0

In researching how to do this I notice that I have to purchase an ssl certificate to get it to work. Is this the only way to do this? I am running the onion server from my home computer. It is not commercial in any way, mostly just a learning experience.. Given the nature of an onion site, it would just make sense to have it an encrypted page. Any help with the would be greatly appreciated.

4
  • See previous answer tor.stackexchange.com/questions/10684/ssl-certificate-for-tor
    – Oousi
    Aug 11, 2018 at 21:22
  • That previous answer just tells me that I have to purchase a 'trusted' certificate. I don't care if it's trusted.. I only care if it is an encrypted connection. It kinda sucks that I have to tell people to hit, advanced and confirm ok, but, all in all, it does work with a self signed certificate.
    – Jeff
    Aug 12, 2018 at 5:51
  • But otherwise it was still helpful cause it shows where I can buy one if I really wanted ty
    – Jeff
    Aug 12, 2018 at 6:03
  • You get free SSL certificates by using 'lets encrypt' - letsencrypt.org Also read the second answer here: stackoverflow.com/questions/27759745/need-for-ssl-in-tor
    – IAmNoone
    Aug 12, 2018 at 9:53

1 Answer 1

0

Using Linux - Ubuntu 16.04 (OS)

Apache2 (Web Server)

I found the answer I was looking for Here.

https://www.digitalocean.com/community/tutorials/how-to-create-a-self-signed-ssl-certificate-for-apache-in-ubuntu-16-04

I followed the directions exactly and as I executed them I noted them to these instructions. It appears to be working fine.

First Create the Certificate

sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/apache-selfsigned.key -out /etc/ssl/certs/apache-selfsigned.crt

Second Create a Diffie-Hellman group

sudo openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048

Configure Apache to Use SSL

Changes to default-ssl.conf

ServerAdmin [email protected]

ServerName server_domain_or_IP

SSLCertificateFile      /etc/ssl/certs/apache-selfsigned.crt

SSLCertificateKeyFile /etc/ssl/private/apache-selfsigned.key

BrowserMatch "MSIE [2-6]" \
            nokeepalive ssl-unclean-shutdown \
            downgrade-1.0 force-response-1.0

Open the 000-default.conf file and add the following line the VH Block

Redirect "/" "https://your_domain_or_IP/"

Make changes to the firewall

sudo ufw allow 'Apache Full'

sudo ufw delete allow 'Apache'

Enable the Changes in Apache

sudo a2enmod ssl

sudo a2enmod headers

sudo a2ensite default-ssl

sudo a2enconf ssl-params

sudo apache2ctl configtest

The Global warning can be ignored

sudo systemctl restart apache2

Change to a Permanent Redirect

Redirect permanent "/" "https://your_domain_or_IP/"

sudo apache2ctl configtest

The Global warning can be ignored

sudo systemctl restart apache2

The browser will say that the connection is not secure, because, it isn't signed by one of your browser's trusted certificate authorities, but, it is fine it is still encrypting.

Just choose advanced and it will send you to your homepage.

1
  • I just need to add this comment. I started this for a tor onion site, and just wanted to add that in the torrc file you need to create another hidden service for ssl HiddenServicePort 443 127.0.0.1:443 It creates another hostname file in the directory that you specify in HiddenServiceDir.
    – Jeff
    Aug 12, 2018 at 5:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .