{"action":"created","issue":{"url":"https://api.github.com/repos/InspectorIncognito/server/issues/19","labels_url":"https://api.github.com/repos/InspectorIncognito/server/issues/19/labels{/name}","comments_url":"https://api.github.com/repos/InspectorIncognito/server/issues/19/comments","events_url":"https://api.github.com/repos/InspectorIncognito/server/issues/19/events","html_url":"https://github.com/InspectorIncognito/server/issues/19","id":118833846,"number":19,"title":"utilizar Certificado Autofirmado","user":{"login":"farodrig","id":6003654,"avatar_url":"https://avatars.githubusercontent.com/u/6003654?v=3","gravatar_id":"","url":"https://api.github.com/users/farodrig","html_url":"https://github.com/farodrig","followers_url":"https://api.github.com/users/farodrig/followers","following_url":"https://api.github.com/users/farodrig/following{/other_user}","gists_url":"https://api.github.com/users/farodrig/gists{/gist_id}","starred_url":"https://api.github.com/users/farodrig/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/farodrig/subscriptions","organizations_url":"https://api.github.com/users/farodrig/orgs","repos_url":"https://api.github.com/users/farodrig/repos","events_url":"https://api.github.com/users/farodrig/events{/privacy}","received_events_url":"https://api.github.com/users/farodrig/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-11-25T13:12:47Z","updated_at":"2015-11-26T16:17:39Z","closed_at":null,"body":"Utilizar Certificado Autofirmado para encriptar comunicación."},"comment":{"url":"https://api.github.com/repos/InspectorIncognito/server/issues/comments/159951984","html_url":"https://github.com/InspectorIncognito/server/issues/19#issuecomment-159951984","issue_url":"https://api.github.com/repos/InspectorIncognito/server/issues/19","id":159951984,"user":{"login":"farodrig","id":6003654,"avatar_url":"https://avatars.githubusercontent.com/u/6003654?v=3","gravatar_id":"","url":"https://api.github.com/users/farodrig","html_url":"https://github.com/farodrig","followers_url":"https://api.github.com/users/farodrig/followers","following_url":"https://api.github.com/users/farodrig/following{/other_user}","gists_url":"https://api.github.com/users/farodrig/gists{/gist_id}","starred_url":"https://api.github.com/users/farodrig/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/farodrig/subscriptions","organizations_url":"https://api.github.com/users/farodrig/orgs","repos_url":"https://api.github.com/users/farodrig/repos","events_url":"https://api.github.com/users/farodrig/events{/privacy}","received_events_url":"https://api.github.com/users/farodrig/received_events","type":"User","site_admin":false},"created_at":"2015-11-26T16:17:39Z","updated_at":"2015-11-26T16:17:39Z","body":"Se investigó y se llegó a que se deben realizar los siguientes pasos: (Estos deben ser testeados en un servidor de prueba)\r\n\r\n1. Habilitar ssl en Apache:\r\n```sh\r\n$ sudo a2enmod ssl\r\n```\r\n\r\n2. Crear directorio para guardar llave y certificado:\r\n```sh\r\n$ sudo mkdir /etc/apache2/ssl\r\n```\r\n\r\n3. Crear llaves:\r\n```sh\r\n$ sudo openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout /etc/apache2/ssl/apache.key -out /etc/apache2/ssl/apache.crt\r\n```\r\n\r\n4. Responder a las preguntas de la siguiente forma:\r\n```sh\r\nCountry Name (2 letter code) [AU]:CL\r\nState or Province Name (full name) [Some-State]:Metropolitana\r\nLocality Name (eg, city) []:Santiago\r\nOrganization Name (eg, company) [Internet Widgits Pty Ltd]:ISCI\r\nOrganizational Unit Name (eg, section) []:SmartCities\r\nCommon Name (e.g. server FQDN or YOUR name) []:'PONER_IP_PUBLICA'\r\nEmail Address []:contacto@transapp.cl\r\n```\r\n\r\n5. Agregar VirtualHost para conexión por https:\r\n```sh\r\n<VirtualHost *:433>\r\n\r\n        Alias /static /home/ubuntu/Documentos/server/static\r\n        <Directory /home/ubuntu/Documentos/server/static>\r\n                Require all granted\r\n        </Directory>\r\n\r\n        <Directory /home/ubuntu/Documentos/server/server>\r\n                <Files wsgi.py>\r\n                      Require all granted\r\n                </Files>\r\n        </Directory>\r\n\r\n        LoadModule wsgi_module /usr/lib/apache2/modules/mod_wsgi.so\r\n\r\n        WSGIScriptAlias / /home/ubuntu/Documentos/server/server/wsgi.py\r\n\r\n        ErrorLog ${APACHE_LOG_DIR}/error.log\r\n        CustomLog ${APACHE_LOG_DIR}/access.log combined\r\n\r\n        SSLEngine on\r\n        SSLCertificateFile /etc/apache2/ssl/apache.crt\r\n        SSLCertificateKeyFile /etc/apache2/ssl/apache.key\r\n\r\n        # HSTS (mod_headers is required) (15768000 seconds = 6 months)\r\n        Header always set Strict-Transport-Security \"max-age=15768000\"\r\n\r\n        <FilesMatch \"\\.(cgi|shtml|phtml|php)$\">\r\n                        SSLOptions +StdEnvVars\r\n        </FilesMatch>\r\n        <Directory /usr/lib/cgi-bin>\r\n                        SSLOptions +StdEnvVars\r\n        </Directory>\r\n        BrowserMatch \"MSIE [2-6]\" \\\r\n                        nokeepalive ssl-unclean-shutdown \\\r\n                        downgrade-1.0 force-response-1.0\r\n        BrowserMatch \"MSIE [17-9]\" ssl-unclean-shutdown\r\n</VirtualHost>\r\n\r\n# modern configuration, tweak to your needs\r\nSSLProtocol             all -SSLv3 -TLSv1\r\nSSLCipherSuite          ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK\r\nSSLHonorCipherOrder     on\r\n    SSLCompression          off\r\n\r\n\r\n    # OCSP Stapling, only in httpd 2.3.3 and later\r\n    SSLUseStapling          on\r\n    SSLStaplingResponderTimeout 5\r\n    SSLStaplingReturnResponderErrors off\r\nSSLStaplingCache        shmcb:/var/run/ocsp(128000)\r\n```\r\n\r\n6. Agregar a Setting.py:\r\n```sh\r\n# secure proxy SSL header and secure cookies\r\nSECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')\r\nSESSION_COOKIE_SECURE = True\r\nCSRF_COOKIE_SECURE = True\r\n\r\n# session expire at browser close\r\nSESSION_EXPIRE_AT_BROWSER_CLOSE = True\r\n\r\n# wsgi scheme\r\nos.environ['wsgi.url_scheme'] = 'https'\r\n```\r\n\r\n6. Agregar a wspi.py:\r\n```sh\r\nos.environ['HTTPS'] = \"on\"\r\n```\r\n\r\n7. Reiniciar Apache:\r\n```sh\r\n$ sudo service apache2 restart\r\n```"}}