SSL / HTTPS where to begin.

[StefTresMan]

Hi all,

Running a fresh install of Zabbix 6.4.12/Apache2/Mysql on Debian 12 (OS is the only Linux version supported by our company.) After some POC installations to see if Zabbix fits our needs: it definitely does!
My challenge at this moment is that this install has to be set-up safe and solid, so enter SSL.
I have been looking into different tutorials and guides on how to set-up Apache, but i did not find the right path (yet).

I received from the company a .pfx file with a wildcard certificate, i have DNS set-up to point to the right internal IP, but i don't know where to start. The tutorials i've seen never address an existing certificate, it's mostly tutorials from certificate providers, so i have to walk a different road. The tutorias that focus on Apache2 also didn't help me quite further because i don't see in the config files how Apache is serving Zabbix. The existing virtualhost and default files point to the index.html files that are standard with Zabbix.

Is anyone willing to point me in the right direction on how to even start with setting this up? I will need to have my certificate converted with openssl, extract the needed files, put them in the right folders and reconfigure Zabbix to redirect HTTP to HTTPS, but don't know where to begin.

Thank you!

[um3n]

Hey SefTresMan,

an existing certificate is no problem at all.. first of all, I think you need to convert the pfx file into separate key and crt file without passwords.
To extract the private key from a .pfx file, run the following OpenSSL command:

openssl pkcs12 -in myCert.pfx -nocerts -out privateKey.pem

The private key that you have extract will be encrypted. To unencrypt the file so that it can be used, you want to run the following command:

openssl rsa -in privateKey.pem -out private.pem

Now you should be able to configure the new files in your Apacheserver. To do that, please see the documentation of apache.
Here are some further infos for webserver hardening for zabbix.

If you want to use SSL-Certs for encrypting traffic between zabbix-server and agents you have to look into antoher part of the documentation. But if I understand you correctly, that here should help you start with SSL.

[StefTresMan]

Hi Um3n,

I have it up and running, thank you!

Indeed, extract the key and crt, and followed this tutorial:

https://www.server-world.info/en/note?os=Debian_11&p=httpd&f=3

In this tutorial, the files are in place for Debian, so it's a nearly 1:1 except for using your own certificates of course.

Thank you for your quick assistance!