Principles and Benefits of HTTPS

Reasons for Using HTTPS

HTTP lacks security measures:

• Data can be intercepted and read by third parties
• Content may be altered or hijacked during transmission

How HTTPS Works

HTTPS secures data through encryption and authentication:

• Symmetric encrypsion uses identical keys for encryption and decryption
• Asymmetric encryption employs distinct public and private keys

The protocol prevents man-in-the-middle attacks by using CA-signed certificates, ensuring both client and server authenticate each other before communication begins.

Setting Up HTTPS with Nginx

Generating Certificate Authority (CA) Certificates

Ensure the environment has OpenSSL installed and Nginx compiled with SSL support:

openssl version
nginx -V
rpm -qa | grep open

Steps to generate keys and certificates:

1. Generate a private key
2. Create a certificate signing request (CSR)
3. Isue a signed certificate

Create a directory for SSL keys:

mkdir /etc/nginx/ssl_key

Generate a private key using IDEA encryption:

openssl genrsa -idea -out jesonc.key 1024

Set a password when prompted (e.g., 123456). This creates jesonc.key.

Create a CSR:

openssl req -new -key jesonc.key -out jesonc.csr

Generate a self-signed certificate valid for ten years:

openssl x509 -req -days 3650 -in jesonc.csr -signkey jesonc.key -out jesonc.crt

Configure Nginx for HTTPS:

ssl on;
ssl_certificate /etc/nginx/ssl_key/jesonc.crt;
ssl_certificate_key /etc/nginx/ssl_key/jesonc.key;

Example configuration in /etc/nginx/conf.d/test_https.conf:

server {
    listen 443;
    server_name 192.168.1.112 www.zhangbiao.com;
    
    keepalive_timeout 100;
    
    ssl on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    
    ssl_certificate /etc/nginx/ssl_key/jesonc.crt;
    ssl_certificate_key /etc/nginx/ssl_key/jesonc.key;
    
    index index.html index.htm;
    location / {
        root /opt/app/code;
    }
}

Restart Nginx after configuration:

nginx -s stop -c /etc/nginx/nginx.conf
nginx -c /etc/nginx/nginx.conf

Access via:

https://www.zhangbiao.com/index.html

Apple-Specific HTTPS Requirements

To meet Apple's standards:

1. TLS 1.2 or higher
2. SHA-256 or stronger hashing algorithm
3. RSA 2048-bit or ECC 256-bit key strength
4. Forward secrecy support

Check current OpenSSL version and certificate properties:

openssl version
openssl x509 -noout -text -in ./jesonc.crt

Current version is 1.0.1; upgrade needed.

Update OpenSSL with the following script:

#!/bin/sh
#jeson@imoocc.com

cd /opt/download
wget https://www.openssl.org/source/openssl-1.0.2k.tar.gz
tar -zxvf openssl-1.0.2k.tar.gz
cd openssl-1.0.2k
./config --prefix=/usr/local/openssl
make && make install
mv /usr/bin/openssl /usr/bin/openssl.OFF
mv /usr/include/openssl /usr/include/openssl.OFF
ln -s /usr/local/openssl/bin/openssl /usr/bin/openssl
ln -s /usr/local/openssl/include/openssl /usr/include/openssl
echo "/usr/local/openssl/lib" >>/etc/ld.so.conf
ldconfig -v
openssl version -a

Execute the script:

sh ./update_openssl.sh

Verify updated vertion:

openssl version

Recreate the certificate with required parameters:

openssl req -days 36500 -x509 -sha256 -nodes -newkey rsa:2048 -keyout jesonc_apple.crt

Update the configuration file:

server {
    listen 443;
    server_name 192.168.1.112 www.zhangbiao.com;
    
    keepalive_timeout 100;
    
    ssl on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    
    ssl_certificate /etc/nginx/ssl_key/jesonc_apple.crt;
    ssl_certificate_key /etc/nginx/ssl_key/jesonc.key;
    
    index index.html index.htm;
    location / {
        root /opt/app/code;
    }
}

Validate and reload Nginx:

nginx -tc /etc/nginx/nginx.conf
nginx -s reload -c /etc/nginx/nginx.conf

Confirm port 443 is active:

netstat -luntp | grep 443

Visit:

https://www.zhangbiao.com/index.html

HTTPS Performance Tuning

Optimize performance using:

1. Keep-alive connections
2. Session caching

Updated configuration:

server {
    listen 443;
    server_name 116.62.103.228 jeson.t.imooc.io;
    
    keepalive_timeout 100;
    
    ssl on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    
    ssl_certificate /etc/nginx/ssl_key/jesonc_apple.crt;
    ssl_certificate_key /etc/nginx/ssl_key/jesonc.key;
    
    index index.html index.htm;
    location / {
        root /opt/app/code;
    }
}