Issue 35 - remove mentions of crypto-utils

modules/system-administrators-guide/pages/_partials/servers/The_Apache_HTTP_Server.adoc

@@ -111,7 +111,7 @@ Note that you can check the configuration for possible errors by using the follo
 
 [subs="attributes"]
 ----
-~]#{nbsp}apachectl configtest
+#{nbsp}apachectl configtest
 Syntax OK
 ----
 
@@ -124,7 +124,7 @@ This section describes how to start, stop, restart, and check the current status
 
 [subs="attributes"]
 ----
-~]#{nbsp}dnf install httpd
+#{nbsp}dnf install httpd
 ----
 
 For more information on the concept of targets and how to manage system services in {MAJOROS} in general, see
@@ -138,14 +138,14 @@ To run the `httpd` service, type the following at a shell prompt as `root`:
 
 [subs="attributes"]
 ----
-~]#{nbsp}systemctl start httpd.service
+#{nbsp}systemctl start httpd.service
 ----
 
 If you want the service to start automatically at boot time, use the following command:
 
 [subs="attributes"]
 ----
-~]#{nbsp}systemctl enable httpd.service
+#{nbsp}systemctl enable httpd.service
 ln -s '/usr/lib/systemd/system/httpd.service' '/etc/systemd/system/multi-user.target.wants/httpd.service'
 ----
 
@@ -164,14 +164,14 @@ To stop the running `httpd` service, type the following at a shell prompt as `ro
 
 [subs="attributes"]
 ----
-~]#{nbsp}systemctl stop httpd.service
+#{nbsp}systemctl stop httpd.service
 ----
 
 To prevent the service from starting automatically at boot time, type:
 
 [subs="attributes"]
 ----
-~]#{nbsp}systemctl disable httpd.service
+#{nbsp}systemctl disable httpd.service
 rm '/etc/systemd/system/multi-user.target.wants/httpd.service'
 ----
 
@@ -184,7 +184,7 @@ There are three different ways to restart a running `httpd` service:
 
 [subs="attributes"]
 ----
-~]#{nbsp}systemctl restart httpd.service
+#{nbsp}systemctl restart httpd.service
 ----
 
 This stops the running `httpd` service and immediately starts it again. Use this command after installing or removing a dynamically loaded module such as PHP.
@@ -193,7 +193,7 @@ This stops the running `httpd` service and immediately starts it again. Use this
 
 [subs="attributes"]
 ----
-~]#{nbsp}systemctl reload httpd.service
+#{nbsp}systemctl reload httpd.service
 ----
 
 This causes the running `httpd` service to reload its configuration file. Any requests currently being processed will not be interrupted, so configuration changes will only take effect for new client connections.
@@ -202,7 +202,7 @@ This causes the running `httpd` service to reload its configuration file. Any re
 
 [subs="attributes"]
 ----
-~]#{nbsp}systemctl kill --kill-who=main --signal=HUP httpd
+#{nbsp}systemctl kill --kill-who=main --signal=HUP httpd
 ----
 
 
@@ -213,7 +213,7 @@ To verify that the `httpd` service is running, type the following at a shell pro
 
 [subs="attributes"]
 ----
-~]#{nbsp}systemctl is-active httpd.service
+#{nbsp}systemctl is-active httpd.service
 active
 ----
 
@@ -240,7 +240,7 @@ To check the configuration for possible errors, type the following at a shell pr
 
 [subs="attributes"]
 ----
-~]#{nbsp}apachectl configtest
+#{nbsp}apachectl configtest
 Syntax OK
 ----
 
@@ -1978,8 +1978,8 @@ The _option_ can be either a name of the directory to look for in user's home di
 In order for the web server to access the content, the permissions on relevant directories and files must be set correctly. Make sure that all users are able to access the home directories, and that they can access and read the content of the directory specified by the [option]`UserDir` directive. For example, to allow access to `public_html/` in the home directory of user `joe`, type the following at a shell prompt as `root`:
 
 ----
-~]# chmod a+x /home/joe/
-~]# chmod a+rx /home/joe/public_html/
+# chmod a+x /home/joe/
+# chmod a+rx /home/joe/public_html/
 ----
 
 All files in this directory must be set accordingly.
@@ -2240,7 +2240,7 @@ If you intend to create a new DSO module, make sure you have the [package]*httpd
 
 [subs="attributes"]
 ----
-~]#{nbsp}dnf install httpd-devel
+#{nbsp}dnf install httpd-devel
 ----
 
 This package contains the include files, the header files, and the [application]*APache eXtenSion* ([command]#apxs#) utility required to compile a module.
@@ -2249,7 +2249,7 @@ Once written, you can build the module with the following command:
 
 [subs="attributes"]
 ----
-~]#{nbsp}apxs -i -a -c module_name.c
+#{nbsp}apxs -i -a -c module_name.c
 ----
 
 If the build was successful, you should be able to load the module the same way as any other module that is distributed with the Apache HTTP Server.
@@ -2330,7 +2330,7 @@ If you intend to set up an SSL server, make sure you have the [package]*mod_ssl*
 
 [subs="attributes"]
 ----
-~]#{nbsp}dnf install mod_ssl openssl
+#{nbsp}dnf install mod_ssl openssl
 ----
 indexterm:[Apache HTTP Server,files,/etc/httpd/conf.d/ssl.conf]
 This will create the `mod_ssl` configuration file at `/etc/httpd/conf.d/ssl.conf`, which is included in the main Apache HTTP Server configuration file by default. For the module to be loaded, restart the `httpd` service as described in xref:Web_Servers.adoc#s3-apache-running-restarting[Restarting the Service].
@@ -2354,7 +2354,7 @@ To disable SSL version 2 and SSL version 3, which implies enabling everything ex
 . As `root`, open the `/etc/httpd/conf.d/ssl.conf` file and search for *all* instances of the [command]#SSLProtocol# directive. By default, the configuration file contains one section that looks as follows:
 
 ----
-~]# vi /etc/httpd/conf.d/ssl.conf
+# vi /etc/httpd/conf.d/ssl.conf
 #   SSL Protocol support:
 # List the enable protocol levels with which clients will be able to
 # connect.  Disable SSLv2 access by default:
@@ -2378,16 +2378,16 @@ Repeat this action for all VirtualHost sections.
 
 [subs="macros"]
 ----
-~]# grep SSLProtocol /etc/httpd/conf.d/ssl.conf
+# grep SSLProtocol /etc/httpd/conf.d/ssl.conf
 pass:quotes[*SSLProtocol*] all -SSLv2 -SSLv3
 ----
 
 This step is particularly important if you have more than the one default VirtualHost section.
 
-. Restart the Apache daemon as follows:
+. Restart the Apache service as follows:
 
 ----
-~]# service httpd restart
+# systemctl restart httpd
 ----
 
 Note that any sessions will be interrupted.
@@ -2405,14 +2405,14 @@ Certificates are issued for a particular IP address and domain name pair. If one
 
 VeriSign, a widely used certificate authority, issues certificates for a particular software product, IP address, and domain name. Changing the software product renders the certificate invalid.
 
-In either of the above cases, you will need to obtain a new certificate. For more information on this topic, see xref:Web_Servers.adoc#s3-apache-mod_ssl-genkey[Generating a New Key and Certificate].
+In either of the above cases, you will need to obtain a new certificate. For more information on this topic, see xref:Web_Servers.adoc#s3-apache-mod_ssl-genkey[Generating a New Certificate Using OpenSSL].
 
 If you want to use an existing key and certificate, move the relevant files to the `/etc/pki/tls/private/` and `/etc/pki/tls/certs/` directories respectively. You can do so by issuing the following commands as `root`:
 
 [subs="macros, attributes"]
 ----
-~]#{nbsp}mv pass:quotes[`key_file.key`] pass:quotes[`/etc/pki/tls/private/hostname.key`]
-~]#{nbsp}mv pass:quotes[`certificate.crt`] pass:quotes[`/etc/pki/tls/certs/hostname.crt`]
+#{nbsp}mv pass:quotes[`key_file.key`] pass:quotes[`/etc/pki/tls/private/hostname.key`]
+#{nbsp}mv pass:quotes[`certificate.crt`] pass:quotes[`/etc/pki/tls/certs/hostname.crt`]
 ----
 
 Then add the following lines to the `/etc/httpd/conf.d/ssl.conf` configuration file:
@@ -2431,139 +2431,66 @@ To load the updated configuration, restart the `httpd` service as described in x
 
 [subs="attributes"]
 ----
-~]#{nbsp}mv /etc/httpd/conf/httpsd.key /etc/pki/tls/private/penguin.example.com.key
-~]#{nbsp}mv /etc/httpd/conf/httpsd.crt /etc/pki/tls/certs/penguin.example.com.crt
+#{nbsp}mv /etc/httpd/conf/httpsd.key /etc/pki/tls/private/penguin.example.com.key
+#{nbsp}mv /etc/httpd/conf/httpsd.crt /etc/pki/tls/certs/penguin.example.com.crt
 ----
 
 ====
 
 [[s3-apache-mod_ssl-genkey]]
-==== Generating a New Key and Certificate
-indexterm:[Apache HTTP Server,SSL server,private key]indexterm:[Apache HTTP Server,SSL server,certificate]
-In order to generate a new key and certificate pair, the [package]*crypto-utils* package must be installed on the system. To install it, enter the following command as `root`:
+==== Generating a New Certificate Using OpenSSL
+
+First, generate the private key. In this example we will use a 2048 RSA key:
 
 [subs="attributes"]
 ----
-~]#{nbsp}dnf install crypto-utils
+# openssl genrsa -out myhost.com.key 2048
 ----
 
-This package provides a set of tools to generate and manage SSL certificates and private keys, and includes [application]*genkey*, the Red{nbsp}Hat Keypair Generation utility that will guide you through the key generation process.
-
-.Replacing an existing certificate
-[IMPORTANT]
-====
-
-If the server already has a valid certificate and you are replacing it with a new one, specify a different serial number. This ensures that client browsers are notified of this change, update to this new certificate as expected, and do not fail to access the page. To create a new certificate with a custom serial number, use the following command instead of [application]*genkey*:
+Create a Certificate Signing Request(CSR). The Common Name field must be your server's hostname:
 
 [subs="attributes"]
 ----
-~]#{nbsp}openssl req -x509 -new -set_serial number -key hostname.key -out hostname.crt
+# openssl req -new -key myhost.com.key -out myhost.com.csr -sha512
 ----
 
-====
+A message digest algorithm like SHA2 or stronger is recommended, but it's more important for the certificate than for the request. However your CA decides which message digest they use for the certificate.
+
+Now give your CSR to your Certificate Authority(CA) so they can sign your key and give you a certificate:
+
+[subs="attributes"]
+----
+# openssl x509 -req -days 365 -in myhost.com.csr -signkey myhost.com.key -out myhost.com.crt -sha512
+----
 
-.Remove a previously created key
 [NOTE]
 ====
+You can also self-sign the CSR, but bear in mind the security issues that it poses and that browsers will warn users about this.
+====
 
-If there already is a key file for a particular host name in your system, [application]*genkey* will refuse to start. In this case, remove the existing file using the following command as `root`:
+Once your CA has signed it, they will give you the certificate(`.crt` file). Now move the private key and the certificate to their respective directories:
 
 [subs="attributes"]
 ----
-~]#{nbsp}rm /etc/pki/tls/private/hostname.key
+# cp myhost.com.crt /etc/pki/tls/certs/
+# cp myhost.com.key /etc/pki/tls/private/myhost.com.key
 ----
 
-====
+The Certificate Signing Request(CSR) can be deleted as it becomes useless once you have obtained your certificate. Alternatively you can put it along your private key:
 
-To run the utility enter the [command]#genkey# command as `root`, followed by the appropriate host name (for example, `penguin.example.com`):
-
-[subs="macros, attributes"]
+[subs="attributes"]
 ----
-~]#{nbsp}genkey pass:quotes[_hostname_]
+# cp myhost.com.csr /etc/pki/tls/private/myhost.com.csr
 ----
 
-To complete the key and certificate creation, take the following steps:
+Set the correct context of these files for SELinux:
 
-. Review the target locations in which the key and certificate will be stored.
-
-[[figure-apache-mod_ssl-genkey-01]]
-.Running the genkey utility
-
-image::apache-mod_ssl-genkey-01.png[Running the genkey utility]
-
-Use the kbd:[Tab] key to select the btn:[Next] button, and press kbd:[Enter] to proceed to the next screen.
-
-. Using the kbd:[up] and kbd:[down] arrow keys, select a suitable key size. Note that while a larger key increases the security, it also increases the response time of your server. The NIST recommends using `2048 bits`. See [citetitle]_link:++https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar1.pdf++[NIST Special Publication 800-131A Revision 1]_.
-
-[[figure-apache-mod_ssl-genkey-02]]
-.Selecting the key size
-
-image::apache-mod_ssl-genkey-02.png[Selecting the key size]
-
-Once finished, use the kbd:[Tab] key to select the btn:[Next] button, and press kbd:[Enter] to initiate the random bits generation process. Depending on the selected key size, this may take some time.
-
-. Decide whether you want to send a certificate request to a certificate authority.
-
-[[figure-apache-mod_ssl-genkey-03]]
-.Generating a certificate request
-
-image::apache-mod_ssl-genkey-03.png[Generating a certificate request]
-
-Use the kbd:[Tab] key to select btn:[Yes] to compose a certificate request, or btn:[No] to generate a self-signed certificate. Then press kbd:[Enter] to confirm your choice.
-
-. Using the kbd:[Spacebar] key, enable (`[*]`) or disable (`[ ]`) the encryption of the private key.
-
-[[figure-apache-mod_ssl-genkey-04]]
-.Encrypting the private key
-
-image::apache-mod_ssl-genkey-04.png[Encrypting the private key]
-
-Use the kbd:[Tab] key to select the btn:[Next] button, and press kbd:[Enter] to proceed to the next screen.
-
-. If you have enabled the private key encryption, enter an adequate passphrase. Note that for security reasons, it is not displayed as you type, and it must be at least five characters long.
-
-[[figure-apache-mod_ssl-genkey-05]]
-.Entering a passphrase
-
-image::apache-mod_ssl-genkey-05.png[Entering a passphrase]
-
-Use the kbd:[Tab] key to select the btn:[Next] button, and press kbd:[Enter] to proceed to the next screen.
-
-.Do not forget the passphrase
-[IMPORTANT]
-====
-
-Entering the correct passphrase is required in order for the server to start. If you lose it, you will need to generate a new key and certificate.
-
-====
-
-. Customize the certificate details.
-
-[[figure-apache-mod_ssl-genkey-06]]
-.Specifying certificate information
-
-image::apache-mod_ssl-genkey-06.png[Specifying certificate information]
-
-Use the kbd:[Tab] key to select the btn:[Next] button, and press kbd:[Enter] to finish the key generation.
-
-. If you have previously enabled the certificate request generation, you will be prompted to send it to a certificate authority.
-
-[[figure-apache-mod_ssl-genkey-07]]
-.Instructions on how to send a certificate request
-
-image::apache-mod_ssl-genkey-07.png[Instructions on how to send a certificate request]
-
-Press kbd:[Enter] to return to a shell prompt.
-
-Once generated, add the key and certificate locations to the `/etc/httpd/conf.d/ssl.conf` configuration file:
-
-[subs="quotes, macros"]
+[subs="attributes"]
 ----
-SSLCertificateFile /etc/pki/tls/certs/pass:attributes[{blank}]_hostname_.crt
-SSLCertificateKeyFile /etc/pki/tls/private/pass:attributes[{blank}]_hostname_.key
+# restorecon -RvF /etc/pki
 ----
 
-Finally, restart the `httpd` service as described in xref:Web_Servers.adoc#s3-apache-running-restarting[Restarting the Service], so that the updated configuration is loaded.
+The last step is to configure the webserver of your host for the TLS protocol using the key and the certificate files you have just created - see xref:The_Apache_HTTP_Server.adoc#mod-ssl-configuration[mod_ssl configuration].
 
 [[s2-apache-resources]]
 === Additional Resources
@@ -2574,8 +2501,6 @@ To learn more about the Apache HTTP Server, see the following resources.
 
 * `httpd(8)` — The manual page for the `httpd` service containing the complete list of its command-line options.
 
-* `genkey(1)` — The manual page for [command]#genkey# utility, provided by the [package]*crypto-utils* package.
-
 * `apachectl(8)` — The manual page for the Apache HTTP Server Control Interface.
 
 [[bh-The_Apache_HTTP_Server-Installable_Documentation]]
@@ -2586,8 +2511,8 @@ To learn more about the Apache HTTP Server, see the following resources.
 Before accessing the documentation, issue the following commands as `root`:
 
 ----
-~]# dnf install httpd-manual
-~]# apachectl graceful
+# dnf install httpd-manual
+# apachectl graceful
 ----
 
 .Online Documentationindexterm:[Apache HTTP Server,additional resources,useful websites]