Content-Type-Options nosniff\r\n# Requires Apache &gt;= 2.4\r\nSSLCompression off \r\nSSLSessionTickets Off\r\nSSLUseStapling on \r\nSSLStaplingCache \"shmcb:logs\/stapling-cache(150000)\"\r\n\r\nSSLOpenSSLConfCmd DHParameters \"\/etc\/ssl\/certs\/dhparam.pem\"<\/pre>\n<p>Si modifica il Virtualhost o la configurazione base SSL di Apache impostando i parametri creati, ad esempio:<\/p>\n<pre class=\"lang:default decode:true\">&lt;IfModule mod_ssl.c&gt;\r\n        &lt;VirtualHost _default_:443&gt;\r\n                ServerAdmin blabla@blablabla.bla\r\n                ServerName nome-host-o-indirizzo-ip\r\n\r\n                DocumentRoot \/var\/www\/html\r\n\r\n                ErrorLog ${APACHE_LOG_DIR}\/error.log\r\n                CustomLog ${APACHE_LOG_DIR}\/access.log combined\r\n\r\n                SSLEngine on\r\n\r\n                SSLCertificateFile      \/etc\/ssl\/certs\/apache-selfsigned.crt\r\n                SSLCertificateKeyFile \/etc\/ssl\/private\/apache-selfsigned.key\r\n\r\n                &lt;FilesMatch \"\\.(cgi|shtml|phtml|php)$\"&gt;\r\n                                SSLOptions +StdEnvVars\r\n                &lt;\/FilesMatch&gt;\r\n                &lt;Directory \/usr\/lib\/cgi-bin&gt;\r\n                                SSLOptions +StdEnvVars\r\n                &lt;\/Directory&gt;\r\n\r\n                BrowserMatch \"MSIE [2-6]\" \\\r\n                               nokeepalive ssl-unclean-shutdown \\\r\n                               downgrade-1.0 force-response-1.0\r\n\r\n        &lt;\/VirtualHost&gt;\r\n&lt;\/IfModule&gt;<\/pre>\n<p>Eventualmente forzare tutto il traffico sulla porta sicura:<\/p>\n<pre class=\"lang:default decode:true \">sudo nano \/etc\/apache2\/sites-available\/000-default.conf<\/pre>\n<p>E impostare:<\/p>\n<pre class=\"lang:default decode:true \">&lt;VirtualHost *:80&gt;\r\n        . . .\r\n\r\n        Redirect \"\/\" \"https:\/\/nome-host-o-indirizzo-ip\/\"\r\n\r\n        . . .\r\n&lt;\/VirtualHost&gt;\r\n<\/pre>\n<p>Abilitare le modifiche in Apache:<\/p>\n<pre class=\"lang:default decode:true\">sudo a2enmod ssl\r\nsudo a2enmod headers\r\nsudo a2ensite default-ssl\r\nsudo a2enconf ssl-params<\/pre>\n<p>Controlliamo che non ci siano errori nella configurazione:<\/p>\n<pre class=\"lang:default decode:true \">sudo apache2ctl configtest<\/pre>\n<p>Nel caso sia tutto a posto dovrebbe restituire un messaggio tipo:<\/p>\n<pre class=\"lang:default decode:true\">AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1. Set the 'ServerName' directive globally to suppress this message\r\nSyntax OK<\/pre>\n<p>Applichiamo le modifiche:<\/p>\n<pre class=\"lang:default decode:true \">sudo systemctl restart apache2<\/pre>\n<p>Testiamo che funzioni tutto andando su https:\/\/nome-host-o-inddirizzo-ip\/ ( ci sar\u00e0 ovviamente un avviso che il certificato non \u00e8 sicuro, basta autorizzarlo ).<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Si crea il certificato: openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout \/etc\/ssl\/private\/apache-selfsigned.key -out \/etc\/ssl\/certs\/apache-selfsigned.crt req -x509: indica quale certificato (CSR) utilizzare, in questo caso si usa lo standard X.509; nodes: dice a OpenSSL di non usare una password per il certificato; days 365: imposta la scadenza in giorni del certificato; newkey rsa:2048: indica [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[62,15,3,23],"tags":[246,64,16,8,63,5,247],"_links":{"self":[{"href":"http:\/\/www.sfsoft.it\/blog\/wp-json\/wp\/v2\/posts\/1969"}],"collection":[{"href":"http:\/\/www.sfsoft.it\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.sfsoft.it\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.sfsoft.it\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.sfsoft.it\/blog\/wp-json\/wp\/v2\/comments?post=1969"}],"version-history":[{"count":4,"href":"http:\/\/www.sfsoft.it\/blog\/wp-json\/wp\/v2\/posts\/1969\/revisions"}],"predecessor-version":[{"id":1973,"href":"http:\/\/www.sfsoft.it\/blog\/wp-json\/wp\/v2\/posts\/1969\/revisions\/1973"}],"wp:attachment":[{"href":"http:\/\/www.sfsoft.it\/blog\/wp-json\/wp\/v2\/media?parent=1969"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.sfsoft.it\/blog\/wp-json\/wp\/v2\/categories?post=1969"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.sfsoft.it\/blog\/wp-json\/wp\/v2\/tags?post=1969"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}