0 Fork 0

mirror of https://github.com/Cacti/documentation.git synced 2026-10-23 03:26:44 +09:00

Files

T

Thomas Vincent 2c5e65fcf3 docs: update SSL config — ECDSA keys, TLS 1.2+, Let's Encrypt (#220 )

* docs: update SSL config with ECDSA keys, TLS 1.2+, Let's Encrypt

Refs #220

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

* docs(ssl): fix RHEL certbot install and note Debian cert paths

certbot ships only in EPEL on RHEL/Rocky/AlmaLinux, so the dnf install fails
on a stock host without epel-release first. The self-signed commands use the
RHEL /etc/pki paths while the Apache block references Debian /etc/ssl paths;
add a note so Debian/Ubuntu users write the cert where Apache expects it.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

---------

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

2026-08-16 20:52:50 +01:00

4.5 KiB

Raw Permalink Blame History

Configuring SSL for Cacti

Enabling HTTPS for Cacti is done at the web server level. This page covers self-signed certificates for internal use and Let's Encrypt for public-facing servers.

Note

: If using multiple Data Collectors, all must have HTTPS enabled for the remote polling feature to work correctly.

Self-Signed Certificate (Internal Use)

Self-signed certificates are suitable for internal networks where you control the clients. Use ECDSA (secp384r1) for best performance, or RSA 4096 if your environment requires RSA.

ECDSA (recommended)

# RHEL/Rocky/AlmaLinux
dnf install -y mod_ssl

# Generate a 384-bit EC private key and self-signed certificate (valid 3 years)
openssl req -x509 -nodes -newkey ec -pkeyopt ec_paramgen_curve:P-384 \
    -keyout /etc/pki/tls/private/cacti.key \
    -out /etc/pki/tls/certs/cacti.crt \
    -days 1095 \
    -subj "/CN=cacti.example.com" \
    -addext "subjectAltName=DNS:cacti.example.com"

chmod 600 /etc/pki/tls/private/cacti.key

RSA (alternative)

# 4096-bit RSA — use when EC is not supported by your TLS client pool
openssl req -x509 -nodes -newkey rsa:4096 \
    -keyout /etc/pki/tls/private/cacti.key \
    -out /etc/pki/tls/certs/cacti.crt \
    -days 1095 \
    -subj "/CN=cacti.example.com" \
    -addext "subjectAltName=DNS:cacti.example.com"

chmod 600 /etc/pki/tls/private/cacti.key

Debian/Ubuntu paths: the commands above use the RHEL layout (/etc/pki/tls/...). On Debian/Ubuntu, write the key and certificate to /etc/ssl/private/cacti.key and /etc/ssl/certs/cacti.crt instead, to match the Apache SSLCertificateKeyFile/SSLCertificateFile paths shown below.

Key size: RSA 2048-bit is below NIST SP 800-131A Rev 2 guidance for long-term use. Use 4096-bit RSA or an ECDSA key.

Apache Configuration

Update /etc/httpd/conf.d/ssl.conf (RHEL/Rocky/AlmaLinux) or /etc/apache2/sites-available/cacti-ssl.conf (Debian/Ubuntu):

<VirtualHost *:443>
    ServerName cacti.example.com
    DocumentRoot /var/www/html/cacti

    SSLEngine on
    # RHEL/Rocky/AlmaLinux cert paths:
    #   SSLCertificateFile    /etc/pki/tls/certs/cacti.crt
    #   SSLCertificateKeyFile /etc/pki/tls/private/cacti.key
    # Debian/Ubuntu cert paths:
    SSLCertificateFile    /etc/ssl/certs/cacti.crt
    SSLCertificateKeyFile /etc/ssl/private/cacti.key

    # Require TLS 1.2 or 1.3; TLS 1.0 and 1.1 are prohibited (RFC 8996)
    SSLProtocol           -all +TLSv1.2 +TLSv1.3

    # TLS 1.2 cipher suites -- no RC4, 3DES, or export ciphers
    SSLCipherSuite        ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:\
ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:\
ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305
    SSLHonorCipherOrder   on

    # TLS 1.3 cipher suites (SSLCipherSuite does not apply to TLS 1.3)
    SSLOpenSSLConfCmd     Ciphersuites TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
</VirtualHost>

# Optional: redirect HTTP to HTTPS (uncomment to enable)
#<VirtualHost *:80>
#    ServerName cacti.example.com
#    Redirect permanent / https://cacti.example.com/
#</VirtualHost>

Restart Apache after editing:

apachectl configtest
systemctl restart httpd        # RHEL/Rocky/AlmaLinux
systemctl restart apache2      # Debian/Ubuntu

Let's Encrypt (Public-Facing Servers)

For servers reachable from the internet, use Let's Encrypt for a browser-trusted certificate at no cost.

RHEL/Rocky/AlmaLinux

# certbot ships in EPEL on RHEL/Rocky/AlmaLinux, not in BaseOS/AppStream
dnf install -y epel-release
dnf install -y certbot python3-certbot-apache
certbot --apache -d cacti.example.com

Debian/Ubuntu

apt-get install -y certbot python3-certbot-apache
certbot --apache -d cacti.example.com

Certbot configures Apache and sets up automatic renewal. Verify auto-renewal works:

certbot renew --dry-run

Verifying the Configuration

After restarting Apache, confirm TLS is working and that weak protocols are disabled:

# Check the certificate and protocol support
openssl s_client -connect cacti.example.com:443 -tls1_2 < /dev/null
openssl s_client -connect cacti.example.com:443 -tls1   < /dev/null  # should fail

For a comprehensive scan, use SSL Labs on public servers or testssl.sh on internal hosts:

# testssl.sh (download from https://testssl.sh/)
./testssl.sh cacti.example.com

4.5 KiB Raw Permalink Blame History