cd \/etc\/ssl\/srvweb.home.lan<\/span>\/<\/span><\/li>\r\n<\/ul>\r\n
$\"\"$ <\/a><\/p>\r\n<\/div>\r\n
Nous commencerons par g\u00e9n\u00e9rer la cl\u00e9 priv\u00e9e pour l\u2019autorit\u00e9 de certification en rentrant un mot de passe.<\/div>\r\n
Ce dernier sera absolument n\u00e9cessaire pour la signature de certificat, conservez le pr\u00e9cieusement:<\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n
\r\n
\r\n
\r\n
\r\n
\r\n
openssl genrsa -des3 -out homeCA.<\/span>key<\/span> 2048<\/span><\/li>\r\n
Enter PEM pass phrase:<\/span><\/li>\r\n
Verifying - Enter PEM pass phrase:<\/span><\/li>\r\n<\/ul>\r\n
$\"\"$ <\/a><\/p>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n
Puis nous g\u00e9n\u00e9rerons le certificat root de l\u2019autorit\u00e9 de certification \u00e0 destination des clients au format .pem:<\/p>\r\n
\r\n
\r\n
\r\n
\r\n
\r\n
openssl req -x509 -<\/span>new<\/span> -nodes -key homeCA.<\/span>key<\/span> -sha256 -days <\/span>3650<\/span> -out homeCA.<\/span>pem<\/span><\/li>\r\n
Enter pass phrase for<\/span> homeCA.<\/span>key<\/span>:<\/span><\/li>\r\n<\/ul>\r\n
$\"\"$ <\/p>\r\n<\/div>\r\n
You are about to be asked to enter information that will be incorporated<\/span>into your certificate request.<\/span>What you are about to enter is what is called a Distinguished Name or a DN.<\/span>There are quite a few fields but you can leave some blank<\/span>For<\/span> some fields there will be a default value,<\/span>If<\/span> you enter <\/span>'.'<\/span>, the field will be left blank.<\/span><\/div>\r\n
\r\n
-----<\/span><\/div>\r\n<\/div>\r\n
\r\n
\r\n
Country <\/span>Name<\/span> (<\/span>2<\/span> letter code<\/span>)<\/span> [<\/span>AU<\/span>]<\/span>:FR<\/span><\/li>\r\n
State or Province <\/span>Name<\/span> (<\/span>full name<\/span>)<\/span> [<\/span>Some-State<\/span>]<\/span>:Ile de France<\/span><\/li>\r\n
Locality <\/span>Name<\/span> (<\/span>eg, city<\/span>)<\/span> []<\/span>:Paris<\/span><\/li>\r\n
Organization <\/span>Name<\/span> (<\/span>eg, company<\/span>)<\/span> [<\/span>Internet Widgits Pty Ltd<\/span>]<\/span>:HOME<\/span><\/li>\r\n
Organizational Unit <\/span>Name<\/span> (<\/span>eg, section<\/span>)<\/span> []<\/span>:IT<\/span><\/li>\r\n
Common <\/span>Name<\/span> (<\/span>e.<\/span>g<\/span>. server FQDN or YOUR name<\/span>)<\/span> []<\/span>:srvweb.home.lan<\/span><\/li>\r\n
Email Address <\/span>[]<\/span>:admin@home.lan<\/span><\/li>\r\n<\/ul>\r\n
$\"\"$ <\/p>\r\n<\/div>\r\n
Pour des raisons pratiques nous g\u00e9n\u00e8rerons \u00e9galement un certificat au format .crt:<\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n
\r\n
\r\n
\r\n
\r\n
\r\n
openssl x509 -<\/span>in<\/span> homeCA.<\/span>pem<\/span> -inform PEM -out homeCA.<\/span>crt<\/span><\/li>\r\n<\/ul>\r\n
$\"\"$ <\/a><\/p>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n
Nous cr\u00e9erons la cl\u00e9 priv\u00e9e utilis\u00e9e pour tous les serveurs de home.lan de telle mani\u00e8re que le certificat final soit un certificat home (*.home.lan).
Puis nous g\u00e9nererons le CSR (Certificate Signing Request) :<\/p>\r\n
\r\n
\r\n
\r\n
\r\n
\r\n
openssl<\/span> genrsa -out srvweb.home.lan<\/span>.<\/span>key<\/span> 2048<\/span><\/li>\r\n
openssl req -<\/span>new<\/span> -key srvweb.home.lan<\/span>.<\/span>key<\/span> -out srvweb.home.lan<\/span>.<\/span>csr<\/span><\/li>\r\n<\/ul>\r\n
$\"\"$ <\/a><\/p>\r\n<\/div>\r\n
\r\n
You are about to be asked to enter information that will be incorporated <\/span>into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank. For<\/span> some fields there will be a default value, <\/span>If<\/span> you enter <\/span>'.'<\/span>, the field will be left blank.<\/span><\/div>\r\n<\/div>\r\n
\r\n
-----<\/span><\/p>\r\n<\/div>\r\n
\r\n
\r\n
Country <\/span>Name<\/span> (<\/span>2<\/span> letter code<\/span>)<\/span> [<\/span>AU<\/span>]<\/span>:FR<\/span><\/li>\r\n
State or Province <\/span>Name<\/span> (<\/span>full name<\/span>)<\/span> [<\/span>Some-State<\/span>]<\/span>:Ile de France<\/span><\/li>\r\n
Locality <\/span>Name<\/span> (<\/span>eg, city<\/span>)<\/span> []<\/span>:Paris<\/span><\/li>\r\n
Organization <\/span>Name<\/span> (<\/span>eg, company<\/span>)<\/span> [<\/span>Internet Widgits Pty Ltd<\/span>]<\/span>:HOME<\/span><\/li>\r\n
Organizational Unit <\/span>Name<\/span> (<\/span>eg, section<\/span>)<\/span> []<\/span>:IT<\/span><\/li>\r\n
Common <\/span>Name<\/span> (<\/span>e.<\/span>g<\/span>. server FQDN or YOUR name<\/span>)<\/span> []<\/span>:srvweb.home.lan<\/span><\/li>\r\n
Email Address <\/span>[]<\/span>:admin@home.lan<\/span><\/li>\r\n<\/ul>\r\n<\/div>\r\n
Please enter the following <\/span>'extra'<\/span> attributes<\/span><\/div>\r\n
\r\n
to be sent with your certificate request<\/span><\/div>\r\n<\/div>\r\n
\r\n
A challenge password <\/span>[]<\/span>:<\/span><\/div>\r\n<\/div>\r\n
\r\n
An optional company name <\/span>[]<\/span>:<\/span><\/div>\r\n
$\"\"$ <\/a><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n
Nous cr\u00e9erons un fichier contenant les param\u00e8tres pour notre certificat HTTPS:<\/p>\r\n
\r\n
\r\n
\r\n
\r\n
\r\n
nano srvweb.home.lan<\/span>.<\/span>ext<\/span><\/li>\r\n<\/ul>\r\n
$\"\"$ <\/a><\/p>\r\n<\/div>\r\n
\r\n
authorityKeyIdentifier=keyid,issuer<\/span><\/div>\r\n<\/div>\r\n
\r\n
basicConstraints=CA:<\/span>FALSE<\/span><\/div>\r\n<\/div>\r\n
\r\n
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment<\/span><\/div>\r\n<\/div>\r\n
\r\n
subjectAltName = @alt_names<\/span><\/div>\r\n<\/div>\r\n
\r\n
[<\/span>alt_names<\/span>]<\/span><\/div>\r\n<\/div>\r\n
\r\n
DNS.<\/span>1<\/span> = *.home.lan<\/span><\/div>\r\n
$\"\"$ <\/a><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n
Enfin nous signerons notre certificat avec notre autorit\u00e9 de certification et obtiendrons le certificat public pour Apache.
Lors de ce processus le mot de passe de notre autorit\u00e9 de certification nous sera demand\u00e9:<\/p>\r\n
\r\n
\r\n
\r\n
\r\n
\r\n
openssl x509 -req -<\/span>in<\/span> srvweb.home.lan<\/span>.<\/span>csr<\/span> -CA homeCA.<\/span>pem<\/span> -CAkey homeCA.<\/span>key<\/span> -CAcreateserial -out srvweb.home.lan<\/span>.<\/span>crt<\/span> -days <\/span>3650<\/span> -sha256 -extfile srvweb.home.lan<\/span>.<\/span>ext<\/span><\/li>\r\n<\/ul>\r\n
$\"\"$ <\/a><\/p>\r\n<\/div>\r\n
\r\n
Certificate request self-signature ok<\/span><\/div>\r\n<\/div>\r\n
\r\n
subject=C = FR, ST = Ile de France, L = Paris, O = HOME<\/span>, OU = IT, CN = srvweb.home.lan<\/span>, emailAddress = admin@home.lan<\/span><\/div>\r\n<\/div>\r\n
\r\n
\r\n
Enter pass phrase <\/span>for<\/span> homeCA.<\/span>key<\/span>:<\/span><\/li>\r\n<\/ul>\r\n
$\"\"$ <\/a><\/p>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n
Configuration du VHost Apache<\/h4>\r\n
Nous devrons ensuite configurer le VHost n\u00e9cessaire \u00e0 la publication du site. Nous ex\u00e9cuterons donc la commande:<\/p>\r\n
\r\n
\r\n
\r\n
\r\n
\r\n
nano \/etc\/apache2\/sites-available\/srvweb.home.lan<\/span>.<\/span>conf<\/span><\/li>\r\n<\/ul>\r\n
$\"\"$ <\/a><\/p>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n
Et nous compl\u00e9terons ce fichier comme ci-dessous:<\/p>\r\n
\r\n
\r\n
\r\n
<<\/span>VirtualHost *:<\/span>80<\/span>><\/span><\/div>\r\n
\r\n
DocumentRoot \/var\/www\/srvweb.home.lan<\/span><\/div>\r\n<\/div>\r\n
\r\n
ServerName srvweb.home.lan<\/span><\/div>\r\n<\/div>\r\n
\r\n
Redirect permanent \/ https:<\/span>\/\/srvweb.home.lan<\/span>\/<\/span><\/div>\r\n<\/div>\r\n
\r\n
ErrorLog $<\/span>{<\/span>APACHE_LOG_DIR<\/span>}<\/span>\/srvweb_error.<\/span>log<\/span><\/div>\r\n<\/div>\r\n
\r\n
CustomLog $<\/span>{<\/span>APACHE_LOG_DIR<\/span>}<\/span>\/srvweb_access.<\/span>log<\/span> combined<\/span><\/div>\r\n<\/div>\r\n
\r\n
<<\/span>\/VirtualHost<\/span>><\/span><\/div>\r\n<\/div>\r\n
\r\n
\u00a0<\/div>\r\n<\/div>\r\n
\r\n
<<\/span>VirtualHost *:<\/span>443<\/span>><\/span><\/div>\r\n<\/div>\r\n
\r\n
ServerAdmin admin@home.lan<\/span><\/div>\r\n<\/div>\r\n
\r\n
DocumentRoot \/var\/www\/srvweb.home.lan<\/span><\/div>\r\n<\/div>\r\n
\r\n
ServerName srvweb.home.lan<\/span><\/div>\r\n
\u00a0<\/div>\r\n<\/div>\r\n
\r\n
SSLEngine On<\/span><\/div>\r\n<\/div>\r\n
\r\n
SSLCertificateFile \/etc\/ssl\/srvweb.home.lan<\/span>\/srvweb.home.lan<\/span>.<\/span>crt<\/span><\/span><\/div>\r\n<\/div>\r\n
\r\n
SSLCertificateKeyFile \/etc\/ssl\/srvweb.home.lan<\/span>\/srvweb.home.lan<\/span>.<\/span>key<\/span><\/span><\/div>\r\n
\u00a0<\/div>\r\n<\/div>\r\n
\r\n
<<\/span>Directory \/var\/www\/srvweb.home.lan<\/span>><\/span><\/div>\r\n<\/div>\r\n
\r\n
Options FollowSymlinks<\/span><\/div>\r\n<\/div>\r\n
\r\n
AllowOverride All<\/span><\/div>\r\n<\/div>\r\n
\r\n
Require all granted<\/span><\/div>\r\n<\/div>\r\n
\r\n
<<\/span>\/Directory<\/span>><\/span><\/div>\r\n<\/div>\r\n
\r\n
ErrorLog $<\/span>{<\/span>APACHE_LOG_DIR<\/span>}<\/span>\/srvweb_error.<\/span>log<\/span><\/div>\r\n<\/div>\r\n
\r\n
CustomLog $<\/span>{<\/span>APACHE_LOG_DIR<\/span>}<\/span>\/srvweb_access.<\/span>log<\/span> combined<\/span><\/div>\r\n<\/div>\r\n
\r\n
<<\/span>\/VirtualHost<\/span>><\/span><\/div>\r\n<\/div>\r\n
\r\n
\u00a0<\/div>\r\n
$\"\"$ <\/a><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n
Puis nous activerons le module Apache SSL:<\/p>\r\n
\r\n
\r\n
\r\n
\r\n
\r\n
s<\/span>udo a2enmod ssl<\/span><\/li>\r\n<\/ul>\r\n
$\"\"$ <\/a><\/p>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n
Nous cr\u00e9erons le lien symbolique et red\u00e9marrerons Apache:<\/p>\r\n
\r\n
\r\n
\r\n
\r\n
\r\n
sudo ln -s \/etc\/apache2\/sites-available\/srvweb.home.lan<\/span>.<\/span>conf<\/span> \/etc\/apache2\/sites-enabled\/srvweb.home.lan<\/span>.<\/span>conf<\/span><\/li>\r\n
sudo systemctl restart apache2<\/span><\/li>\r\n<\/ul>\r\n
$\"\"$ <\/a><\/p>\r\n
Importation du certificat dans Mozilla Firefox<\/h4>\r\n
\r\n
R\u00e9cup\u00e9rer le certificat cert.crt (Ici le fichier homeCA.crt)<\/li>\r\n
Ouvrir le navigateur Mozilla Firefox et se rendre sur l'url du serveur<\/li>\r\n
Importer le certificat<\/li>\r\n<\/ul>\r\n
$\"\"$ <\/a><\/p>\r\n
<\/p>\r\n
$\"\"$ <\/a><\/p>\r\n
$\"\"$ <\/a><\/p>\r\n
$\"\"$ <\/a><\/p>\r\n
$\"\"$ <\/a><\/p>\r\n
$\"\"$ <\/a><\/p>\r\n
$\"\"$ <\/a><\/p>\r\n
$\"\"$ <\/a><\/p>\r\n
$\"\"$ <\/a><\/p>\r\n
Installation du certificat dans le magasin de certificats de Windows<\/h4>\r\n
\r\n
Double clique sur le certificat<\/li>\r\n<\/ul>\r\n
$\"\"$ <\/a><\/p>\r\n
$\"\"$ <\/a><\/p>\r\n
$\"\"$ <\/a><\/p>\r\n
$\"\"$ <\/a><\/p>\r\n
$\"\"$ <\/a><\/p>\r\n
$\"\"$ <\/a><\/p>\r\n
$\"\"$ <\/a><\/p>\r\n
$\"\"$ <\/a><\/p>\r\n
$\"\"$ <\/a><\/p>\r\n
$\"\"$ <\/a><\/p>\r\n
Enjoy !<\/p>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n","protected":false},"excerpt":{"rendered":"
S\u00e9curiser un serveur web via HTTPS avec un certificat auto-sign\u00e9 Afin de s\u00e9curiser au mieux le service web, nous aurons besoin de mettre en place un certificat HTTPS.Si le serveur est connect\u00e9 \u00e0 internet nous pourrons utiliser Let\u2019s Encrypt.Ici par soucis de s\u00e9curit\u00e9 nous ne connecterons pas ce serveur vers l\u2019ext\u00e9rieur. Nous g\u00e9n\u00e9rerons donc notre\u2026 Lire la suite »<\/a><\/span><\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,12],"tags":[],"class_list":["post-1699","post","type-post","status-publish","format-standard","hentry","category-internet","category-linux"],"_links":{"self":[{"href":"https:\/\/bitsparadise.info\/index.php\/wp-json\/wp\/v2\/posts\/1699","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bitsparadise.info\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bitsparadise.info\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bitsparadise.info\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/bitsparadise.info\/index.php\/wp-json\/wp\/v2\/comments?post=1699"}],"version-history":[{"count":35,"href":"https:\/\/bitsparadise.info\/index.php\/wp-json\/wp\/v2\/posts\/1699\/revisions"}],"predecessor-version":[{"id":1938,"href":"https:\/\/bitsparadise.info\/index.php\/wp-json\/wp\/v2\/posts\/1699\/revisions\/1938"}],"wp:attachment":[{"href":"https:\/\/bitsparadise.info\/index.php\/wp-json\/wp\/v2\/media?parent=1699"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bitsparadise.info\/index.php\/wp-json\/wp\/v2\/categories?post=1699"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bitsparadise.info\/index.php\/wp-json\/wp\/v2\/tags?post=1699"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

Importation du certificat dans Mozilla Firefox<\/h4>\r\n\r\nR\u00e9cup\u00e9rer le certificat cert.crt (Ici le fichier homeCA.crt)<\/li>\r\nOuvrir le navigateur Mozilla Firefox et se rendre sur l'url du serveur<\/li>\r\n