3

I would like to convert our extranet, which is currently available via http to use https instead. The server is only accessible by it's ip address, there's no domain name.

I'm looking for a free solution to achieve this with apache2.

Improve this question

6 Answers 6

Reset to default
2

You likely don't have a method to push a trusted CA under everyone's client PC. Internally, companies can do this, but it's a bit more difficult to do this externally.

You can get a 'real' SSL cert from GoDaddy for $29 a year. With this setup, the users will get SSL, and won't get a security warning.

If you self-sign a cert, then generally, users will get a warning whenever they visit your site. If you train users to ignore this warning, then you are defeating much of the point of SSL. If the user is connected via a public wifi hotspot, and someone intercepts their traffic, the only thing preventing the man-in-the middle attack from working is the certificate warning which the users receive. The book Beautiful Security has a nice chapter explaining how this is done, and what can be don't to prevent this from occurring.

Improve this answer
0
5

You can do this with a self signed ssl cert, however, the important part of a certificate is that it's a key certified as belonging to an entity by a trusted third party. By signing your own key you're negating much of the security advantage, in particular for anyone other than you who visits the site.

If anyone other than you will be using the site you should purchase a certificate and a domain name - it can be done for less than $100 per year.

That said, there are several questions dealing with self signed certificate generation:

and with configuring apache to deal with https

Improve this answer
2
  • Thanks a lot, it's very helpful. According to the fee, i completely understand your point. But since our audience is purely internal, ( our school professors and students), i guess we don't need to prove them we are 3rd-party approved.
    – pixeline
    Sep 14, 2009 at 7:00
  • Depends. If you control the machines they access the website on, you can just install your root cert. If you don't, then you probably want to buy a cert anyway.
    – Cian
    Sep 14, 2009 at 9:30
2

As far as converting your site to https, it should be easy enough. Just refuse to serv on http and configure apache to use SSL and serv your extranet on https. There should not be anything you need to do on the site itself. All configuration will be done on apache.

As far as ip address vs domain name, you need to speak with whoever you get your SSL Certificate from.

There are many useful documents and howto's available, here's a start:http://ubuntuforums.org/showthread.php?t=3657

  1. yes, check with your SSL guys
  2. it is free, but you have to pay for the certificate, or you create one yourself.
  3. apache support ssl, perfect.
  4. ask questions if you get stuck.

-js

Improve this answer
2

In your apache config, you'd probably be best to redirect all http traffic to https. One way to do this, is to setup two vhosts in the apache config, and have a line similar to

Redirect / https://your.site.tld

This is probably better than refusing to serve non-https traffic.

Improve this answer
1

As others have mentioned, it is already simple enough and free to convert to a https only serving (or a combination of both). Apache can be configured to use mod_ssl along with a server certificate. A self-signed server certificate can be created using openssl to generate it.

However, it all depends on your reason for using SSL. If it is merely to encrypt the session, a self-signed certificate may be somewhat helpful but it will not stop any man-in-the-middle attacks. You want the client browser and web-server to trust each other.

Assuming that this is something for the use of your company employees, there is a free solution. You can become your own root CA and generate certificates for both the server and the clients. All that is needed is for the client browsers to be configured to accept your own company CA as a trusted CA and it will help negate some of the authentication issues.

In addition, you can configure Apache to verify all client certificates and to reject any connection from any client that does not present a valid certificate signed with your own root CA. This can help to create a very tight trust mechanism. It will essentially eliminate most attacks.

Improve this answer
0

brianegge's answer is spot on.

You can self sign if all you need is the benefit of encryption, but it's hard to manage that for the users. Buy a cert from a CA that the browsers will recognize, it's more than worth it compared to the aggravation a self-signed cert will cause.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .