Website Security Solutions | Latest Guides | Blog

Red Hat Enterprise Linux (RHEL) is a Linux-based operating system from Red Hat designed for organizations. RHEL can work on desktops, on servers, in hypervisors or in the cloud. Red Hat and its community-supported counterpart, Fedora, are among the most widely used Linux distributions in the world.
Red Hat Enterprise Linux has multiple variants, with server versions for x86, x86-64, PowerPC, Itanium and IBM Systems. It also includes desktop versions for x86 and x86-64. As of November 2021, the latest version of RHEL is RHEL 8.

Pre-requisite commands:-

Execute the following commands to make sure that you have the httpd webserver and their dependencies installed-

yum install httpd
yum install mod_ssl
yum install openssl
yum install nano

Also, navigate to yourdomain.com (or IP Address) and check whether the default page is visible.

rhel-homepage

Step 1. Generating a CSR and Private Key with OpenSSL

1: Execute the following command to generate a private key and a CSR -

sudo openssl req -new -newkey rsa:2048 -nodes -keyout /etc/pki/tls/private/server.key -out /etc/pki/tls/private/server.csr

This will create a private key and a CSR with the name of server.key and server.csr respectively; in the default ssl directory.

You will then get a prompt asking you to input the following details regarding your CSR:-

Country Name (2 letter code) [AU]: Type in the 2 letter abbreviation for your country.
State or Province Name (full name) [Some-State]: Full name of the state
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Locality Name (eg, city) []: Complete name of the city, no abbreviations
Organization Name (eg, company) [Internet Widgits Pty Ltd]: If you are a business; Enter your legal entity name. If you're not a business, any value entered will not be used in your certificate.
Organizational Unit Name (eg, section) []: If you are a business; Write the appropriate division of your company. It is best to use something generic such as "IT".
Common Name (e.g. server FQDN or YOUR name) []: Enter your domain name
Email Address []: Enter your email address

After you hit Enter, your Private Key and CSR should be saved successfully in the default ssl directory.

2: To view your CSR, type in the following command:

sudo cat /etc/pki/tls/private/server.csr

You can save the CSR in a .txt file or directly proceed to certificate configuration.



Step 2. Order and Configure the SSL Certificate

Now we need to order an SSL Certificate. If you visit our SSL Certificates List page, you will have a selection of Certificates you can order from. If you have a simple website and want to one domain, you can choose from a variety of standard SSL Certificates. If you are a business website you may want to look at using a Business SSL, we recommend a DigiCert SSL such as the DigiCert Basic SSL.
If you require any assistance with selecting an SSL Certificate, please feel free to contact our sales/support team and they will be happy to assist.

1: Order the SSL and complete the checkout process.

2: Once you have completed the SSL Certificate Purchase you can begin the configuration process. This can be started by going into your SSLTrust account and managing your recent purchase.

manage ssl

You then will need to click the Submit Configuration button to begin the configuration process.

submit ssl configuration

3: You now need to paste in the CSR you generated using the OpenSSL library in the Ubuntu CLI. This includes the lines:

  -----BEGIN CERTIFICATE REQUEST----
  -----END CERTIFICATE REQUEST-----
configure SSL

Select Apache/Other for your Web Server Type.

enter ssl details

You will need to also enter the Site Administrator Contact Information.

This information is to be of the individual who is responsible to approve and SSL Certificate. If it is a business SSL, it needs to be a contact under the business.

The Technical Contact Information is the details of the individual responsible for the installation and management of the Certificate.
If you have ordered a business SSL, you will also be required to enter your business details. These should be the correct address and phone number and legal entity name. They will be required to be validated by the Certificate Authority, any mistakes will cause delays. More information on Business Validation can be found here.

4: Click Continue to go to the next Step. Here you need to select the Authentication Method to validate your domain name. This is required to prove you own the domain name and have permission to issue an SSL Certificate for the domain.

select domain validation method

Select the method that will be the easiest for you to use; File-Based Authentication ( HTTP / HTTPS ), CNAME Based Authentication ( DNS ) or Certificate Approver Email.

If you have access to one of the listed emails, this can be the quickest method

Click Continue/Submit to finish the Configuration process.

After you complete the domain validation via your selected method, your SSL will be issued. If you ordered a Business SSL, you will need to wait for the Certificate Authority to complete the Business address and phone validation. If the validation has not progressed, or you have not received your Certificate after some time, please contact our support team so we can check on its status.

sectigo validation manager



Step 3. Upload the SSL Certificate files to your server

When your SSL Certificate has been issued, you will be emailed the Certificate Directly from the Certificate Authority. You can also download it from your SSLTrust Portal. Downloading it from the SSLTrust Portal is a good option as we format the certificate in an easy to use way.

Again; View your certificate management page within SSLTrust

manage ssl 2

1: Click on the Manage button and collect/download your certificate

download ssl

2: Go to the first column and click on copy to clipboard

Copy SSL Certificate

Now, execute the following command-

sudo nano /etc/pki/tls/certs/certificate.crt

Paste your certificate and exit the buffer.

3: Head over to the certificate collection page and click on copy to clipboard on the Intermediate certificate.
Note:- It is recommended that you install your intermediate certificate too so as improve compatibility with browsers; and to minimize the chances of your visitors getting unwanted security warnings on your website.

Copy Intermediate Certificate
sudo nano /etc/pki/tls/certs/intermediate.crt

Paste your Intermediate certificate and exit the buffer.

After having uploaded the certificate files to your server, it is now time to configure httpd SSL Parameters.



Step 4. Configure the httpd SSL Parameters

sudo nano /etc/httpd/conf.d/ssl.conf

Now edit the secure web server configuration file and locate/modify the directives as shown below.

SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
SSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
SSLCertificateFile /etc/pki/tls/certs/certificate.crt
SSLCertificateKeyFile /etc/pki/tls/private/server.key
SSLCACertificateFile /etc/pki/tls/certs/intermediate.crt

Save and exit the buffer.

Verify the changes with:

httpd -t

If the configuration is correct, you will get a prompt with Syntax OK, otherwise make the necessary changes.



Step 5. Configure the httpd Virtual Host

sudo nano /etc/httpd/conf/httpd.conf
 
SSLEngine on
SSLCertificateFile /etc/pki/tls/certs/certificate.crt
SSLCertificateKeyFile /etc/pki/tls/private/server.key
SSLCACertificateFile /etc/pki/tls/certs/intermediate.crt
servername www.yourdomain.com
Documentroot /var/www/html
 

Change yourdomain.com to your domain name.

Verify the changes with:

httpd -t

If the configuration is correct, you will get a prompt with Syntax OK, otherwise make the necessary changes.



Step 6. Add the service and the port number to the Firewall

firewall-cmd --permanent --add-service=https
firewall-cmd --permanent --add-port=443/tcp
firewall-cmd --reload



Step 7. Enable and Restart the httpd service

systemctl enable httpd.service
systemctl restart httpd.service



Step 8. Check the SSL is working

It is a good idea to go to your website and see if it works via https://www.yourdomain.com We also recommend you use this tool to check the install has been completed successfully: www.ssllabs.com/ssltest/

SLLabs Test A RatingYou may need to get your web developer, or update your website yourself, to make sure all files use https:// and all links to your site and within your website use https://
If you require any assistance with your SSL Installation please contact our friendly support team.


Author: Siddiqui Ammar
Published: