{"id":908,"date":"2021-12-07T08:54:55","date_gmt":"2021-12-07T08:54:55","guid":{"rendered":"https:\/\/shreyapohekar.com\/blogs\/?p=908"},"modified":"2021-12-08T08:30:26","modified_gmt":"2021-12-08T08:30:26","slug":"how-to-configure-ssl-on-ec2-instance","status":"publish","type":"post","link":"https:\/\/shreyapohekar.com\/blogs\/how-to-configure-ssl-on-ec2-instance\/","title":{"rendered":"How to configure SSL on EC2 instance for free"},"content":{"rendered":"\n

Hi everyone! I am Shreya Pohekar. This is yet another “how-to” category blog. In this post, I will be writing on how one can enable SSL and configure connections over HTTPS on their EC2 instances or instances hosted over any other cloud platform.<\/p>\n\n\n\n

But why would I want HTTPs?<\/h3>\n\n\n\n

Well, there can be several reasons.<\/p>\n\n\n\n

  1. You run a blog page that is hosted on EC2 instance. According to google search engine latest guidelines, pages running on https are more likely to be amongst the top search results.<\/li>
  2. Just like me, you want to expoit CORs vulnerability where a custom origin is getting reflected. Just to give a gist here, I found a target where anything written after .com was getting reflected in the Access-Control-Allow-Origin header. Read more about headers here<\/span><\/a>. Also the credentials were allowed.<\/li><\/ol>\n\n\n\n

    Example: https:\/\/apps.redacted.com.shreyapohekar.com<\/strong> was getting reflected and credentials were allowed too, which means if the victim is logged in and clicks my cors exploit hosted on https:\/\/apps.redacted.com.shreyapohekar.com<\/strong>, I will be getting all of his sensitive information.<\/p>\n\n\n\n

    I had an EC2 instance running but it was running on HTTP. However for the exploit to work, it should run on HTTPs (as HTTP was not allowed \ud83d\ude41 ). <\/p>\n\n\n\n

    Lets do the configurations!!<\/h3>\n\n\n\n

    If you just want https over your subdomain you can skip this section. If you use case wants you to configure nested subdomain (abc.xyz.efg.domain.com), follow along the blog.<\/p>\n\n\n\n

    As you can see, the subdomain is nested here (apps.redacted.com), so it cant be directly configured from the subdomain section.<\/p>\n\n\n\n

    For nested subdomain configuration:-<\/p>\n\n\n\n

    1. Go to you domain provider \/ Hosting provider, based on whose nameservers you are using.<\/li>
    2. Search for dns zone editor.<\/li>
    3. Create a A record<\/li><\/ol>\n\n\n\n
      \"\"
      This is done in hostinger as the nameserver I use is of hostinger.<\/figcaption><\/figure>\n\n\n\n

      The points to IP address should be the one of your EC2 instance.<\/p>\n\n\n\n

      Setting up SSL on EC2<\/h3>\n\n\n\n

      The very first step here is to install the apache2 package. You can do that from <\/p>\n\n\n\n

      # apt-get update\n# apt-get install apache2\n\nTo restart enable the apache2 service\n# service apache2 restart<\/pre>\n\n\n\n
      It is as simple as that. Once your apache is up and running you will get an index page once you open the public IP address of the ec2 instance.<\/p>\n\n\n\n
      If you dont get the index page, make sure that the EC2 instance security groups are configured to address the incomming request for http<\/p><\/blockquote>\n\n\n\n
      SSL for free<\/h3>\n\n\n\n
      https:\/\/www.sslforfree.com\/<\/a> is a website from where you can create SSL certificates that will be valid for 90 days from its creation date. When you get there, it will provide you a step by step guide to create the certificate.<\/p>\n\n\n\n
      Once the setup is complete, a zip is downloaded containing the private key, certificate.crt and the ca_bundle.crt.<\/p>\n\n\n\n
      Invalid CAA records<\/h3>\n\n\n\n
      While generating the SSL key and certification, you might run into an error stating “Invalid CAA records”<\/p>\n\n\n\n
      This happens when you try to verify your domain with sslforfree. A fix for this is to add a new CAA record. This can be done in DNS management portal\/ DNS zone editor.<\/p>\n\n\n\n
      The fields should look like the following<\/p>\n\n\n\n
      \"\"<\/figure>\n\n\n\n
      \"\"
      CAA entry in DNS<\/figcaption><\/figure>\n\n\n\n
      I assure that there won’t be any more issues you will face while generating the certificate.<\/p>\n\n\n\n
      Apache configuration for SSL<\/h3>\n\n\n\n
      Apache configuration files can be found in \/etc for Linux instances. <\/p>\n\n\n\n
      First of all, create a folder under \/etc\/apache2 by name ssl. Copy all the 3 files (private_key, certificate, ca_bundle) obtained from the zip in this folder.<\/p>\n\n\n\n
      Now, an entry has to be created for sites-enabled.<\/p>\n\n\n\n
      1. Open the file with<\/li><\/ol>\n\n\n\n
        # vim \/etc\/apache2\/sites-enabled\/000-default.conf<\/code><\/pre>\n\n\n\n
        Do the following entry at the end.<\/p>\n\n\n\n
        <VirtualHost *:443>\n\nServerAdmin webmaster@localhost\nServerName shreyapohekar.com\nServerAlias apps.redacted.com.shreyapohekar.com\nDocumentRoot \/var\/www\/html\nSSLEngine on\nSSLCertificateFile \/etc\/apache2\/ssl\/certificate.crt\nSSLCertificateKeyFile \/etc\/apache2\/ssl\/private\/private.key\nSSLCertificateChainFile \/etc\/apache2\/ssl\/ca_bundle.crt\n\n<\/VirtualHost><\/code><\/pre>\n\n\n\n
        1. With VirtualHost directive, multiple domains can run on a single webserver (Ec2 in this case). <\/li>
        2. DocumentRoot specifies the path on the webserver that will be used as the base location for the domain.<\/li>
        3. SSLCertificateFile, SSLCertificateKeyFile, SSLCertificateChainFile are SSL related files that helps in setting up the encryption over http.<\/li><\/ol>\n\n\n\n
          The apache service now can be restarted using<\/p>\n\n\n\n
          # service apache2 restart<\/code><\/pre>\n\n\n\n
          And you are now good to go. Open https:\/\/apps.redacted.com.shreyapohekar.com in the browser. If you don’t get the index page and your site is still loading, then the problem is with security groups.<\/p>\n\n\n\n
          Configure the inbound connection for https from any IP in the world.<\/p>\n\n\n\n
          This is how an inbound security group for a ec2 instance should look like.<\/p>\n\n\n\n
          \"\"<\/figure>\n\n\n\n
          That’s all for the blog post. See you in the next one.<\/p>\n\n\n\n
          Until then, happy learning \ud83d\ude42<\/p>\n","protected":false},"excerpt":{"rendered":"
          The post is a walkthrough on how to configure ssl on linux instances. This can also be helpful when exploiting CORS.<\/p>\n","protected":false},"author":1,"featured_media":914,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ocean_post_layout":"","ocean_both_sidebars_style":"","ocean_both_sidebars_content_width":0,"ocean_both_sidebars_sidebars_width":0,"ocean_sidebar":"","ocean_second_sidebar":"","ocean_disable_margins":"enable","ocean_add_body_class":"","ocean_shortcode_before_top_bar":"","ocean_shortcode_after_top_bar":"","ocean_shortcode_before_header":"","ocean_shortcode_after_header":"","ocean_has_shortcode":"","ocean_shortcode_after_title":"","ocean_shortcode_before_footer_widgets":"","ocean_shortcode_after_footer_widgets":"","ocean_shortcode_before_footer_bottom":"","ocean_shortcode_after_footer_bottom":"","ocean_display_top_bar":"default","ocean_display_header":"default","ocean_header_style":"","ocean_center_header_left_menu":"","ocean_custom_header_template":"","ocean_custom_logo":0,"ocean_custom_retina_logo":0,"ocean_custom_logo_max_width":0,"ocean_custom_logo_tablet_max_width":0,"ocean_custom_logo_mobile_max_width":0,"ocean_custom_logo_max_height":0,"ocean_custom_logo_tablet_max_height":0,"ocean_custom_logo_mobile_max_height":0,"ocean_header_custom_menu":"","ocean_menu_typo_font_family":"","ocean_menu_typo_font_subset":"","ocean_menu_typo_font_size":0,"ocean_menu_typo_font_size_tablet":0,"ocean_menu_typo_font_size_mobile":0,"ocean_menu_typo_font_size_unit":"px","ocean_menu_typo_font_weight":"","ocean_menu_typo_font_weight_tablet":"","ocean_menu_typo_font_weight_mobile":"","ocean_menu_typo_transform":"","ocean_menu_typo_transform_tablet":"","ocean_menu_typo_transform_mobile":"","ocean_menu_typo_line_height":0,"ocean_menu_typo_line_height_tablet":0,"ocean_menu_typo_line_height_mobile":0,"ocean_menu_typo_line_height_unit":"","ocean_menu_typo_spacing":0,"ocean_menu_typo_spacing_tablet":0,"ocean_menu_typo_spacing_mobile":0,"ocean_menu_typo_spacing_unit":"","ocean_menu_link_color":"","ocean_menu_link_color_hover":"","ocean_menu_link_color_active":"","ocean_menu_link_background":"","ocean_menu_link_hover_background":"","ocean_menu_link_active_background":"","ocean_menu_social_links_bg":"","ocean_menu_social_hover_links_bg":"","ocean_menu_social_links_color":"","ocean_menu_social_hover_links_color":"","ocean_disable_title":"default","ocean_disable_heading":"default","ocean_post_title":"","ocean_post_subheading":"","ocean_post_title_style":"","ocean_post_title_background_color":"","ocean_post_title_background":0,"ocean_post_title_bg_image_position":"","ocean_post_title_bg_image_attachment":"","ocean_post_title_bg_image_repeat":"","ocean_post_title_bg_image_size":"","ocean_post_title_height":0,"ocean_post_title_bg_overlay":0.5,"ocean_post_title_bg_overlay_color":"","ocean_disable_breadcrumbs":"default","ocean_breadcrumbs_color":"","ocean_breadcrumbs_separator_color":"","ocean_breadcrumbs_links_color":"","ocean_breadcrumbs_links_hover_color":"","ocean_display_footer_widgets":"default","ocean_display_footer_bottom":"default","ocean_custom_footer_template":"","ocean_post_oembed":"","ocean_post_self_hosted_media":"","ocean_post_video_embed":"","ocean_link_format":"","ocean_link_format_target":"self","ocean_quote_format":"","ocean_quote_format_link":"post","ocean_gallery_link_images":"on","ocean_gallery_id":[],"footnotes":""},"categories":[141,257],"tags":[349,354,337,71,351,350,353,352],"class_list":["post-908","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-linux","category-web-application","tag-cors","tag-cors-exploitation","tag-domain","tag-linux","tag-nested-domain","tag-ssl","tag-sslforfree","tag-subdomain","entry","has-media"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t