Raspberry Pi SSL Server

Question

Hello,

We have set up a Raspberry Pi webserver as a part of our project we are working on. The domain and IP has all been routed accordingly. Now we want to implement SSL security with the domain. The little green padlock is what we want to achieve.

P.S.: We have a free domain name so the service provider for domain won't help much.

Could anyone please guide us how to implement this on RPi ?

Abhijit

rew · Accepted Answer

On top of that, I would suggest you look into "letsencrypt". What Enrico suggests will give you a "self-signed" certificate: People who are passively intercepting the data between you and your users will not be able to see the content. But someone who can actively intercept the traffic can create his own self-signed certificate and pretend to be you (and then decrypt and re-encrypt the traffic to your server, peeking at the content when it is decrypted). That's why there will be a padlock, but red in the URL bar.... letsencrypt will give you a free "official" certificate, resulting in the green padlock.

balearicdynamics · Answer

Hello Abhijit,

As the Raspberry PI support raspbian that is a Debian distribution, I suggest to install openssl over apache; there is also the advantage that you have all open source components and with openssl installed you can create the self-certificate. This will give you the ssl behaviour to your webserver without the need to manage an expensive certificate authority.

There is a well described tutorial on how to setup the openssl and self-certificate over apache in Debian in the Debian wiki at the following link: https://wiki.debian.org/Self-Signed_Certificate

Hope this can be helpful.

Enrico

rew · Answer

John, Around five years ago, they charged like $50 per year for a fully signed certificate. A few years ago, that dropped to around $10 per year. If you're actually using it (on a small scale) that became "worth it" for me. But nowadays, letsencrypt has automated the whole procedure, and does the whole thing for free. So you're not saving $50 per year, and not even $10 per year by going the self-signed, with own-root-authority route. Just get a letsencrypt certificate. Might take a bit more trouble to set up in the beginning, but then all clients suddenly have the green icon without having to install the self-signed root certificate on all of them.