Novell IFOLDER 3 - ADMINISTRATION, Руководство пользователя

Страница: 133 / 148

Managing SSL Certificates for Apache
C
no
vd
ocx (
E
NU)
01
F
ebr
ua
ry
200
6
133
C
Managing SSL Certificates for
Apache
This section discusses how to acquire and manage SSL certificates for your Novell
®
iFolder
®
3. x
servers.
• Section C.1, “Generating an SSL Certificate for the Server,” on page 133
• Section C.2, “Generating a Self-Signed SSL Certificate for Testing Purposes,” on page 134
• Section C.3, “Configuring Apache to Point to an SSL Certificate on an iFolder Server,” on
page 135
• Section C.4, “Configuring Apache to Point to an SSL Certificate on a Shared Volume for an
iFolder Cluster,” on page 135
C.1 Generating an SSL Certificate for the Server
Using SSL requires that you install an SSL certificate from on each iFolder enterprise server and
Web Access server in your domain. Users accept the certificates to enable communications with the
servers.
The certificate can be a self-signed certificate or a certificate from a trusted certificate authority. A
self-signed certificate is usually used only for internal iFolder services, where the server’s identity is
not likely to be spoofed. The trusted CA signature on the certificate attests that the public key
contained in the certificate belongs to the person, organization, server, or other entity noted in the
certificate. It assures users that they are accessing a valid, non-spoofed resource. If the information
does not match or the certificate has expired, an error message warns the user.
Browsers are typically preconfigured to trust well-known certificate authorities. If you use a
Certificate Authority that is not configured into browsers by default, it is necessary to load the
Certificate Authority certificate into the browser, enabling the browser to validate server certificates
signed by that Certificate Authority.
To acquire SSL certificates for use in an operational public-key infrastructure (PKI), use one of the
following methods, depending on your network needs:
• Use the self-signed certificate that is created and enabled for the server by default during the
server install.
• Use the services of a third-party certificate authority to get trusted certificate, then use it instead
of accepting the default certificate during the sever install.
Whichever method you use, the certificate is automatically used for the Apache Web Server
configuration. If it does not automaticially configure the certificate for the Apache Web Server, see
the following:
• Section C.3, “Configuring Apache to Point to an SSL Certificate on an iFolder Server,” on
page 135
• Section C.4, “Configuring Apache to Point to an SSL Certificate on a Shared Volume for an
iFolder Cluster,” on page 135