Section 4 Using the PKI and Certificate for Securing a Web Site In this section, we will explore how the PKI and certificates can be used by a web server to secure web browsing. To make it simpler, please add the following entry to the /etc/hosts file on the Linux computer: 127.0.0.1 SAT4812Server.com This will allow an application to resolve the IP address of the SAT4812Server.com domain. Next, we need to launch a simple web server with the certificate generated in the previous section. Please do the following: Combine the secret key and certificate into one file: cp server.key server.pem cat server.crt >> server.pem Launch a simple web server (HTTPS server) with the server.pem certificate by using the OpenSSL s_server command: openssl s_server server.pem -www –cert By default, the server will listen on port 4433. The default port number can be altered by using the option. Now, please access the HTTPS server using a web browser (e.g., Firefox) –accept on the Linux computer. Type in the URL: . Most likely, an error similar to the following screenshot will appear on the web browser. At this point, please do not add an exception for this The secure connection failed because certificate is not trusted because no issuer web site. “The chain was provided.” Had this certificate been assigned by VeriSign, we would not have this failure, because certificate is very likely preloaded into certificate repository already. VeriSign’s Firefox’s Unfortunately, the certificate of SAT4812Server.com is signed by our own CA, which is not recognized by Firefox. There are typically two ways to make Firefox accept self-signed our CA’s certificate. We can request Mozilla to include certificate in Firefox. Therefore, the our CA’s certificate is known by Firefox and by the user. This is how it works in reality. “trusted” Unfortunately, the market of our own CA is not large enough for Mozilla to include its certificate. Instead, we can manually load our certificate into Firefox because we our CA’s “trust” own CA. To do this, please click on the following menu sequence on Firefox browser:
Section 4 Using the PKI and Certificate for Securing a Web Site In this section, we will explore how the PKI and certificates can be used by a web server to secure web browsing. To make it simpler, please add the following entry to the /etc/hosts file on the Linux computer: 127.0.0.1 SAT4812Server.com This will allow an application to resolve the IP address of the SAT4812Server.com domain. Next, we need to launch a simple web server with the certificate generated in the previous section. Please do the following: Combine the secret key and certificate into one file: cp server.key server.pem cat server.crt >> server.pem Launch a simple web server (HTTPS server) with the server.pem certificate by using the OpenSSL s_server command: openssl s_server –cert server.pem -www By default, the server will listen on port 4433. The default port number can be altered by using the –accept option. Now, please access the HTTPS server using a web browser (e.g., Firefox) on the Linux computer. Type in the URL: . Most likely, an error similar to the following screenshot will appear on the web browser. At this point, please do not add an exception for this web site. The secure connection failed because “The certificate is not trusted because no issuer chain was provided.” Had this certificate been assigned by VeriSign, we would not have this failure, because VeriSign’s certificate is very likely preloaded into Firefox’s certificate repository already. Unfortunately, the certificate of SAT4812Server.com is signed by our own CA, which is not recognized by Firefox. There are typically two ways to make Firefox accept our CA’s self-signed certificate. We can request Mozilla to include our CA’s certificate in Firefox. Therefore, the certificate is known by Firefox and “trusted” by the user. This is how it works in reality. Unfortunately, the market of our own CA is not large enough for Mozilla to include its certificate. Instead, we can manually load our CA’s certificate into Firefox because we “trust” our own CA. To do this, please click on the following menu sequence on Firefox browser: