
SSL OVERVIEW:
Web clients and Web servers often transmit sensitive information. 
Protecting this information is typically accomplished by sending the
data in an encrypted form and subsequently decrypting the data on the
receiving side. The Secure Sockets Layer (SSL) protocol provides several
features that enable secure transmission of Web traffic. These features
include data encryption, server authentication, and message integrity.
To enable secure communication from Web clients to Security Reporting
Center using SSL, you must first enable SSL support.

IMPORTANT: 
The steps provided describe how to enable basic SSL functionality and
generate certificates only. Depending on your network configuration and security
needs, you may need to consult outside documentation. For advanced
configuration concerns, refer to the SSL resources at http://
www.apache.org and http://www.modssl.org.

NOTE: 
After you enable SSL, the HTTP interface continues to be enabled on port
9000. 

To disable HTTP in Apache, edit the following file: 
 *install root*/common/apache/conf/httpd.conf.

Comment out the following lines by placing a # sign in front of them, for example #Port 9000.

 Port 9000
 Listen 9000



SSL INSTALLATION PROCEDURE:


                       ## Sun Solaris ##

1. Install Security Reporting Center, using the instructions in
the User Guide for Security Reporting Center.

2. As the SRC user, execute install.apache-ssl. This enables SSL for
Apache and installs a self-signed certificate for testing purposes. 
Access the secure interface at https://<hostname>:9443. 

*Install your own certificate at this point, or follow the instructions below.


To create a valid SSL certificate:

1. Using the openssl command-line utility, generate an RSA private key.
The openssl command-line utility is included in the Security Reporting
Center distribution, and can be found in <SRC root directory>/common /
apache/bin. At the command line, type:

cd <SRC root>/common/apache/bin ps -ef > ~/.rnd
./openssl genrsa -des3 -rand ssl.rnd -out server.key 1024

2. The openssl utility prompts you for a pass-phrase. Save this pass-phrase
in a secure location.

NOTE: If you want a DSA private key, replace genrsa with gendsa. To
encrypt your key with DES rather than 3DES, replace -des3 with -des.

3. Typically, the Apache Web server prompts you for your pass phrase when
the server is started. If you want to start the DCS without manual
interventions, use the following steps:

a)Type the following at a command-line:

  cp server.key server.key.org
  openssl rsa -in server.key.org -out server.key

b)To change the mode of the server.key file, type:

  chmod 400 server.key

c)To copy the private key to your Apache installation, type:

  cp server.key <SRC install dir>/common/apache/conf/ssl.key

4. Create a Certificate Signing Request. Using the openssl command-line
utility, type:

 ./openssl req -new -config openssl.cnf -key server.key -out server.csr

5. The openssl utility prompts you for a variety of information. Provide
information based on your SRC installation. This creates the server.csr
file. Send this file to a Certificate Authority for signing.

6. When you get a response (a signed certificate) from the Certificate
Authority, copy the response to your Apache installation using the
following command:

 cp <signed cert.> <SRC install>/common/apache/conf/ssl.crt/server.crt

7. Re-start Apache with SSL enabled by typing:
 
 <SRC install dir>/common/bin/restartallui.sh

8. To verify that your SSL-enabled Web server started, type the following:

 ps -elf | grep httpd

If Apache has started, you should see several httpd processes running. If
not, look at the <Apache install directory>/logs/error_log file to diagnose
the problem.


                       ## Microsoft Windows ##

1. Install Security Reporting Center, using the instructions in
the User Guide for Security Reporting Center.

2. Execute SSLUpdate.exe. This enables SSL for Apache and installs a
self-signed certificate for testing purposes. Access the secure
interface at https://<hostname>:9443. 

You can install your own certificate at this point or follow the instructions below.

To create a valid SSL certificate:

1. Using the openssl command line utility, generate an RSA private key.
The openssl utility is included in the SRC distribution, and can be found in
<SRC root directory>/common /apache/bin directory. Type the following at
the command line:
 
 cd <SRC root>/common/apache/bin
 
2. Run openssl.exe.

3. At the openssl> prompt, type:

 genrsa -des3 -rand ssl.rnd -out server.key 1024
 
4. The openssl utility prompts you for a pass-phrase. Save this pass-phrase
in a secure location.

NOTE:If you want a DSA private key, replace genrsa with gendsa. To
encrypt your key with DES rather than 3DES, replace -des3 with -des.

5. Typically, the Apache Web server prompts you for your pass phrase when you 
start the server. If you want to start SRC without manual interventions,
perform the following steps:
 
a)To copy the server key, type the following at the command line:
  
  copy server.key server.key.org
 
b)Run openssl.exe.
 
c)At the openssl> prompt, type the following:

  rsa -in server.key.org -out server.key

d)Copy the private key to your Apache installation by typing:
  
  copy server.key <SRC install dir>/common/apache/conf/ssl.key
  
6. Create a Certificate Signing Request:

a)Run openssl.exe.
 
b)Type the following at The OpenSSL> prompt:
  
  req -new -config openssl.cnf -key server.key -out server.csr
   
7. The openssl utility prompts you for a variety of information. Provide
information based on your SRC installation. This creates the server.csr
file. Send this file to a Certificate Authority for signing.

8. When you get a response (a signed certificate) from the Certificate
Authority, copy the response to your Apache installation using the
following command:

 copy <signed certificate> <SRC install dir>/common/
 apache/conf/ssl.crt/server.crt

9. Re-start the Apache service.