TLS 1.3 is a version of the Transport Layer Security (TLS) protocol that was published in 2018 as a proposed standard in RFC 8446. It offers security and performance improvements over its predecessors.
This guide will demonstrate how to enable TLS 1.3 using the Apache web server on FreeBSD 12.
Requirements
- Vultr Cloud Compute (VC2) instance running FreeBSD 12.
- A valid domain name and properly configured
A
/AAAA
/CNAME
DNS records for your domain.
- A valid TLS certificate. We will get one from Let's Encrypt.
- Apache version
2.4.36
or greater.
- OpenSSL version
1.1.1
or greater.
Before you begin
Check the FreeBSD version.
uname -ro
# FreeBSD 12.0-RELEASE
Ensure that your FreeBSD system is up to date.
freebsd-update fetch install
pkg update && pkg upgrade -y
Install necessary packages if they are not present on your system.
pkg install -y sudo vim unzip wget bash socat git
Create a new user account with your preferred username (we will use johndoe
).
adduser
# Username: johndoe
# Full name: John Doe
# Uid (Leave empty for default): <Enter>
# Login group [johndoe]: <Enter>
# Login group is johndoe. Invite johndoe into other groups? []: wheel
# Login class [default]: <Enter>
# Shell (sh csh tcsh nologin) [sh]: bash
# Home directory [/home/johndoe]: <Enter>
# Home directory permissions (Leave empty for default): <Enter>
# Use password-based authentication? [yes]: <Enter>
# Use an empty password? (yes/no) [no]: <Enter>
# Use a random password? (yes/no) [no]: <Enter>
# Enter password: your_secure_password
# Enter password again: your_secure_password
# Lock out the account after creation? [no]: <Enter>
# OK? (yes/no): yes
# Add another user? (yes/no): no
# Goodbye!
Run the visudo
command and uncomment the %wheel ALL=(ALL) ALL
line to allow members of the wheel
group to execute any command.
visudo
# Uncomment by removing hash (#) sign
# %wheel ALL=(ALL) ALL
Now, switch to your newly created user with su
.
su - johndoe
NOTE: Replace johndoe
with your username.
Set up the timezone.
sudo tzsetup
Install the acme.sh
client and obtain a TLS certificate from Let's Encrypt
Install acme.sh
.
sudo pkg install -y acme.sh
Check the version.
acme.sh --version
# v2.7.9
Obtain RSA and ECDSA certificates for your domain.
# RSA
sudo acme.sh --issue --standalone -d example.com --ocsp-must-staple --keylength 2048
# ECC/ECDSA
sudo acme.sh --issue --standalone -d example.com --ocsp-must-staple --keylength ec-256
NOTE: Replace example.com
in commands with your domain name.
Create sensible directories to store your certs and keys in. We will use /etc/letsencrypt
.
sudo mkdir -p /etc/letsencrypt/example.com
sudo mkdir -p /etc/letsencrypt/example.com_ecc
Install and copy certificates to /etc/letsencrypt
.
# RSA
sudo acme.sh --install-cert -d example.com --cert-file /etc/letsencrypt/example.com/cert.pem --key-file /etc/letsencrypt/example.com/private.key --fullchain-file /etc/letsencrypt/example.com/fullchain.pem
# ECC/ECDSA
sudo acme.sh --install-cert -d example.com --ecc --cert-file /etc/letsencrypt/example.com_ecc/cert.pem --key-file /etc/letsencrypt/example.com_ecc/private.key --fullchain-file /etc/letsencrypt/example.com_ecc/fullchain.pem
After running the above commands, your certificates and keys will be in the following locations:
RSA
: /etc/letsencrypt/example.com
ECC/ECDSA
: /etc/letsencrypt/example.com_ecc
Install Apache
Apache added support for TLS 1.3 in version 2.4.36. FreeBSD 12 system comes with Apache and OpenSSL that support TLS 1.3 out of the box, so there is no need to build a custom version.
Download and install the latest 2.4 branch of Apache via the pkg
package manager.
sudo pkg install -y apache24
Check the version.
httpd -v
# Server version: Apache/2.4.38 (FreeBSD)
Start and enable Apache.
sudo sysrc apache24_enable="yes"
sudo service apache24 start
Now that we have successfully installed Apache, we are ready to configure it to start using TLS 1.3 on our server.
NOTE: In FreeBSD, the mod_ssl
module is enabled by default in both the package and the port
Run sudo vim /usr/local/etc/apache24/httpd.conf
and include the SSL module by uncommenting LoadModule ssl_module libexec/apache24/mod_ssl.so
.
#LoadModule ssl_module libexec/apache24/mod_ssl.so
Run sudo vim /usr/local/etc/apache24/Includes/example.com.conf
, and populate the file with the following basic configuration.
Listen 443
<VirtualHost *:443>
ServerName example.com
SSLEngine on
SSLProtocol all -SSLv2 -SSLv3
# RSA
SSLCertificateFile "/etc/letsencrypt/example.com/fullchain.pem"
SSLCertificateKeyFile "/etc/letsencrypt/example.com/private.key"
# ECC
SSLCertificateFile "/etc/letsencrypt/example.com_ecc/fullchain.pem"
SSLCertificateKeyFile "/etc/letsencrypt/example.com_ecc/private.key"
</VirtualHost>
Save the file and exit with :+W+Q.
Check the configuration.
sudo service apache24 configtest
Reload Apache.
sudo service apache24 reload
Open your site via HTTPS protocol in your web browser. To verify TLS 1.3, you can use browser dev tools or SSL Labs service. The screenshots below show Chrome's security tab with TLS 1.3 in action.
You have successfully enabled TLS 1.3 in Apache on your FreeBSD server. The final version of TLS 1.3 was defined in August 2018, so there’s no better time to start adopting this new technology.