How VPS - How to use/setup VPS
  • Home
  • Management guides
    • Web servers software
      • Directadmin
      • Hocvps Script
      • Centmin Mod
      • CWP
      • Kloxo-MR
      • Plesk
    • Control Panels
    • Securing VPS/Servers
      • SSL Certificates
      • Upgrading
      • Authentication
  • Operating System
    • CentOS
    • Fedora
    • Debian
    • Linux
    • Arch
    • BSD
    • CoreOS
  • Reviews
  • Coupon
    • Domain Coupon
    • Hosting Coupon
No Result
View All Result
  • Home
  • Management guides
    • Web servers software
      • Directadmin
      • Hocvps Script
      • Centmin Mod
      • CWP
      • Kloxo-MR
      • Plesk
    • Control Panels
    • Securing VPS/Servers
      • SSL Certificates
      • Upgrading
      • Authentication
  • Operating System
    • CentOS
    • Fedora
    • Debian
    • Linux
    • Arch
    • BSD
    • CoreOS
  • Reviews
  • Coupon
    • Domain Coupon
    • Hosting Coupon
No Result
View All Result
How VPS - How to use/setup VPS
No Result
View All Result
Home Operating System Debian

How to Enable TLS 1.3 in Apache on Debian 10

How VPS by How VPS
November 1, 2019
in Debian
0
8 Useful Commands to Monitor Swap Space Usage in Linux
0
SHARES
12
VIEWS
Share on FacebookShare on Twitter

Contents

  1. Using a Different System?
  2. Requirements
  3. Before you begin
  4. Install the acme.sh client and obtain a TLS certificate from Let’s Encrypt
  5. Install Apache
  6. Configure Apache for TLS 1.3
  7. Want to contribute?

Using a Different System?

  • How to Enable TLS 1.3 in Nginx on Ubuntu 18.04 LTS

  • How to Enable TLS 1.3 in Nginx on FreeBSD 12

  • How to Enable TLS 1.3 in Apache on FreeBSD 12

  • How to Enable TLS 1.3 in Nginx on Fedora 29

  • How to Enable TLS 1.3 in Nginx on Debian 9

  • How to Enable TLS 1.3 in Apache on Fedora 30

Are we missing a guide for your target system? Request one, or submit your own!


TLS 1.3 is a version of the Transport Layer Security (TLS) protocol that was published in 2018 as a proposed standard in RFC 8446. It offers security and performance improvements over its predecessors.

This guide will demonstrate how to enable TLS 1.3 using the Apache web server on Debian 10.

Requirements

  • Vultr Cloud Compute (VC2) instance running Debian 10 (Buster).
  • A valid domain name and properly configured A/AAAA/CNAME DNS records for your domain.
  • A valid TLS certificate. We will get one from Let’s Encrypt.
  • Apache version 2.4.36 or greater.
  • OpenSSL version 1.1.1 or greater.

Before you begin

Check the Debian version.

lsb_release -ds
# Debian GNU/Linux 10 (buster)

Create a new non-root user account with sudo access and switch to it.

adduser johndoe --gecos "John Doe"
usermod -aG sudo johndoe
su - johndoe

NOTE: Replace johndoe with your username.

Set up the timezone.

sudo dpkg-reconfigure tzdata

Ensure that your system is up to date.

sudo apt update && sudo apt upgrade -y

Install the needed packages.

sudo apt install -y zip unzip curl wget git socat

Install the acme.sh client and obtain a TLS certificate from Let’s Encrypt

Install acme.sh.

sudo mkdir /etc/letsencrypt
git clone https://github.com/Neilpang/acme.sh.git
cd acme.sh 
sudo ./acme.sh --install --home /etc/letsencrypt --accountemail [email protected]
cd ~
source ~/.bashrc

Check the version.

/etc/letsencrypt/acme.sh --version
# v2.8.2

Obtain RSA and ECDSA certificates for your domain.

# RSA
sudo /etc/letsencrypt/acme.sh --issue --standalone -d example.com --ocsp-must-staple --keylength 2048
# ECC/ECDSA
sudo /etc/letsencrypt/acme.sh --issue --standalone -d example.com --ocsp-must-staple --keylength ec-256

NOTE: Replace example.com in commands with your domain name.

Create sensible directories to store your certs and keys in. We will use /etc/letsencrypt.

sudo mkdir -p /etc/letsencrypt/example.com
sudo mkdir -p /etc/letsencrypt/example.com_ecc

Install and copy certificates to /etc/letsencrypt.

# RSA
sudo /etc/letsencrypt/acme.sh --install-cert -d example.com --cert-file /etc/letsencrypt/example.com/cert.pem --key-file /etc/letsencrypt/example.com/private.key --fullchain-file /etc/letsencrypt/example.com/fullchain.pem 
# ECC/ECDSA
sudo /etc/letsencrypt/acme.sh --install-cert -d example.com --ecc --cert-file /etc/letsencrypt/example.com_ecc/cert.pem --key-file /etc/letsencrypt/example.com_ecc/private.key --fullchain-file /etc/letsencrypt/example.com_ecc/fullchain.pem

After running the above commands, your certificates and keys will be in the following locations:

  • RSA: /etc/letsencrypt/example.com
  • ECC/ECDSA: /etc/letsencrypt/example.com_ecc

Install Apache

Apache added support for TLS 1.3 in version 2.4.36. Debian 10 system comes with Apache and OpenSSL that support TLS 1.3 out of the box, so there is no need to build a custom version.

Download and install the latest 2.4 branch of Apache via the apt package manager.

sudo apt install -y apache2

Check the version.

sudo apache2 -v
# Server version: Apache/2.4.38 (Debian)
# Server built:   2019-04-07T18:15:40

Configure Apache for TLS 1.3

Now that we have successfully installed Apache, we are ready to configure it to start using TLS 1.3 on our server.

First, enable the SSL module.

sudo a2enmod ssl

Restart Apache.

sudo systemctl restart apache2

Run sudo vim /etc/apache2/sites-available/example.com.conf, and populate the file with the following basic configuration.

<IfModule mod_ssl.c>
  <VirtualHost *:443>
    ServerName example.com

    SSLEngine on
    SSLProtocol all -SSLv2 -SSLv3

    # RSA
    SSLCertificateFile "/etc/letsencrypt/example.com/fullchain.pem"
    SSLCertificateKeyFile "/etc/letsencrypt/example.com/private.key"
    # ECC
    SSLCertificateFile "/etc/letsencrypt/example.com_ecc/fullchain.pem"
    SSLCertificateKeyFile "/etc/letsencrypt/example.com_ecc/private.key"

  </VirtualHost>
</IfModule>

Save the file and exit.

Activate the new configuration file by linking the file to the sites-enabled directory.

sudo a2ensite example.com.conf

Check the configuration.

sudo apachectl configtest

Reload Apache.

sudo systemctl reload apache2

Open your site via HTTPS protocol in your web browser. To verify TLS 1.3, you can use browser dev tools or SSL Labs service. The screenshots below show Chrome’s security tab with TLS 1.3 in action.

How to Enable TLS 1.3 in Apache on Debian 10

How to Enable TLS 1.3 in Apache on Debian 10

You have successfully enabled TLS 1.3 in Apache on your Debian 10 server. The final version of TLS 1.3 was defined in August 2018, so there’s no better time to start adopting this new technology.

Want to contribute?

You could earn up to $300 by adding new articles

Submit your article
Suggest an update
Request an article
How VPS

How VPS

Related Posts

Debian

How to Install WonderCMS on Debian 9

November 1, 2019
Debian

Using MySQL Views on Debian 7

November 1, 2019
Debian

How to Install and Configure TaskBoard on Debian 9

November 1, 2019
Next Post

Use Gitolite To Setup Git Repositories on Debian

Installing Debian 8 on Vultr

How to Install Unturned 2.2.5 on Debian 9

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Follow Us

  • 121 Followers
  • 87.2k Followers

Recommended

Securing SSH on Ubuntu 14.04

3 years ago

How to Install TermRecord on Ubuntu 16.04 and Debian 9

3 years ago

How to Enable TLS 1.3 in Nginx on FreeBSD 12

4 years ago

How to Install Sentrifugo HRM on CentOS 7

3 years ago

Instagram

    Please install/update and activate JNews Instagram plugin.

Categories

  • Arch
  • Authentication
  • Backups
  • BSD
  • Centmin Mod
  • CentOS
  • Control Panels
  • CoreOS
  • CWP
  • Debian
  • Directadmin
  • Encryption
  • Fedora
  • Firewalls
  • Hocvps Script
  • Hosting providers
  • Kloxo-MR
  • Linux
  • Mitigations
  • Operating System
  • Plesk
  • Reviews
  • Securing VPS/Servers
  • Security Patches
  • SSL Certificates
  • Uncategorized
  • Upgrading
  • VPS/Servers management guides
  • Vulnerability Detection
  • Web servers software
  • Webhosting Control Panel

Topics

Apache Web Server Bluehost Review 2019 Bluehost Review 2020 Bluehost Review 2021 Centmin Mod CentminMod centos install htop fsck htop install HTTP DoS attack Install Snort on an Ubuntu install Zabbix on CentOS install Zabbix on CentOS 7 Linux Commands linux guide linux install htop linux vps setup guide MariaDB MariaDB Error Mysql mysqld error optimize MariaDB optimize Mysql snort Ubuntu
No Result
View All Result

Highlights

Top Free Web Hosting Control Panels To Manage VPS/Dedicated Servers

Webmin Reviews

Virtualmin Reviews

CentOS Web Panel Reviews

Ajenti Reviews

ISPConfig Reviews

Trending

Failed to download metadata for repo 'appstream' on Centos 8
CentOS

How to fix error: Failed to download metadata for repo ‘appstream’ on Centos 8

by How VPS
February 25, 2022
0

I tried to update some extensions by use yum on centOs which I specified in Dockerfile. After...

How to Fix MySQL Error "Plugin 'InnoDB' registration as a STORAGE ENGINE failed"?

How to Fix MySQL Error “Plugin ‘InnoDB’ registration as a STORAGE ENGINE failed”?

November 17, 2020
How to optimize Mysql or MariaDB

How to optimize Mysql or MariaDB

November 3, 2020
Top Free Web Hosting Control Panels To Manage VPS/Dedicated Servers

Top Free Web Hosting Control Panels To Manage VPS/Dedicated Servers

February 17, 2020
Webmin Reviews

Webmin Reviews

February 17, 2020
How VPS – How to use/setup VPS

We bring you the best Premium WordPress Themes that perfect for news, magazine, personal blog, etc. Visit our landing page to see all features & demos.
LEARN MORE »

Recent News

  • How to fix error: Failed to download metadata for repo ‘appstream’ on Centos 8 February 25, 2022
  • How to Fix MySQL Error “Plugin ‘InnoDB’ registration as a STORAGE ENGINE failed”? November 17, 2020
  • How to optimize Mysql or MariaDB November 3, 2020

Categories

  • Arch
  • Authentication
  • Backups
  • BSD
  • Centmin Mod
  • CentOS
  • Control Panels
  • CoreOS
  • CWP
  • Debian
  • Directadmin
  • Encryption
  • Fedora
  • Firewalls
  • Hocvps Script
  • Hosting providers
  • Kloxo-MR
  • Linux
  • Mitigations
  • Operating System
  • Plesk
  • Reviews
  • Securing VPS/Servers
  • Security Patches
  • SSL Certificates
  • Uncategorized
  • Upgrading
  • VPS/Servers management guides
  • Vulnerability Detection
  • Web servers software
  • Webhosting Control Panel

[mc4wp_form]

© 2018 JNews - City News Magazine WordPress theme. All rights belong to their respective owners.
JNews is a top selling 2018 WordPress News, Blog, Newspaper & Magazine Theme.

No Result
View All Result
  • Home

© 2023 JNews - Premium WordPress news & magazine theme by Jegtheme.