Chapter 3. Securing Your Server

To make your customers feel safe doing business with you over the Web, your Web server needs to be secure. Secure servers use the Secure Sockets Layer (SSL) protocol, which encrypts the data sent back and forth between a browser and the server. When your browser is communicating using SSL, you'll see the https: prefix before the Uniform Resource Locator (URL) in the navigation bar.

A secure server uses a certificate to identify a website to Web browsers. A certificate is provided by a trusted third party (a Certificate Authority, or CA). A certificate from a reputable CA guarantees that a website is associated with a particular company or organization. You must install either a test certificate or a certificate signed by a CA before your secure Web server will run.

Customers feel more comfortable when making purchases from websites if they know that their transactions are secure, but secure servers aren't used only for electronic commerce. A secure server may also be used to transmit sensitive data such as sales figures to sales people on the road or to business partners over the Internet.

This chapter will guide you through the process of securing your server.

First, you'll need to create a public and private key pair, which you'll then use to create a certificate request. Then you'll need to get a certificate signed by a CA. This chapter provides instructions on how to get test and signed certificates from VeriSign (http://www.verisign.com) and Thawte (http://www.thawte.com).

	Please Note
	You can get test and signed certificates from any CA that you choose, and not just the CAs that are mentioned in this manual.

Once you have a signed certificate from the CA of your choice, you'll learn how to install it on your Red Hat Linux Secure Server.

When you use a signed certificate, you guarantee the identity of the organization running the server. For example, if the certificate says the website is Red Hat's, and the user trusts the CA, then there is no reason to doubt that any files or programs downloaded from that site really are from Red Hat.

Using Existing Keys and Certificates

If you already have an existing key and certificate (for example, if you're installing the Red Hat Linux Secure Server to replace another company's secure Web server product), you will probably be able to use your existing key and certificate with the Red Hat Linux Secure Server. However, there are two known circumstances in which you will not be able to use your existing key and certificate. First, you can't use your existing key and certificate if you're changing your IP address or domain name. Second, you can't use your existing key and certificate if you have a certificate from VeriSign and you're changing your server software.

You can't use your old key and certificate if you are changing your IP address or domain name. Certificates are issued for a particular IP address and domain name pair. You will need to get a new certificate if you're changing your IP address or domain name.

VeriSign is a widely used CA. If you already have a VeriSign certificate for another purpose, you may have been considering using your existing VeriSign certificate with your new Red Hat Linux Secure Server. However, you won't be allowed to, because VeriSign issues certificates for one particular server software and IP address/domain name combination.

If you change either of those parameters (for example, if you previously used another secure Web server product and now you want to use the Red Hat Linux Secure Server), the VeriSign certificate you obtained to use with the previous configuration will not work with the new configuration. You will need to obtain a new certificate.

If you have an existing key and certificate that you can use, you will not have to follow the instructions contained in Chapter 3. You do need to move and rename the files which contain your key and certificate.

Move your existing key file to:

/etc/httpd/conf/server.key

Move your existing certificate file to:

/etc/httpd/conf/server.crt

After you've moved your key and certificate, skip to the section called Installing and Testing Your Certificate.