linuxexpert-practice-labs/labs/lpic-3-303/331-2-x509-in-apache/README.md

LPIC-3 331.2: Certificates for encryption, signing and authentication

Apache with two HTTPS sites on one address, HSTS, a client-certificate area and OCSP stapling, all from a small lab CA.

Before you start

The lab points the made-up names alpha.test and beta.test at 127.0.0.1 in /etc/hosts, and checks that nothing listens on port 443 yet. Keep your CA, keys and certificates in /root/tls, with the file names the tasks give, and copy what Apache needs wherever you like. Ubuntu's package is apache2; on the RHEL family it's httpd with mod_ssl.

Tasks

1. In /root/tls, make a lab CA ca.crt (/O=Lab/CN=Lab TLS CA, key ca.key), and sign with it: alpha.crt and beta.crt (keys alpha.key and beta.key) for server authentication, each with its name (alpha.test, beta.test) as subject alternative name and the OCSP responder http://127.0.0.1:8888 in its authority information access; and a client certificate user.crt (key user.key) for /O=Lab/CN=lab-user, for client authentication.
2. Install Apache and serve two HTTPS sites on port 443: alpha.test, whose page says alpha site, and beta.test, whose page says beta site, each with its own certificate. Allow only TLS 1.2 and 1.3, and send HSTS (Strict-Transport-Security) on both. Apache must start at boot.
3. On alpha.test, make /admin/ (a page that says admin area) require a client certificate issued by the lab CA with organization Lab.
4. Run an OCSP responder for the lab CA on port 8888 with openssl ocsp and an index file that lists alpha.crt as valid, and turn on OCSP stapling, so that a client asking for the status of alpha.test gets a stapled good answer.

Hints

• openssl req -x509 ... -addext basicConstraints=critical,CA:TRUE; openssl req -new, then openssl x509 -req -CA ca.crt -CAkey ca.key -CAcreateserial -extfile with subjectAltName, extendedKeyUsage and authorityInfoAccess=OCSP;URI:... lines.
• Two <VirtualHost *:443> blocks with ServerName, SSLEngine on, SSLCertificateFile, SSLCertificateKeyFile, SSLProtocol and Header always set Strict-Transport-Security .... Ubuntu: a2enmod ssl headers, a2ensite. Check with apachectl configtest and openssl s_client -connect 127.0.0.1:443 -servername beta.test.
• SSLCACertificateFile, and in a <Location /admin>: SSLVerifyClient require, Require expr "%{SSL_CLIENT_S_DN_O} == 'Lab'". Test with curl --cacert ca.crt --cert user.crt --key user.key.
• An index line is V, the expiry as YYMMDDHHMMSSZ, an empty field, the serial, unknown and the subject, separated by tabs. openssl ocsp -port 8888 -index ... -CA ca.crt -rsigner ca.crt -rkey ca.key, in the background. SSLStaplingCache (outside the virtual hosts) and SSLUseStapling on; openssl s_client ... -status. On the RHEL family, see what SELinux says when Apache asks the responder.