Untuk melakukan instalasi SSL di sistem lokal dengan Fedora 18 bisa menggunakan OpenSSL. Tetapi SSL yang kita buat akan menampilkan untrusted pada browser, karena ini adalah percobaan di sistem lokal jadi tidak terlalu bermasalah. Web server yang kita gunakan adalah Apache.

Instalasi

Buka terminal, lalu login sebagai root

su - 
atau 
su root

install Apache, mod_ssl dan openssl

yum install httpd mod_ssl openssl

untuk mempermudah tutorial kali ini, kita akan menggunakan konfigurasi bawaan dari apache tanpa menggunakan virtualhost.

Konfigurasi SSL

Buat sebuah folder ssl di /var/www/html lalu berpindah ke folder ssl tersebut

mkdir /var/www/html/ssl ; cd /var/www/html/ssl

Generate key dan CSR (Certificate Signing Request) dengan bantuan OpenSSL

openssl req -new -x509 -days 365 -nodes -out local.csr -keyout local.key

contoh pengisian untuk perintah diatas

Generating a 2048 bit RSA private key
....................................................................................+++
....................................................+++
writing new private key to 'local.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:ID
State or Province Name (full name) []:Sumatera Utara
Locality Name (eg, city) [Default City]:Berastagi
Organization Name (eg, company) [Default Company Ltd]:Jaranguda
Organizational Unit Name (eg, section) []:SSL
Common Name (eg, your name or your server's hostname) []:localhostku
Email Address []:admin@localhostku

Buka file /etc/httpd/conf.d/ssl.conf dengan editor favorite anda, disini saya akan menggunakan nano

nano  /etc/httpd/conf.d/ssl.conf

Ubah bagian

#DocumentRoot "/var/www/html"
#ServerName www.example.com:443
#SSLCertificateFile /etc/pki/tls/certs/localhost.crt
#SSLCertificateKeyFile /etc/pki/tls/private/localhost.key

menjadi

DocumentRoot "/var/www/html"
ServerName localhost:443
SSLCertificateFile /var/www/html/ssl/local.csr
SSLCertificateKeyFile /var/www/html/ssl/local.key

sekarang jalankan Apache

service httpd start

bila tidak ada error yang muncul, buka browser anda lalu arahkan ke https://localhost bila muncul error seperti gambar dibawah ini (tampilan pada browser Google Chrome)
ssl error warning
klik saja Proceed anyway
https di apache fedora 18

Mengatasi Error

Bila muncul error

[Sun Jan 27 01:48:14.001376 2013] [ssl:emerg] [pid 3905] AH02312: Fatal error initialising mod_ssl, exiting.
[Sun Jan 27 01:49:19.581011 2013] [suexec:notice] [pid 3930] AH01232: suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Sun Jan 27 01:49:20.000401 2013] [ssl:notice] [pid 3930] AH01886: SSL FIPS mode disabled
[Sun Jan 27 01:49:20.001059 2013] [ssl:emerg] [pid 3930] AH02241: Init: Unable to read server certificate from file /var/www/html/ssl/local.csr
[Sun Jan 27 01:49:20.001129 2013] [ssl:emerg] [pid 3930] SSL Library Error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Sun Jan 27 01:49:20.001173 2013] [ssl:emerg] [pid 3930] SSL Library Error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error (Type=X509)
[Sun Jan 27 01:49:20.001192 2013] [ssl:emerg] [pid 3930] AH02312: Fatal error initialising mod_ssl, exiting.

coba check certificate yang tadi anda buat dengan perintah

openssl x509 -noout -text -in local.csr

bila muncul pesan seperti dibawah ini, ganti certificate anda dengan yang baru, dengan menjalankan perintah di awal tutorial ini

unable to load certificate
139847712094048:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:696:Expecting: TRUSTED CERTIFICATE

Leave a comment

Your email address will not be published. Required fields are marked *