How to implement the HTTPS protocol between a web server and web browser?

Question

What are the requirements to implement the HTTPS protocol? I know that I need an HTTPS server that contains a certificate. Please guide me to implement HTTPS.

Answer 1

Depends on the web server. Typically, you need:

• Port 443 (or whatever port you're using) open on the virtual site (for Apache that's the Listen directive in the VirtualHost section of your config file, in IIS you have to add a host header)
• A valid security certificate
• A credible issuing authority if you're using this for a public website and don't want a security warning from the browser (something like Verisign, Thawte, RapidSSL, etc.)
• A unique IP address (or rather, the IP/port combination you're using has to end up serving the website)
• The firewall port open for 443 (or whatever port you're using)

Answer 2

You can configure a HTTP Server like Apache to provide HTTPS by installing mod_ssl and configuring it with a certificate, etc. in /etc/httpd/conf.d/ssl.conf (Red Hat / CentOS).

Or you can use a software reverse proxy / SSL Offloader like nginx to provide SSL termination to your HTTP Server. In this case the certificate resides on the proxy and does the SSL negotiation, etc. and proxy_pass[es] the traffic to the HTTP Server.

Or you can use a hardware reverse proxy / SSL Offloader like F5's BIG-IP which is just a dedicated device that does local traffic management in addition to SSL termination. Same as nginx, certificate resides on the device and passes the traffic to the HTTP Server.

Cheers