An Overview Of Security-Related Packages; An Overview Of Certificates And Security - Red Hat ENTERPRISE LINUX 5 - DEPLOYMENT Deployment Manual

22.8.1. An Overview of Security-Related Packages

To enable the secure server, you must have the following packages installed at a minimum:
httpd
The httpd package contains the httpd daemon and related utilities, configuration files, icons,
Apache HTTP Server modules, man pages, and other files used by the Apache HTTP Server.
mod_ssl
The mod_ssl package includes the mod_ssl module, which provides strong cryptography for
the Apache HTTP Server via the Secure Sockets Layer (SSL) and Transport Layer Security (TLS)
protocols.
openssl
The openssl package contains the OpenSSL toolkit. The OpenSSL toolkit implements the SSL
and TLS protocols, and also includes a general purpose cryptography library.
Additionally, other software packages provide certain security functionalities (but are not required by
the secure server to function):

22.8.2. An Overview of Certificates and Security

Your secure server provides security using a combination of the Secure Sockets Layer (SSL) protocol
and (in most cases) a digital certificate from a Certificate Authority (CA). SSL handles the encrypted
communications as well as the mutual authentication between browsers and your secure server.
The CA-approved digital certificate provides authentication for your secure server (the CA puts its
reputation behind its certification of your organization's identity). When your browser is communicating
using SSL encryption, the https:// prefix is used at the beginning of the Uniform Resource Locator
(URL) in the navigation bar.
Encryption depends upon the use of keys (think of them as secret encoder/decoder rings in data
format). In conventional or symmetric cryptography, both ends of the transaction have the same key,
which they use to decode each other's transmissions. In public or asymmetric cryptography, two keys
co-exist: a public key and a private key. A person or an organization keeps their private key a secret
and publishes their public key. Data encoded with the public key can only be decoded with the private
key; data encoded with the private key can only be decoded with the public key.
To set up your secure server, use public cryptography to create a public and private key pair. In most
cases, you send your certificate request (including your public key), proof of your company's identity,
and payment to a CA. The CA verifies the certificate request and your identity, and then sends back a
certificate for your secure server.
A secure server uses a certificate to identify itself to Web browsers. You can generate your own
certificate (called a "self-signed" certificate), or you can get a certificate from a CA. A certificate from a
reputable CA guarantees that a website is associated with a particular company or organization.
Alternatively, you can create your own self-signed certificate. Note, however, that self-signed
certificates should not be used in most production environments. Self-signed certificates are not
automatically accepted by a user's browser — users are prompted by the browser to accept the
certificate and create the secure connection. Refer to
information on the differences between self-signed and CA-signed certificates.
Once you have a self-signed certificate or a signed certificate from the CA of your choice, you must
install it on your secure server.
An Overview of Security-Related Packages
Section 22.8.4, "Types of Certificates"
for more
349