3.2OpenSSL and HTTPS Configuration

Plaintext HTTP can be eavesdropped on or tampered with, so nearly every production web server runs HTTPS. Configuring TLS in Apache, and the OpenSSL operations that manage the underlying keys and certificates, are core practical skills tested at L2.

3.2.1Certificate/key storage and openssl operations

• Certificates, private keys, and CA certificates are conventionally kept under /etc/ssl/ (common on Debian-family systems) or /etc/pki/ (common on RHEL-family systems).
• The openssl command handles the full certificate/key lifecycle: generating private keys, creating certificate signing requests (CSRs), issuing self-signed certificates, and inspecting certificate contents.

3.2.2Apache TLS directives

• SSLEngine on turns on SSL/TLS for that VirtualHost. SSLCertificateFile points to the server certificate and SSLCertificateKeyFile to its matching private key (certificate and key must always be a matched pair).
• SSLProtocol controls which protocol versions are allowed (e.g., disabling old SSLv3 and permitting only TLS), while SSLCipherSuite controls the allowed cipher combinations—both used to exclude weak configurations.
• When validating a CA—for client certificate authentication, for example—specify SSLCACertificateFile (a single bundled file of CA certificates) or SSLCACertificatePath (a directory of CA certificate files).

A typical rollout clarifies the pieces. First, generate a private key with openssl, then either create a CSR from that key to send to a certificate authority, or issue a self-signed certificate on the spot for internal testing. Place the resulting certificate and key under /etc/ssl/ or /etc/pki/, tightening permissions so only root (or Apache's run user) can read the private key. In the Apache VirtualHost, first enable TLS with SSLEngine on, then point to the certificate and key separately: SSLCertificateFile /etc/ssl/certs/example.crt and SSLCertificateKeyFile /etc/ssl/private/example.key. Mismatching the certificate and key pair causes a startup error, so verifying they match is the first thing to check. Further, explicitly disable old protocols with something like SSLProtocol -all +TLSv1.2 +TLSv1.3, and use SSLCipherSuite to permit only a vetted set of strong ciphers—avoiding a permissive "allow everything" configuration. When mutual TLS via client certificates is required, add trusted CA information with SSLCACertificateFile or SSLCACertificatePath. These directives are Apache-specific, but generating, inspecting, and converting the keys and certificates themselves is consistently the job of the openssl command.

3.2.3Section summary

• Enable with SSLEngine on; SSLCertificateFile = certificate / SSLCertificateKeyFile = private key; stored under /etc/ssl/, /etc/pki/
• SSLProtocol = allowed protocols / SSLCipherSuite = allowed ciphers; CA validation via SSLCACertificateFile (file) / SSLCACertificatePath (directory); key/cert operations via openssl