HTTPS
Brief notes on data encryption
The data encryption is used to protect the data that is sent between the client and
the server. There are two types of algorithm: symmetric and asymmetric data
encryption algorithms. The difference between the two types of algorithm is
that for the symmetric algorithms the same key is used both for encryption and
decryption. These algorithms are not used by servers with a potentially large
number of clients because the data captured can be decrypted by any client
that know the key and because the key needs to be distribuite in a safe
manner(for example using a floppy disk) and not distributing it on a large
network like internet. The asymmetric algorithms work in a different way,
the data encrypted with a key can be decrypted only with the other key and
viceversa. Anyone know the public key but only the owner knows the private
one. In this way the key owner do not have to distribuite the key only to
know clients but he can distributes it to a large scale network.
How create SSL certificates with OpenSSL
A certificate is needed to certify your identity through a
CA(Certification Authority). You can use a certificate without register it to
third party CA but creating a Root Certification certificate.
You can find all the necessary to create certificates in the library
OpenSSL at: www.openssl.org.
After its installation go in the binaries directory and type:
openssl genrsa -out server.key
This will create a private key for encode your data.
After run this command:
openssl req -new -x509 -days 730 -config openssl.cnf -key server.key -out server.pem
to create the public certificate. In this way the certificate can be used for
730 days and the public key will be the server.pem file.
Use certificates in MyServer
To configure certificates in MyServer you have to put the two files: server.key,
server.pem in the certificates folder under the MyServer installation path.
After this you have to configure an https virtual host in the virtualhosts.xml file.
<VHOST>
<NAME>Every connection</NAME>
<PORT>443</PORT>
<SSL_PRIVATEKEY>certificates/server.key</SSL_PRIVATEKEY>
<SSL_CERTIFICATE>certificates/server.pem</SSL_CERTIFICATE>
<PROTOCOL>HTTPS</PROTOCOL>
<DOCROOT>web</DOCROOT>
<SYSFOLDER>system</SYSFOLDER>
<ACCESSLOG>logs/myServer.log</ACCESSLOG>
<WARNINGLOG>logs/myServer.err</WARNINGLOG>
</VHOST>
With this host we put an https listener on the port 443(the default one for HTTPS)
and we use the file certificates/server.key for the private key and the
certificates/server.pem file for the public one.