Lab 4: HTTPS and Encryption Techniques

Lab 4 Modifying existing HTTP Website to use HTTPS and encryption

• The goal of this lab is to modify an existing HTTP website to use HTTPS and encrypt all communications.
• The lab uses a self-signed certificate to secure the website.
• HTTPS utilizes TLS as the communication protocol.

HTTPS Communication

• TLS ensures the client is communicating with an authorized entity.
• TLS encrypts communication to prevent unauthorized access.

Server & Client Authentication

• The client does not authenticate itself to the server.
• Client authentication is optional and can be implemented using username/password after the encrypted channel is established.
• When using HTTPS, any client can connect to the server.

Preparation

• The lab uses four websites hosted on a rule host.
• You need to customize the DNS and web server configuration with your rule host number.
• Updating the DNS server and web server configurations requires restarting the respective services.

DNS Config

• Update the DNS configuration files by changing the rule host number (XX) in the files.
• Confirm the DNS configuration changes by performing a DNS lookup on all five names.
• All five names should resolve to the same IP address.

Web Server Config

• Modify the web server configuration files to reflect your rule host number.
• Update the ServerName, ServerAlias, ErrorLog, and CustomLog fields within the VirtualHost block to reflect the corresponding rule host.
• Restart the web server after making changes to the configuration.

Testing Web Server

• Verify all four web sites are accessible by browsing to their URLs.
• You can use either your own device configured with your rule host as a DNS server, or modify your system's hosts file.

Methodology

• Convert https://selfsigned.tne30024 to a HTTPS website protected with a self-signed certificate.
• Verify encryption using Wireshark.

Certificate Creation

• Generate a self-signed certificate and corresponding private key.
• Include the website URL in both the commonName and subjectAltName fields of the certificate.
• Set the subjectAltName field to DNS:selfsigned.tne30024.

Installing the Certificate and Private Key

• Copy or install the certificate and private key files on the rule host in a directory with general access permissions.
• Store the private key in a directory that is not accessible by the browser, to ensure its security.
• Consider hosting the certificate in a dedicated folder for better organization.

Modifying the Web Site

• Enable the Apache SSL module in the /usr/local/etc/apache24/httpd.conf file.
• Reconfigure the selfsigned.tne30024 website in the /usr/local/etc/apache24/extra/httpd-vhosts.conf file.
• Configure the selfsigned.tne30024 VirtualHost block to accept connections on port 443.
• Specify the location of the certificate and private key in the VirtualHost block.

Testing the Solution

• Browse to the new HTTPS website (https://selfsigned.tne30024).
• Accept the security risk of an untrusted certificate and verify the website is displayed with a red broken padlock.
• Review the certificate details to confirm its validity.
• Reload the website while Wireshark is running to verify encrypted communication between the browser and your rule host.
• Use the automated marking script at http://ruleprimary1.caia.swin.edu.au/tne30024.php for evaluation if unable to use a browser.

This lab focuses on modifying an existing HTTP website to implement HTTPS and encrypt all communications with a self-signed certificate. Students will learn about the TLS protocol, its role in server-client authentication, and the necessary preparations for updating DNS and web server configurations.