Git, Apache and HTTPS with a free certificate

From Wiki de Caballero
Jump to navigation Jump to search

Prerequisites

  • Ubuntu CLI understanding
  • Git knowledge
  • Ubuntu, this was tested using Ubuntu 16
  • Apache 2

Git using Apache

This is a basic setup to allow Git on a server to be accessible via HTTP (no HTTPS yet, read further).

  1.  Install Apache
    sudo apt-get install apache2 apache2-utils
  2. Enable necessary modules
    a2enmod cgi alias env
  3. (Optional) Add user(s) to the htpasswd file. This step is optional if this setup is going to serve only anonymous repository (pull/fetch). However if you want to push or if you want to allow to only obtain a repository using user/pass combo this step is necessary (see next step).
    # Create file and add a user
    # -c = create file
    # The file is stored in /git/ the git repository for this specific setup
    htpasswd -c /git/.htpasswd [user name]
    # This will ask for a password
    
    # Add a user to the file
    htpasswd /git/.htpasswd [user name]
  4. To allow to obtain a git repository using http, add the following to the apache2.conf
    # Path to the Git directory (inside the OS)
    SetEnv GIT_PROJECT_ROOT /git
    
    # Allows all projects to be served
    # If commented a file must exist in each available repository via Apache, file name: git-daemon-export-ok
    SetEnv GIT_HTTP_EXPORT_ALL
    
    # Defines the URL path where git is located, as seen via http
    # First param is path, second is os path to git-http-backend, don't forget the last slash
    ScriptAlias /git/ /usr/lib/git-core/git-http-backend/
    
    # Access configuration
    <Files "git-http-backend">
    	# Enable Basic HTTP Authentication
    	AuthType Basic
    	AuthName "Git Access"
    	AuthUserFile /git/.htpasswd
    	# The following line allows to obtain a repository (pull/fetch) without having a user/pass combo
    	# Comment it if user/pass are needed to obtain info as well
    	Require expr !(%{QUERY_STRING} -strmatch '*service=git-receive-pack*' || %{REQUEST_URI} =~ m#/git-receive-pack$#)
    	Require valid-user
    	# END Enable Basic HTTP Authentication
    </Files>

Additional info:

Self signed Certificate

How Certificates work

Here are some videos on how certificates and SSL (TLS) work:

Additional info:

Why certificates are needed

To allow git to be served using https the server must have a certificate. Now, this certificate can be signed by a root Certificate Authority (CA), an Intermediate Cerfificate Authority (validated by a root CA) or a self signed certificate. To get a root or intermediate CA Certificate you must contact a company to give you one and pay for it. You could also create your own root or intermediate CA but this outside the scope of this article.

How to create a self-signed Certificate

This is done on an Ubuntu 16 but you could do this in another system, you do need OpenSSl.

The process is actually very simple.

Disclaimer: I am not an expert in OpenSSL, these are my tests and I might have made wrong assumptions. Please read the OpenSSL docs.

# One line
# ********************
# This command outputs two files, the private key and the certificate. The certificate will be valid for 1 year (use '-days [number]' to change this).
#
#
# -nodes = not encrypted, if you leave this out, Apache will ask for a password when using the private key
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout selfsigned.key -out selfsigned.crt


# Two steps
# ********************
# First the key is generated and second the certificate is generated using the generated key.
#
# Step 1: Generate the Private Key
# Step 1 - Option 1) -des3 encrypts the key, Apache will ask for a password when using the private key
openssl genrsa -des3 -out selfsigned.key 2048
# Step 1 - Option 2) No key encryption
openssl genrsa -out selfsigned.key 2048
#
# Step 2
# The certificate will be valid for 1 year (use '-days [number]' to change this).
openssl req -x509 -new -key selfsigned.key -out selfsigned.crt


# Three steps
# ********************
# First the key is generated, then a signing request is generated and finally the certificate is generated using the generated key and the signing request.
#
# Step 1: Generate the Private Key
# Step 1 - Option 1) -des3 encrypts the key, Apache will ask for a password when using the private key
openssl genrsa -des3 -out selfsigned.key 2048
# Step 1 - Option 2) No key encryption
openssl genrsa -out selfsigned.key 2048
#
# Step 2: Generate the Signing Request (.csr = Certificate Signing Request)
openssl req -new -key selfsigned.key -out selfsigned.csr
#
# Step 3: Generate the certificate using the Private Key and the Signing Request
# The certificate will be valid for 1 year (use '-days [number]' to change this).
openssl x509 -req -in selfsigned.csr -signkey selfsigned.key -out server.crt


# Check the certificate (a.k.a. see what's inside)
# ********************
openssl x509 -text -noout -in certificate.pem



How to create a Root Certificate authority and child certificates

Other sites:

Adding the certificate to Apache

Ensuring the right protocol:

Other links:

Configuring Git to use the self signed certificate

More sites:

Client based authentication using certificates in Apache

Used links:

Other links:

(Possibly) Giving Git a Client Certificate

More (possibly useful) info