mirror of
https://github.com/Cacti/documentation.git
synced 2026-10-31 17:17:42 +09:00
Thomas Vincent
2c5e65fcf3
* docs: update SSL config with ECDSA keys, TLS 1.2+, Let's Encrypt Refs #220 Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * docs(ssl): fix RHEL certbot install and note Debian cert paths certbot ships only in EPEL on RHEL/Rocky/AlmaLinux, so the dnf install fails on a stock host without epel-release first. The self-signed commands use the RHEL /etc/pki paths while the Apache block references Debian /etc/ssl paths; add a note so Debian/Ubuntu users write the cert where Apache expects it. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> --------- Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
151 lines
4.5 KiB
Markdown
151 lines
4.5 KiB
Markdown
# Configuring SSL for Cacti
|
|
|
|
Enabling HTTPS for Cacti is done at the web server level. This page covers
|
|
self-signed certificates for internal use and Let's Encrypt for public-facing
|
|
servers.
|
|
|
|
> **Note**: If using multiple Data Collectors, all must have HTTPS enabled for
|
|
> the remote polling feature to work correctly.
|
|
|
|
## Self-Signed Certificate (Internal Use)
|
|
|
|
Self-signed certificates are suitable for internal networks where you control
|
|
the clients. Use ECDSA (secp384r1) for best performance, or RSA 4096 if your
|
|
environment requires RSA.
|
|
|
|
### ECDSA (recommended)
|
|
|
|
```shell
|
|
# RHEL/Rocky/AlmaLinux
|
|
dnf install -y mod_ssl
|
|
|
|
# Generate a 384-bit EC private key and self-signed certificate (valid 3 years)
|
|
openssl req -x509 -nodes -newkey ec -pkeyopt ec_paramgen_curve:P-384 \
|
|
-keyout /etc/pki/tls/private/cacti.key \
|
|
-out /etc/pki/tls/certs/cacti.crt \
|
|
-days 1095 \
|
|
-subj "/CN=cacti.example.com" \
|
|
-addext "subjectAltName=DNS:cacti.example.com"
|
|
|
|
chmod 600 /etc/pki/tls/private/cacti.key
|
|
```
|
|
|
|
### RSA (alternative)
|
|
|
|
```shell
|
|
# 4096-bit RSA — use when EC is not supported by your TLS client pool
|
|
openssl req -x509 -nodes -newkey rsa:4096 \
|
|
-keyout /etc/pki/tls/private/cacti.key \
|
|
-out /etc/pki/tls/certs/cacti.crt \
|
|
-days 1095 \
|
|
-subj "/CN=cacti.example.com" \
|
|
-addext "subjectAltName=DNS:cacti.example.com"
|
|
|
|
chmod 600 /etc/pki/tls/private/cacti.key
|
|
```
|
|
|
|
> **Debian/Ubuntu paths**: the commands above use the RHEL layout
|
|
> (`/etc/pki/tls/...`). On Debian/Ubuntu, write the key and certificate to
|
|
> `/etc/ssl/private/cacti.key` and `/etc/ssl/certs/cacti.crt` instead, to match
|
|
> the Apache `SSLCertificateKeyFile`/`SSLCertificateFile` paths shown below.
|
|
|
|
> **Key size**: RSA 2048-bit is below NIST SP 800-131A Rev 2 guidance for
|
|
> long-term use. Use 4096-bit RSA or an ECDSA key.
|
|
|
|
## Apache Configuration
|
|
|
|
Update `/etc/httpd/conf.d/ssl.conf` (RHEL/Rocky/AlmaLinux) or
|
|
`/etc/apache2/sites-available/cacti-ssl.conf` (Debian/Ubuntu):
|
|
|
|
```apache
|
|
<VirtualHost *:443>
|
|
ServerName cacti.example.com
|
|
DocumentRoot /var/www/html/cacti
|
|
|
|
SSLEngine on
|
|
# RHEL/Rocky/AlmaLinux cert paths:
|
|
# SSLCertificateFile /etc/pki/tls/certs/cacti.crt
|
|
# SSLCertificateKeyFile /etc/pki/tls/private/cacti.key
|
|
# Debian/Ubuntu cert paths:
|
|
SSLCertificateFile /etc/ssl/certs/cacti.crt
|
|
SSLCertificateKeyFile /etc/ssl/private/cacti.key
|
|
|
|
# Require TLS 1.2 or 1.3; TLS 1.0 and 1.1 are prohibited (RFC 8996)
|
|
SSLProtocol -all +TLSv1.2 +TLSv1.3
|
|
|
|
# TLS 1.2 cipher suites -- no RC4, 3DES, or export ciphers
|
|
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:\
|
|
ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:\
|
|
ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305
|
|
SSLHonorCipherOrder on
|
|
|
|
# TLS 1.3 cipher suites (SSLCipherSuite does not apply to TLS 1.3)
|
|
SSLOpenSSLConfCmd Ciphersuites TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
|
|
</VirtualHost>
|
|
|
|
# Optional: redirect HTTP to HTTPS (uncomment to enable)
|
|
#<VirtualHost *:80>
|
|
# ServerName cacti.example.com
|
|
# Redirect permanent / https://cacti.example.com/
|
|
#</VirtualHost>
|
|
```
|
|
|
|
Restart Apache after editing:
|
|
|
|
```shell
|
|
apachectl configtest
|
|
systemctl restart httpd # RHEL/Rocky/AlmaLinux
|
|
systemctl restart apache2 # Debian/Ubuntu
|
|
```
|
|
|
|
## Let's Encrypt (Public-Facing Servers)
|
|
|
|
For servers reachable from the internet, use Let's Encrypt for a
|
|
browser-trusted certificate at no cost.
|
|
|
|
### RHEL/Rocky/AlmaLinux
|
|
|
|
```shell
|
|
# certbot ships in EPEL on RHEL/Rocky/AlmaLinux, not in BaseOS/AppStream
|
|
dnf install -y epel-release
|
|
dnf install -y certbot python3-certbot-apache
|
|
certbot --apache -d cacti.example.com
|
|
```
|
|
|
|
### Debian/Ubuntu
|
|
|
|
```shell
|
|
apt-get install -y certbot python3-certbot-apache
|
|
certbot --apache -d cacti.example.com
|
|
```
|
|
|
|
Certbot configures Apache and sets up automatic renewal. Verify auto-renewal
|
|
works:
|
|
|
|
```shell
|
|
certbot renew --dry-run
|
|
```
|
|
|
|
## Verifying the Configuration
|
|
|
|
After restarting Apache, confirm TLS is working and that weak protocols are
|
|
disabled:
|
|
|
|
```shell
|
|
# Check the certificate and protocol support
|
|
openssl s_client -connect cacti.example.com:443 -tls1_2 < /dev/null
|
|
openssl s_client -connect cacti.example.com:443 -tls1 < /dev/null # should fail
|
|
```
|
|
|
|
For a comprehensive scan, use [SSL Labs](https://www.ssllabs.com/ssltest/) on
|
|
public servers or `testssl.sh` on internal hosts:
|
|
|
|
```shell
|
|
# testssl.sh (download from https://testssl.sh/)
|
|
./testssl.sh cacti.example.com
|
|
```
|
|
|
|
---
|
|
|
|
Copyright (c) 2004-2026 The Cacti Group
|