JKL Toy company enables Secure Sockets Layer (SSL) protection on HTTP Server

Scenario

The JKL Toy company (a fictitious company) wants to enable Secure Sockets Layer (SSL) protection for a specific directory on their HTTP Server. The secured directory will contain confidential corporate earnings information that only a select group of employees and business associates will be able to access. The JKL Web administrator has decided not to create and deploy user certificates to client browsers, but rather use SSL so that all data exchanged with the browser is encrypted. The JKL Web administrator will use a server certificate, basic password protection (based upon existing IBM i user accounts), and standard SSL encryption to provide access to the secured information.

Prerequisites

• It is assumed you have read Scenarios: HTTP Server.
• It is assumed you have read and completed JKL Toy Company creates an HTTP Server or you have an existing HTTP Server configuration.
• It is assumed that a certificate authority (and certificate store) is already established for the Digital Certificate Manager.
• It is assumed you are familiar with Domain Name Servers (DNS).

Start the IBM Web Administration for i interface

Access the IBM Web Administration for i from your browser. For information about how to access the Web Administration for i interface, see Starting Web Administration for i.

Set up a name-based virtual host

1. Click the Manage tab.
2. Click the HTTP Servers subtab.
3. Select your HTTP Server from the Server list.

   Example: JKLTEST

4. Select Global configuration from the Server area list.
5. Expand Server Properties.
6. Click Virtual Hosts.
7. Click the Name-based tab in the form.
8. Click Add under the Named virtual hosts table.
9. Select or enter an IP address in the IP address column.
   Example: 9.5.61.228

   Note: The IP address 9.5.61.288 used in this scenario is associated with JKL Toy Company's IBM i hostname JKLEARNINGS and registered by a Domain Name Server (DNS). You will need to choose a different IP address and hostname. The IBM Web Administration for i interface provides the IP addresses used by your IBM i server in the IP Address list; however, you will need to provide the hostname associated with the address you choose.
10. Enter a port number in the Port column.

    Example: 443

    Note: Specify a port number other than the one currently being used for your HTTP Server to maintain an SSL and non-SSL Web site.
11. Click Add under the Virtual host containers table in the Named host column.
    Note: This is a table within the Named virtual hosts table in the Named host column.
12. Enter the fully qualified server hostname for the virtual host in the Server name column.

    Example: www.JKLEARNINGS.org

    Note: Make sure the server hostname you enter is fully qualified and associated with the IP address you selected.
13. Enter a document root for the virtual host index file or welcome file in the Document root column.

    Example: /www/jkltest/earnings/

    Note: You are specifying a document root that will be created below. Remember the document root you have entered; you will be asked to enter the document root again when creating a new directory.
14. Click Continue.
15. Click OK.

Set up Listen directive for virtual host

1. Expand Server Properties.
2. Click General Server Configuration.
3. Click the General Settings tab in the form.
4. Click Add under the Server IP addresses and ports to listen on table.
5. Select the IP address you entered for the virtual host in the IP address column.

   Example: 9.5.61.288

6. Enter the port number you entered for the virtual host in the Port column.

   Example: 443

7. Click Continue.
8. Click OK.

Set up the virtual host directories

1. Select the virtual host from the Server area list.
2. Expand HTTP Tasks and Wizards.
3. Click Add a Directory to the Web.
4. Click Next.
5. Select Static web pages and files.
6. Click Next.
7. Enter a directory name for the virtual host in the Name field.

   Example: /www/jkltest/earnings/

8. Click Next.
9. Enter an alias for the virtual host in the Alias field.

   Example: /earnings/

10. Click Next.
11. Click Finish.

The document root and directory for the virtual host has been created.

Set up password protection via authentication

1. Select the directory under the virtual host from the Sever area list.

   Example: Directory /www/jkltest/earnings

2. Expand Server Properties.
3. Click Security.
4. Click the Authentication tab in the form.
5. Select IBM i user profiles under User authentication method.
6. Enter Projected Earnings in the Authentication name or realm field.
7. Specify the user profile in the field IBM i user profile to process requests under Related information.
8. Click Apply.
9. Click the Control Access tab in the form.
10. Select Control access based on specific authorization of Control access field.
11. Click Add Authorization button under the Authorization for control access table.
12. Select Require valid user from the new row Authorization or Container list.
13. Click OK.

Enable SSL for the virtual host

1. Select the virtual host from the Sever area list.

   Example: Virtual Host *:443

2. Expand Server Properties.
3. Click Security.
4. Click the SSL with Certificate Authentication tab in the form.
5. Select Enable SSL under SSL.
6. Select QIBM_HTTP_SERVER_[server_name] from the Server certificate application name list.

   Example: QIBM_HTTP_SERVER_JKLTEST

   Note: Remember the name of the server certificate. You will need to select it again in the Digital Certificate Manager.
7. Select Do not request client certificate for connection under Client certificates when establishing the connection.
8. Click OK.

The HTTPS_PORT provides a specific environment variable value that is passed to CGI programs . This field is not used in this scenario.

Associate system certificate with HTTP Server

The application name (created during the SSL process) is assigned a system certificate via the Digital Certificate Manager (DCM). During the process of enabling SSL for a virtual host, an IBM i server certificate must be assigned to the application name used when configuring SSL. This task is accomplished via the Digital Certificate Manager interface (accessed from the IBM i Tasks screen). See IBM i Digital Certificate Manager for more information.

1. Click the Related Links tab.
2. Click Digital Certificate Manager.
3. Click Select a Certificate Store.
4. Select *SYSTEM.
5. Click Continue.
6. Enter a password in the Certificate store password field.
7. Click Continue.
8. Click Manage Applications.
9. Select Update certificate assignment.
10. Click Continue.
11. Select Server.
12. Click Continue.
13. Select the appropriate application name.
    Note: Select the application name created while enabling SSL for the virtual host directory.

    Example: QIBM_HTTP_SERVER_JKLTEST

14. Click Update Certificate Assignment.
15. Select the appropriate certificate.
16. Click Assign New Certificate. This assigns the certificate to the application name selected in the previous step.

Restart your HTTP Server

Select one of the following methods below:

Manage one server

1. Click the Manage tab.
2. Click the HTTP Servers subtab.
3. Select your HTTP Server from the Server list.
4. Click the Stop icon if the server is running.
5. Click the Start icon.

Manage all servers

1. Click the Manage tab.
2. Click the HTTP Servers subtab.
3. Select All Servers from the Server list.
4. Click the All HTTP Servers tab.
5. Select your HTTP Server name in the table.

   Example: JKLTEST

6. Click Stop if the server is running.
7. Click Start.

Test your HTTP Server

1. Start a new Web browser.
2. Enter https://[virtual_hostname_name]:[port] in the location or URL field.

   Example: https://www.JKLEARNINGS.org:443

You will be challenged for a user name and password. After entering an appropriate IBM i user name and password, you will see a sample homepage (created by the Serve New Directory wizard) with the browser's security padlock icon enabled. The padlock indicates that SSL is enabled.

View your HTTP Server configuration

Your configuration will look similar if you used the given example in this and previous examples.

1. Click the Manage tab.
2. Click the HTTP Servers subtab.
3. Select your HTTP Server from the Server list.

   Example: JKLTEST

4. Expand Tools.
5. Click Display Configuration File.