when referencing an insecure (http) resource within a secure (https) page. Such references create vulnerabilities that put the privacy and integrity of an otherwise-secure page at risk, because the insecure content could be modified in transit. If added to the DOM, insecurely-delivered content can read or alter the rest of the page even if the bulk of the page was delivered over a secure connections. (source)
The following information has been carefully collected but may contain errors or may be fully or partially outdated. Please use the description with care.
Familiarise yourself with the SSL concept and get a second opinion of SSL, server keys and encrypted transmission by studying also other web resources. Relax, stay cool and try the commands below first in a test environment, where you then can easily delete all created files.
Only deploy SSL to your production system if you exactly know what you are doing.
By default, Etherpad Lite runs via http:// which is unsecure in many respects, for example regarding the transmission of admin or user passwords in plain text, and also regarding confidential pad contents. When using http.
But there is hope.
As a server admin you can set up your Etherpad Lite to use the native https server part of Node and Express framework in a fully secure way. There is no need for using an additional Apache or Nginx server or proxy.
The following description for Linux assume that you want to
If you want to have your key signed by an approved Certificate Authority (CA), it's getting difficult and you usually need to pay yearly. There is at least one "Web of Trust" (WoT) community CA called "CAcert" (see reference section), which - once you became assured member (no costs) - allows you to get CAcert-signed server keys which lasts for two years (no costs).
Some intermediate files will be generated but not explained here, too keep it concise. Read the page in "References" if you are curious what they are for.
# Generate the server key openssl genrsa -des3 -out epl-server.key 4096 # Remark: the default parameters for certificates (CN, O, OU ..) are retrieved from # /etc/ssl/openssl.conf openssl req -new -key epl-server.key -out epl-server.csr openssl x509 -req -days 9000 -in epl-server.csr -signkey epl-server.key -out epl-server.crt # Let's make a version of the server key which does not require a password when the server starts openssl rsa -in epl-server.key -out epl-server.key.insecure mv epl-server.key server.key.secure mv epl-server.key.insecure epl-server.key
# Generate a second (temporary) key as the key of your own CA openssl genrsa -des3 -out own-ca.key 4096 # When being asked for the Common Name CN, enter your our Common Name and add " (CA)" to it. # Rationale: CN of your server key must be somehow distinct from the CN of your own-CA certificate. openssl req -new -x509 -days 9000 -key own-ca.key -out own-ca.crt # Sign your epl-server.key with the certificate of your own CA resulting in a self-signed epl-server.key openssl x509 -req -days 9000 -in epl-server.csr -CA own-ca.crt -CAkey own-ca.key -set_serial 001 -out epl-server.crt
# Set secure file permissions: only the Etherpad lite process must be able to read them chmod 400 epl-server.key chown etherpad epl-server.key chmod 400 epl-server.crt chown etherpad epl-server.crt
# These files are not needed when running the Etherpad using SSL and can be saved elsewhere or deleted rm epl-server.key.secure rm epl-server.csr rm own-ca.key rm own-ca.crt
An important thing is to tell users what a "fingerprint of the server key" is and how they can check whether the received fingerprint in the current browser connection matches the correct server fingerprint. (Details will be added later, I just wanted to mention it.)
You can print the (sha256, sha1, md5) fingerprints of the certificate and then verify them with the values shown in your browser
openssl x509 -fingerprint -sha256 -noout -in epl-server.crt openssl x509 -fingerprint -sha1 -noout -in epl-server.crt openssl x509 -fingerprint -md5 -noout -in epl-server.crt
The fingerprint of the server key of the local machine can be printed by using
ssh-keygen -lf /etc/ssh/ssh_host_rsa_key.pub