Category: SSL

Apache: Multiple SSL websites on a single IP address

On July 2, 2013

In Cpanel and WHM, Linux server, Plesk, SSL

Apache: Multiple SSL websites on a single IP address

Update: This is a new update from a cPanel Tech
“There is nothing to enable. As long as you are using cPanel & WHM version 11.38 on CentOS, RHEL, or CloudLinux version 6 or newer, SNI works out of the box”.

One of the frustrating limitations in supporting secure websites has been the inability to share IP addresses among SSL websites.
When website administrators and IT personnel are restricted to use a single SSL Certificate per socket (combination of IP Address and socket) it can cost a lot of money. Well we can actually share IP addresses for multiple secure websites. Solving this limitation required an extension to the Transport Layer Security (TLS) protocol that includes the addition of what hostname a client is connecting to when a handshake is initiated with a web server. The name of the extension is Server Name Indication (SNI). SNI is supported in Apache v2.2.12 , and OpenSSL v0.9.8j or later.

With SNI, you can have many virtual hosts sharing the same IP address and port, and each one can have its own unique certificate

Prerequisites to use SNI

Use OpenSSL 0.9.8f or later
Build OpenSSL with the TLS Extensions option enabled (option enable-tlsext; OpenSSL 0.9.8k and later has this enabled by default).
Apache must have been built with that OpenSSL (./configure –with-ssl=/path/to/your/openssl). In that case, mod_ssl will automatically detect the availability of the TLS extensions and support SNI.
Apache must use that OpenSSL at run-time, which might require setting LD_LIBRARY_PATH or equivalent to point to that OpenSSL, maybe in bin/envvars. (You’ll get unresolved symbol errors at Apache startup if Apache was built with SNI but isn’t finding the right openssl libraries at run-time.)

Setting up SNI with Apache

The configuration is pretty simple and straight forward, though I recommend making a backup of your existing httpd.conf file before proceeding.

# Ensure that Apache listens on port 443
Listen 443

# Listen for virtual host requests on all IP addresses
NameVirtualHost *:443

# Go ahead and accept connections for these vhosts
# from non-SNI clients
SSLStrictSNIVHostCheck off

# Because this virtual host is defined first, it will
# be used as the default if the hostname is not received
# in the SSL handshake, e.g. if the browser doesn't support
# SNI.
DocumentRoot /www/example2
ServerName linuxwebhostingsupport.com

# Other directives here
SSLEngine On
SSLCertificateFile /path/to/linuxwebhostingsupport.com.crt
SSLCertificateKeyFile /path/to/linuxwebhostingsupport.com.key
SSLCertificateChainFile /path/to/CA.crt

DocumentRoot /www/example2
ServerName www.abdulwahabmp.co.in

# Other directives here
SSLEngine On
SSLCertificateFile /path/to/abdulwahabmp.co.in.crt
SSLCertificateKeyFile /path/to/abdulwahabmp.co.in.key
SSLCertificateChainFile /path/to/CA.crt

That it!!!. Just restart APache service. Now go and check your Websites using https. That should be working.

Plesk support SNI from 10.2.x version onwards.

SNI will work on following Operating systems out of box

OpenSuSE Linux 11.3 or later.
Ubuntu Linux 10.4 or later.
Debian Linux 6.0 or later.
RedHat Linux 6.0 or later.
CentOS Linux 60.0 or later

Supported Desktop Browsers
Internet Explorer 7 and later
Firefox 2 and later
Opera 8 with TLS 1.1 enabled
Google Chrome:
Supported on Windows XP on Chrome 6 and later
Supported on Vista and later by default
OS X 10.5.7 in Chrome Version 5.0.342.0 and later
Chromium 11.0.696.28 and later
Safari 2.1 and later (requires OS X 10.5.6 and later or Windows Vista and later).
Note: No versions of Internet Explorer on Windows XP support SNI

How to install an SSL certificate on Ubuntu for Nginx

By wahab

On June 10, 2012

In Linux server, SSL

Introduction

SSL (Secure Sockets Layer) is a protocol that provides secure communication over the internet. It uses cryptographic algorithms to encrypt data between the web server and the client’s browser. SSL is now deprecated, and TLS (Transport Layer Security) is the newer version that’s used widely.

In this tutorial, we’ll walk you through the steps to install and secure your website with SSL on Ubuntu 22.04 using Nginx. By the end of this guide, you’ll have a secure, encrypted connection between your web server and your users’ browsers, helping to ensure their safety and privacy.

Note: Originally, this blog was written for an old versions of Nginx and Ubuntu, I have updated to match the latest Ubuntu and Nginx recently.

Section 1: Installing Nginxon Ubuntu 22.04

Apache2 is a popular open-source web server software that plays a crucial role in hosting websites on the internet. In this section, we will walk through the process of installing Apache2 on Ubuntu 22.04.

Step 1: Update the Package List
Before installing any new software, it’s always a good idea to update the package list to ensure you are installing the latest version of the software. To update the package list, open the terminal on Ubuntu 22.04 and run the following command:

sudo apt update

Step 2: Install Nginx
Once the package list is updated, you can proceed with installing Nginx by running the following command:

sudo apt install nginx

This command will download and install Nginx along with all its dependencies. During the installation process, you will be prompted to confirm the installation by typing y and pressing Enter.

Enable and Start the Apache2 service

sudo systemctl enable nginx
sudo systemctl start nginx

Step 3: Verify NginxInstallation
To test if Nginx is working correctly, open a web browser and enter your server’s IP address or domain name in the address bar. You should receive the default Nginx landing page:

Congratulations, you have successfully installed Nginx on Ubuntu 22.04! In the next section, we will proceed with securing the web server by enabling SSL.

If you encounter any issues like Connection timeout or Unable to reach the website during the verification process, one possible cause could be that the Ubuntu firewall is blocking nginx traffic.

To check if Nginx is currently enabled in the firewall, you can use the Nginx is not listed as an allowed service, you can add it by running the following command:

sudo ufw allow 'Nginx Full'

This will allow both HTTP (port 80) and HTTPS (port 443) traffic to pass through the firewall, ensuring that your website is accessible to visitors.

Section 2: Installing SSL Certificate on Ubuntu 22.04 with Nginx

There are different types of SSL certificates, including domain validated, organization validated, and extended validation certificates. Each type has different features and provides varying levels of trust and security.

To install an SSL certificate on Ubuntu 22.04 with Nginx, you’ll need to follow these steps:

Obtain an SSL certificate: You can purchase an SSL certificate from a certificate authority (CA) or obtain a free SSL certificate from Let’s Encrypt. If you already have an SSL certificate, make sure it is valid and up-to-date.

Configure Apache2 to use the SSL certificate: Apache2 needs to be configured to use the SSL certificate for secure communication. This involves creating a virtual host for the SSL-enabled website, specifying the SSL certificate and key files, and enabling SSL encryption.

You can read more about different SSL certificate types, the process to create a Certificate signing request(CSR), etc in the below blog post:

SSL Certificates: What They Are and Why Your Website Needs Them

Here are the steps for creating and configuring virtual hosts for Apache on Ubuntu 22.04:

1. Create a new virtual host configuration file:

sudo nano /etc/nginx/sites-available/linuxwebhostingsupport.com

Add the following configuration to the file, replacing linuxwebhostingsupport.com with your own domain name:

server {
    listen 80;
    listen [::]:80;

    server_name linuxwebhostingsupport.com;

    root /var/www/html/linuxwebhostingsupport.com/html;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    server_name linuxwebhostingsupport.com;

    root /var/www/html/linuxwebhostingsupport.com/html;
    index index.html;

    ssl_certificate /etc/ssl/certs/linuxwebhostingsupport.com.crt;
    ssl_certificate_key /etc/ssl/certs/linuxwebhostingsupport.com.key;
    ssl_trusted_certificate /etc/ssl/certs/linuxwebhostingsupport.com_cabundle.crt;

    location / {
        try_files $uri $uri/ =404;
    }
}

Note: replace the paths to SSL certificate files with your own paths.

2. Create the documentroot
Run the following command to create the directory:

sudo mkdir -p /var/www/html/linuxwebhostingsupport.com/html

3. Test the Nginx configuration:

sudo nginx -t

If there are any issues, this check will show

4. Enable the virtual host configuration file:

If the configuration test is successful, enable the server block by creating a symbolic link in the /etc/nginx/sites-enabled directory:

sudo ln -s /etc/nginx/sites-available/linuxwebhostingsupport.com /etc/nginx/sites-enabled/

5. Create an HTML file named index.html in the new directory by running the following command:

sudo nano /var/www/html/linuxwebhostingsupport.com/html/index.html

This will open a text editor. Add the following code to the file:

<html>
    <head>
        <title>Hello, world!</title>
    </head>
    <body>
        <h1>Hello, world!</h1>
        <p>Welcome to my website!</p>
    </body>
</html>

5. Reload Nginx for the changes to take effect:

sudo systemctl reload Nginx

Section 3: Testing SSL on Ubuntu 22.04 with Nginx

Test your SSL configuration by visiting your domain in a web browser and verifying that the SSL certificate is valid and the website loads correctly over HTTPS. The browser should display a padlock icon and the connection should be secure

You can also use the online tools like https://www.sslshopper.com/ssl-checker.html to check the configuration further. It can show if there any issues with certificate chain or trust.

Section 4. Troubleshooting SSL on Ubuntu 22.04 with Apache2

1. Certificate errors: If you encounter a certificate error, such as a warning that the certificate is not trusted or has expired, check the certificate’s validity and ensure it’s installed correctly. You can check the certificate’s details using your web browser, and make sure it matches the domain name and other relevant details.

2. Mixed content warnings: If you see mixed content warnings, which indicate that some parts of the site are not secure, check for any resources that are still being loaded over HTTP instead of HTTPS. This can include images, scripts, and other files.

3. SSL handshake errors: If you see an SSL handshake error, this usually means there’s an issue with the SSL configuration. Check your Apache configuration files and make sure the SSL directives are properly set up. You can also check for any issues with the SSL certificate, such as an invalid or mismatched domain name.

4. Server configuration errors: If the SSL certificate is working properly, but the site is still not loading over HTTPS, check your server configuration files to make sure the VirtualHost configuration is correct. Make sure the correct SSL certificate and key files are specified and that the SSL directives are set up correctly.

5. Browser-specific issues: If you’re only experiencing SSL issues in a specific web browser, make sure the browser is up to date and try clearing the cache and cookies. You can also try disabling any browser extensions that may be interfering with the SSL connection.

Remember, troubleshooting SSL issues can be complex and may require some technical expertise. If you’re not comfortable with these steps or need additional help, it’s always a good idea to consult with a professional. You can contact me at admin @ linuxwebhostingsupport.com

Section 5: Best Practices for SSL Configuration on Ubuntu 22.04 with Apache2

Here are some tips and best practices for configuring SSL on Ubuntu 22.04 with Apache2:

1. Keep SSL certificates up to date: Make sure to renew your SSL certificates before they expire. This can be done through the certificate authority where you purchased the certificate. Keeping your SSL certificates up to date will ensure that your website visitors are not presented with security warnings or errors.

2. Configure Nginx for HTTPS-only access: To ensure that your website visitors are accessing your site securely, configure your Nginx server to only serve HTTPS traffic. This can be done by redirecting all HTTP traffic to HTTPS. To do this, add the red colored line to your server block of Nginx virtual host configuration file:

server {
    listen 80;
    server_name linuxwebhostingsupport.com;
    return 301 https://$server_name$request_uri;
}

3. Use secure ciphers and protocols: To protect the confidentiality and integrity of your website traffic, use secure ciphers and protocols. Disable weak ciphers and protocols such as SSLv2 and SSLv3. Use TLSv1.2 or higher, and prefer the use of forward secrecy. You can configure this in your Nginx virtual host configuration file by adding the following lines:

ssl_protocols TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;
ssl_stapling on;
ssl_stapling_verify on;

Make sure to adjust the file paths and other configuration options to match your specific setup.

You can find more detailed instruction on making your SSL configuration strong and best practices in the below post:

Strong TLS/SSL Security on your server

By following these best practices, you can ensure that your SSL configuration is secure and up to date.

Section 6. Summary

In this tutorial, we discussed how to install and configure SSL certificates on Ubuntu 22.04 with Nginx. We covered the different types of SSL certificates, the steps for obtaining and installing an SSL certificate, and how to configure Nginx to use the SSL certificate. We also discussed how to create virtual hosts for both SSL and non-SSL sites and how to troubleshoot SSL issues.
It’s important to emphasize the importance of SSL for website security and user trust. SSL encryption helps protect sensitive information, such as passwords and credit card numbers, from being intercepted by attackers. Additionally, having a valid SSL certificate gives users confidence that they are interacting with a legitimate website and not an imposter.

To follow best practices for SSL configuration, it’s recommended to keep SSL certificates up to date, configure Nginx for HTTPS-only access, and use secure ciphers and protocols. By following these best practices, website owners can help ensure the security and trustworthiness of their website.