Skip to content

Latest commit

 

History

History
54 lines (43 loc) · 2.07 KB

httpd.md

File metadata and controls

54 lines (43 loc) · 2.07 KB
Raw

Apache HTTPD managed service

  1. Install Apache httpd with SSL/TLS support
sudo yum install -y httpd mod_ssl
  1. Setup your SSL/TLS configuration as per the documentation. Post-installation the mod_ssl package presents the ssl.conf file below. Configure it with your custom directives and optionally rename it:
sudo mv /etc/httpd/conf.d/ssl.conf /etc/httpd/conf.d/httpd-acm.conf

NOTE: A minimal TLS/SSL configuration example (as per documentation):

<VirtualHost *:443>
ServerName www.acm-httpd.example
SSLEngine on
SSLProtocol -all +TLSv1.2

SSLCertificateKeyFile ""
SSLCertificateFile ""
</VirtualHost>

NOTE: The SSLCertificateFile and SSLCertificateKeyFile entries must be present in the configuration enabled and at the beginning of the configuration line (as per default mod_ssl ssl.conf file). The nitro-enclaves-acm.service shall scan the configuration file and update them with the correct pkcs#11 URIs after the token gets provisioned with the ACM certificate key.

  1. Setup ACM for Nitro Enclaves as per the documentation.

NOTE: Copy the default ACM for Nitro Enclaves httpd service configuration file example:

sudo mv /etc/nitro_enclaves/acm-httpd.example.yaml /etc/nitro_enclaves/acm.yaml

  1. Make sure that the /etc/nitro_enclaves/acm.yaml file contains the Conf directive path entry to point at your httpd SSL/TLS configuration file from step 2 above. After successfully starting the nitro-enclaves-acm.service, the enclave shall be up and running with a pkcs#11 token provisioned with a private key and the ACM certificate chain.

  2. Test that the server works as expected

curl --cacert path_to_pem_file --tlsv1.2 https://host_name_or_IP

or

curl -k --tlsv1.2 https://host_name_or_IP

NOTE: If you used a private certificate, you must add the host name to /etc/hosts in the following format: 127.0.0.1 host_name.