Build a webserver with CentOS 7, MySQL, PHP7.2 and use a existing wildcard SSL Certificate from Windows Server

Build a webserver with CentOS 7, MySQL, PHP7.2 and use a existing wildcard SSL Certificate from Windows Server

A.   Build a CentOS Linux server with minimum setup with developer options. After installed the CentOs, run yum -y update to upate the server to most update version

B.   Install Apache

Install Apache by yum yum install httpd

Start the httpd service systemctl start httpd.service

Let the httpd service start with the system systemctl enable httpd.service

C.   Configure the firewall

firewall-cmd --permanent --zone=public --add-service=http

firewall-cmd --permanent --zone=public --add-service=https

firewall-cmd --reload

D.   Install MySQL

Install mysql by yum yum install mariadb-server mariadb

Start the httpd service systemctl start mariadb

Let the httpd service start with the system systemctl enable mariadb.service

Configure the MYSQL sudo mysql_secure_installation

The new password for the “root” of MySQL

E.   Install PHP7.2

     yum install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm

yum install http://rpms.remirepo.net/enterprise/remi-release-7.rpm  

yum install yum-utils

yum-config-manager --enable remi-php72

yum install php php-mcrypt php-cli php-gd php-curl php-mysql php-ldap php-zip php-fileinfo

     systemctl restart httpd.service

F.    Install phpMyAdmin

yum -y install phpmyadmin

vi /etc/httpd/conf.d/phpMyAdmin.conf to add the ip or ip range to allow access the phpMyAdmin, following example is added the subnet 192.168.3.0/24 and 192.168.168.0/24

G.  Copy website to following directory in Linux cd /var/www/html by using ftp (install ftp before use the ftp yum install -y ftp)

H.  Import tables to MySQL by using phpMyAdmin

l Launch the phpMyAdmin

l Create the database as the program required, here is “cfweb”

l Click on the “Import” tab to begin import the tables

 

I. Run following command openssl version, if the openssl was installed, the output should like OpenSSL 1.0.2k-fips  26 Jan 2017

J.    Install mod_ssl

Before configure the SSL, run following command to install the SSL module

yum -y install mod_ssl

K.   Export the PFX file from Windows Server

l Click Start, Run, then type “mmc” and hit enter.

l In the leftmost menu, choose “Add/Remove Snap In” under “File”.

l Click “Certificates”, then click “Add”, then OK.

l When the wizard starts, choose “Computer Account”, “Local Computer” and finish out the wizard.

l Once you’re finished, go back to the MMC and expand the “Certificates” node, then the “Personal” node.

l Click on the “Certificates” node under “Personal” and find your certificate in the right pane.

l Right click on the certificate and choose “All Tasks”, then “Export”.

l When the wizard starts, choose “Yes” for exporting the private key, you will also need to set a password and specify a file name and location for the PFX file, e.g. “ssl.pfx” and in c:\temp

l Once the PFX file has been saved, close out the MMC (don’t save the snap-in if it asks).

L.    Enable SSL in CentOS

l Copy the PFX to a directory (e.g. /ssl) under root directory of the Linux server, e.g. use ftp

l In Linux server, change to the directory ssl cd /ssl

l In /ssl directory, run openssl pkcs12 -in ssl.pfx -out ssl.pem

l Copy the ssl.pem to 2 files cp ./ssl.pem ./ssl.crt and cp ./ssl.pem ./ssl.key

l    In ssl.crt file, clear the content out of following

-----BEGIN CERTIFICATE-----  and  -----END CERTIFICATE-----

l    In ssl.key file, clear the content out of following

-----BEGIN RSA PRIVATE KEY----- and -----END RSA PRIVATE KEY-----

l cp ./ssl.crt /etc/pki/tls/certs/ssl.crt

l cp ./ssl.key /etc/pki/tls/private/ssl.key

l vi /etc/httpd/conf.d/ssl.conf

l edit the two line in ssl.conf like this

  SSLCertificateFile /etc/pki/tls/certs/ssl.crt

  SSLCertificateKeyFile /etc/pki/tls/private/ssl.key

l systemctl restart httpd

How to use a internal Windows CA (Certificate Authority) in Windows 2012 with Exchange 2013

We can use a internal windows CA certificate with Exchange 2013 to avoid Cert Errors
Something which you need to know is , Using a Internal Windows CA Certificate you need to install the certificates on every machine you use and Mobile devices other wise you will end up in a certificate error.
So that’s why people prefer going for a 3rd party certificate to overcome it.
In this article We Will Learn issuing a Internal Windows CA Certificate ,

You need to have two A records , Mail.domain.com and Autodisover.domain.com
and you will place the cert which we generate into the machines your configuring outlook. or any device, So that you can over come outlook errors
First we will learn how to Export a Certificate request file from Exchange 2013,
Step 1:
Login to Exchange Administration Center (EAC) in Exchange 2013
Servers – Certificates – Click on the “+” Sign – New

Choose
“Create a request for a Certificate from the Certification authority”, Next

Type a Friendly Name :

Wild Card is used if you are going to manage more URLs .For Example : *.Domain.com

Choose the Server to have the Cert Request

Step 2:
Enter the Required URL’s for your Exchange ,

For Example Am entering only for Outlook Web App (When accessed from the internet)

Step 3:
You will see the collection for URL’s


Step 4:
Fill out the Form

Create a Simple Share to Save the Cert Request


Save the Cert Request to a Shared Location as below

Now you could see the Pending Cert Request

Step 5:
Your request file would look like this


ExchangeCert.req is the request file you created. Now right click on the file , Open with , Use notepad, opening it via Notepad , It would give a set of Request content, You will use this content in the later part

Step 6:
You need to have this role installed to have a  Certificate Authority , It can be DC or Exchange it self
I have done this in the Exchange itself (No Harm)

Open Server Manager – Manage – Add Roles and Features

Step 7:
Choose Active Directory Certificate Services, Choose Next and Choose Certification Authority Web Enrollment

Choose : Certification Authority Web Enrollment

Choose Install

Choose Close


Step 8:
To Configure Active Directory Certificate Services, choose the Exclamation Mark on the Flag

Choose Next

Choose Certificate Authority and Certification Authority Web Enrollment

Choose Enterprise

Step 9:
Choose Root CA

Step 10:
Create a new Private key

Step 11:
Have this Default with 2048 key Character length

Step 12:
Click Next

Step 13:
By Default Certificate is valid for 5 years , don’t make any changes on it , Click next

Step 14:



Step 15:
Now if you Open IIS manager , you will see “CertSrv”  a Virtual Directory Created ,

Use the right side column “Browse *.443(https)
Step 16:
You would see a page like this , Choose Request a Certificate

Step 17:
Click on Advanced Certificate Request

Step 18:
Choose the Second one
Submit a certificate request by using a base-64-Encoded CMC

Step 19:
Now Copied the content from the  Note pad  – (See Step5), choose Template : WebServer

Step 20:
Choose “Base 64 encoded”

Step 21:
Save the Certificate

Copied the File to a  Common Share

Step 22:
Now go to your EAC – Servers – Certificates- Choose the Pending Request – Choose Complete



Step 23:
Now Assign Services to the Certificate, choose Cert and Click on Edit


Now the Server Part is ready

Step 24:
Now will learn how to install the Certificate in the Client End,double Click on the Certificate

Click Install Certificate – Click Next –

Choose Local Machine

Choose Personal –

Click Next And Import will be Successful

Now Do the Same Process, Double Click on the Certificate, Click Install Certificate – Click Next – Choose Trusted Root Certification Authorities

Double Click on the Certificate, Click Install Certificate – Click Next – Choose Intermediate Certification Authorities

Step 25:
Before

After installing the Certificate in the Client