How to easily deploy HTTPS in ubuntu 10.04?

Question

I have an apache web server running on Ubuntu 10.04 and I would like to switch everything to HTTPS.

Answer 1

Apache2 makes this very easy with the additional tools packaged with it. If you have the apache2-common package installed, you can enable the mod_ssl module (required for HTTPS) in one easy command:

sudo a2enmod ssl

Apache2 also includes a command to help you easily generate self-signed certificates called apache2-ssl-certificate. Generate your certificate for the server as shown below or use certificates purchased through a trusted root CA ( Verisign, Entrust, Thawte, etc ).

sudo apache2-ssl-certificate -days 365

Keep in mind, users will receive this infamous warning when viewing your site if you use a self-signed certificate:

Use the following 4 statements in your Apache configuration ( /etc/apache2/sites-available/default ) or VirtualHost directive ( below DocumentRoot ) to turn on the SSL Engine for that particular site:

SSLEngine on
SSLOptions +StrictRequire
SSLCertificateFile    /etc/apache2/ssl/certs/apache.crt
SSLCertificateKeyFile /etc/apache2/apache-ssl/apache.pem

The SSLOptions +StrictRequire forces SSL communication only for that particular site. The SSLCertificateFile and SSLCertificateKeyFile specify the locations to your SSL certificate and it's corresponding key.

Ensure we are listening on port 443 by modifying /etc/apache2/ports.conf to include the Listen directive:

echo "Listen 443" >> /etc/apache2/ports.conf

Finally you must restart Apache2 to initiate the changes:

sudo /etc/init.d/apache2 restart 

Additional Fun:

Configure HTTP requests on port 80 to redirect to port 443 with mod_rewrite.

Note:

Some of this data is from past experience with Debian/Ubuntu systems, for the most accurate instructions there is a guide for 10.04 on the Ubuntu website.

Answer 2

I'm not telling you how to do this, it's beyond the scope of this forum IMO⁽¹⁾. I'm only saying what I think you can do.

There really isn't an easy way to do this. You really have to know a bit about apache configuration and dig down in the configuration files. In addition to that you need a SSL certificate

The easiest way would be to tell your web server to stop listening to port 80⁽²⁾ and only listen to port 443. A better solution would be to have apache redirect all connections to port 80 to port 443

_{⁽¹⁾ And beyond my expertise
⁽²⁾ Or block port 80 in your firewall}