How to configure Apache

This document provides information on how to configure the Apache publishing profile to make it possible to install and publish certificates.

Requirements

• An Apache server with SSL parameters activated.
• A certificate generated and signed by a CA. More information in How to create a request and How to sign a request.
• A local credential on the Apache server with read and write permissions in the following directories:
  • /etc/ssl/certs/
  • /etc/ssl/private/
• A credential registered in Segura™ with the IP address or domain of the Apache server. More information on how to configure a credential in Segura™ in How to configure a credential in Segura™.

Configure Apache

To configure Apache, see the following steps:

1. On Segura™, in the navigation bar, hover over the Products menu and select Certificate Manager.
2. In the side menu, select Publishing > Publishing profiles.
3. In the actions button, select Apache.
4. In the Settings tab, enter the following information:
   1. In the Profile name *, enter the profile's name.
   2. In the Credential username, enter the credentials' name.
   3. (Optional): Check the Use a registered credential to access all devices option and, in the Access credential registered in the system, select the access credential registered in Segura™ to be used.
5. Click Continue.
6. In the Apache tab, enter the following fields:
   1. In the Site field, enter the name of Apache's server configuration file. For example: default-ssl.conf. This field is not used to publish: Segura® uses only the Configuration file path field.
   2. In the Configuration file path field, enter the full path of the configuration file. For example: /etc/apache2/sites-available/default-ssl.conf.
   3. In the Port field, enter the port where Apache serves the certificate. The default is 443. Segura® uses this port only for the post-publication check.
7. Click Continue.
8. In the Devices tab, select the Apache server.
   1. The device must be previously registered in Segura™.
   2. The Network Connector column shows Yes or No, depending on whether the device has its own Network Connector agent configured.
9. In the Review tab, review all information entered previously, and click Save.

Post-publication check

After installing the certificate, Segura® connects to the server on the port entered in the Port field and compares the fingerprint of the certificate the server presents with the fingerprint of the published certificate:

• If the fingerprints match, the publication succeeds.
• If the fingerprints differ, the publication fails with the error Fingerprint comparison failed.
• If Segura® cannot connect to the server, the publication still ends successfully. The execution log records that Segura® could not communicate with the server on that port.

The check connects only over TLS 1.2. Through a Network Connector, it connects to 127.0.0.1:<port> on the server, without SNI. Through a direct connection, it connects to the device's hostname.

Network Connector behavior

Apache publishing uses the Network Connector configured on the device for both the installation and the post-publication check. The execution log shows the route each step used: Network Connector: <agent> for the installation, and TLS verification via Network Connector or TLS verification: direct connection to <host>:<port> for the check.