'''NOTE:''' Following this guidance is at your own risk and could break your HDA. This has been tested with Amahi 10, Fedora 25 which is still in development.

[[User:Sag47|Sag47]] 00:38, 15 June 2011 (PDT). Updates and clarifications [[User:Spaceman|spaceman]] 15:23, 27 March 2017 (BST).[[User:Tamorgen|Tamorgen]] 09:15, 31 Oct 2018 (EST). Made changes for Subject Alternative Name.

I assume you already have Fedora 23 25 installed with Amahi up and running.

'''NOTE:''' Leaving defaults will not make your server less secure. Make sure that you change "asecretpassword" in the commands below to something else. Otherwise any commands which don't have "asecretpassword" in it can be copied and pasted. This has to do with the challenge password for the private key. If you don't understand what I mean then you should read about [http://en.wikipedia.org/wiki/Public-key_cryptography public-key cryptography] which is essentially what SSL uses.Create As of Chrome version 58, the Chrome browser requires SSL certificates to use SAN (Subject Alternative Name) and has removed Common Name (CN). Using a sub-folder CN will produce an error within the Security Overview section of the certificate, telling the user that the SAN is missing. A new method of '''creating the certificate is required. 1. Change directory to /etc/httpd/''' called '''ssl.crt''', and switch users <pre><nowiki>mkdir cd /etc/httpd/ssl.crtsudo -s</nowiki></pre>Generate 2. Create a new Secure key filecreateRootCA.sh using vi, called server.key.orgnano, and output the file to /etc/httpd/ssl.crt (our newly created folder) '''**REMEMBER TO CHANGE "asecretpassword" TO A PASSWORD OF YOUR CHOICE**'''or your favorite text editor.  <pre><nowiki>#!/usr/bin/env bashmkdir ~/ssl/openssl genrsa -des3 -passout pass:asecretpassword -out ~/etcssl/httpdrootCA.key 2048openssl req -x509 -new -nodes -key ~/ssl.crt/serverrootCA.key-sha256 -days 1024 -out ~/ssl/rootCA.org 1024pem</nowiki></pre> Create server3.crt and serverNow create another file createselfsignedcertificate.csr from our newly self-generated key (server.key.org)sh: <pre><nowiki>openssl req -new -passin pass:asecretpassword -passout pass:asecretpassword -key #!/usr/bin/env bashmkdir /etc/httpd/ssl.crtmkdir /serveretc/httpd/ssl.key.org openssl req -new -sha256 -nodes -out /etc/httpd/ssl.crt/server.csr -days 3650openssl req -x509 -passin pass:asecretpassword -passout passnewkey rsa:asecretpassword 2048 -key keyout /etc/httpd/ssl.crt/server.key-config <( cat /etc/httpd/server.csr.org cnf )openssl x509 -req -in /etc/httpd/ssl.crt/server.csr -CA ~/ssl/rootCA.pem -CAkey ~/ssl/rootCA.key -CAcreateserial -out /etc/httpd/ssl.crt/server.crt -days 3650-sha256 -extfile v3.ext</nowiki></pre> 4. Create a thrid the configuration file, server.key, from from our self-generated key (servercsr.keycnf.org): <pre><nowiki>openssl rsa [req]default_bits = 2048prompt = nodefault_md = sha256distinguished_name = dn [dn]C=USST=MarylandL=AnnapolisO=Home AdministratorOU=HDA DomainemailAddress=your-passin pass:asecretpassword address@your-in /etc/httpd/ssldomain.crtcomCN = localhost</server.key.org -out nowiki></etc/httpd/sslpre> 5.crt/serverNow, create a file called v3.keyext for the x509 v3 certificate </nowikipre></prenowiki>Create another sub-folder of authorityKeyIdentifier=keyid,issuerbasicConstraints=CA:FALSEkeyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEnciphermentsubjectAltName = @alt_names [alt_names]DNS.1 = localhostDNS.2 = ''hostname.yourdomain'/etc/httpd/'DNS.2 = hdaDNS.3 = hda.'' called yourdomain''DNS.4 = cockpit.'ssl.key'yourdomain'', and move our newly created server</nowiki></pre> 6.key Now it's time to this foldercreate your certificates. Run createRootCA.sh. Follow the prompts <pre><nowiki>bash ./createRootCA.sh</nowiki></pre> Then createselfsignedcertificate.sh <pre><nowiki>mkdir bash ./etccreateselfsignedcertificate.sh</httpdnowiki></pre> 7. Copy your newly created server.key to the ssl.keydirectory.<pre><nowiki>mv cp /etc/httpd/ssl.crt/server.key /etc/httpd/ssl.key/server.key

Modify the apache initialization for allowing SSL virtual hosts. Just in case you decide you want more than one virtual host to be capable of SSL. ('''NOTE''': NameVirtualHost has no effect and will be removed in the next release /etc/httpd/conf.d/00-init.conf:1; this section can be ommited).

You need to modify 01-platform-ssl.conf and <pre><nowiki>nano 01-platfrom-ssl.conf</pre>...replace the line with "<VirtualHost *:80>" to with the following lines...

Modify /etc/httpd/conf.d/'''01-platform.conf''' and go down to the rewrite rules<pre><nowiki>nano 01-platform. conf</nowiki></pre>Below the last rewrite rule , just before the line "# this was only for FCGI" put above the following code.<location /> section, add:

Now that you're done go ahead and visit '''<nowiki>http://hda</nowiki>''' and watch it turn into '''<nowiki>https://hda</nowiki>'''! Understand that the certificates you generated have not been verified by a certificate authority so you'll need to confirm a security exception.

If all goes well and you get "'''Syntax OK'''" then you can start your Apache server again.