Changes between Initial Version and Version 1 of HttpsFiles

Timestamp:

May 5, 2010, 10:56:22 AM (15 years ago)

Author:

Nicklas Nordborg

Comment:

Documenting some of the mess with setting up and using https

HttpsFiles

@@ +1 @@
+== Linking to files on a https server ==
+
+On this page I will try to write about setting up an environment with files on an external web server that uses https and requires client authentication to access the files. It is a long procedure and there are probably multiple ways to do it and multiple ways to screw up if you are not careful. The first step is setting up an Apache HTTP server and configure it to use https and only accept clients that are authenticated with a trusted certificate.
+
+=== Setting up a secure Apache server ===
+
+I more or less followed the instruction in [http://www.vanemery.com/Linux/Apache/apache-SSL.html Van's Apache SSL/TLS mini-HOWTO]. The key idea is that you first setup your own Certification Authority. This makes it easier to setup a trusted chain of certificates since you will only need to import the CA-certificate to also trust all other certificates signed by it.
+
+Create a CA-certificate as described in step 1.
+
+Create a certificate for the web server and sign it with the CA-certificate as described in step 2.
+
+Steps 3-4 are about configuring the Apache server to use the generated certificates. Use the suggested configuration as a starting point. After this step the web server can run as a https server but it will allow any client to connect.
+
+To allow only clients with a trusted certificate to connect add this to the configuration file:
+
+{{{
+SSLVerifyClient require
+SSLVerifyDepth 1
+}}}
+
+Due to recently discovered security issues with SSL the above should be applied to the entire server. The guide suggests that you can add this to a sub-directory but it may not work until all clients have fixed their implementation. For example, Java  1.6.0_20 (which is the newest Java version when I write this) has disabled re-negotiation (See [http://java.sun.com/javase/javaseforbusiness/docs/TLSReadme.html] for detailed background information)
+
+This should complete the server-side setup.
+
+=== Creating a signed certificate for the BASE server ===
+
+We need to create a client certificate for the BASE server that the Apache server can trust. The section ''Creating Client Certificates for Authentication'' in the mini-guide is useful only for certificates that should be used in Firefox or Internet explorer. I could not get certificates that was generated by that recipe to work with the BASE server. Instead we need to use the '''keytool''' program that is shipped with Java. Most of the information that we need can be found in the [http://java.sun.com/javase/6/docs/technotes/tools/windows/keytool.html Keytool documentation]. Be aware that some of the examples override default settings and some doesn't. You'll need to be more consistent, particularly with 'alias' and 'keystore' parameters.
+
+The first step is to create a key for the BASE server. Follow the instructions in the ''Generating Your Key Pair'' section in the examples chapter.
+
+The second step is to create a Certificate Signing Request. Follow the instruction in the ''Requesting a Signed Certificate from a Certification Authority'' in the examples chapter. 
+
+The file that is generated needs to be signed by the CA-certificate that we created in the first step when setting up the Apache server. For this we can once again follow the mini-guide. It is the third '''openssl''' command in the ''Creating Client Certificates for Authentication'' section:
+
+{{{
+openssl x509 -req -in van-c.csr -out van-c.crt -sha1 -CA my-ca.crt -CAkey my-ca.key -CAcreateserial -days 3650
+}}}
+
+Now, we need to use the keytool again to import the signed certificate, but before we can do this we need to trust the CA-certificate that we used for signing. Import the CA-certificate into the 'cacerts' file (found in <java-home>/jre/lib/security/cacerts). Follow the descriptions in the ''Importing a Certificate for the CA'' section in the examples chapter. Make sure that you import to the 'cacerts' file and not to the keystore as in the example.
+
+The final step is to import the signed certificate to the keystore. This is easy and is described in the ''Importing the Certificate Reply from the CA'' section.
+
+
+=== Configuring the BASE server ===
+
+You'll need to instruct BASE to load the keystore and truststore files. This is described in the [http://base.thep.lu.se/chrome/site/latest/html/appendix/appendix.base.config.html base.config documentation].
+
+Test everything by adding a file item in BASE that points to a URL on the Apache server.
+