13.09.2016 Views

PHP and MySQL Web Development 4th Ed-tqw-_darksiderg

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

356 Chapter 15 E-commerce Security Issues<br />

Secure <strong>Web</strong> Servers<br />

You can use the Apache web server, Microsoft IIS, or any number of other free or commercial<br />

web servers for secure communication with browsers via Secure Sockets Layer.<br />

Using Apache enables you to use a Unix-like operating system, which is almost certainly<br />

more reliable but slightly more difficult to set up than IIS.You can also, of course, choose<br />

to use Apache on a Windows platform.<br />

Using SSL on IIS simply involves installing IIS, generating a key pair, <strong>and</strong> installing<br />

your certificate. Using SSL on Apache requires that the OpenSSL package is also<br />

installed <strong>and</strong> the mod ssl module is enabled during installation of the server software.<br />

You can have your cake <strong>and</strong> eat it too by purchasing a commercial version of Apache.<br />

For several years, Red Had sold such a product, called Stronghold, which is now bundled<br />

with Red Hat Enterprise Linux products. By purchasing such a solution, you get the<br />

reliability of Linux <strong>and</strong> an easy-to-install product with technical support from the vendor.<br />

Installation instructions for the two most popular web servers, Apache <strong>and</strong> IIS, are in<br />

Appendix A,“Installing <strong>PHP</strong> <strong>and</strong> <strong>MySQL</strong>.” You can begin using SSL immediately by<br />

generating your own digital certificate, but visitors to your site will be warned by their<br />

web browsers that you have signed your own certificate.To use SSL effectively, you also<br />

need a certificate issued by a certifying authority.<br />

The exact process to get this certificate varies between CAs, but in general, you need<br />

to prove to a CA that you are some sort of legally recognized business with a physical<br />

address <strong>and</strong> that the business in question owns the relevant domain name.<br />

You also need to generate a certificate signing request (CSR).The process for this<br />

varies from server to server.You can find instructions on the CAs’ websites. Stronghold<br />

<strong>and</strong> IIS provide a dialog box–driven process, whereas Apache requires you to type comm<strong>and</strong>s.<br />

However, the process is essentially the same for all servers.The result is an<br />

encrypted CSR.Your CSR should look something like this:<br />

---BEGIN NEW CERTIFICATE REQUEST---<br />

MIIBuwIBAAKBgQCLn1XX8faMHhtzStp9wY6BVTPuEU9bpMmhrb6vgaNZy4dTe6VS<br />

84p7wGepq5CQjfOL4Hjda+g12xzto8uxBkCDO98Xg9q86CY45HZk+q6GyGOLZSOD<br />

8cQHwh1oUP65s5Tz018OFBzpI3bHxfO6aYelWYziDiFKp1BrUdua+pK4SQIVAPLH<br />

SV9FSz8Z7IHOg1Zr5H82oQOlAoGAWSPWyfVXPAF8h2GDb+cf97k44VkHZ+Rxpe8G<br />

ghlfBn9L3ESWUZNOJMfDLlny7dStYU98VTVNekidYuaBsvyEkFrny7NCUmiuaSnX<br />

4UjtFDkNhX9j5YbCRGLmsc865AT54KRu31O2/dKHLo6NgFPirijHy99HJ4LRY9Z9<br />

HkXVzswCgYBwBFH2QfK88C6JKW3ah+6cHQ4Deoiltxi627WN5HcQLwkPGn+WtYSZ<br />

jG5tw4tqqogmJ+IP2F/5G6FI2DQP7QDvKNeAU8jXcuijuWo27S2sbhQtXgZRTZvO<br />

jGn89BC0mIHgHQMkI7vz35mx1Skk3VNq3ehwhGCvJlvoeiv2J8X2IQIVAOTRp7zp<br />

En7QlXnXw1s7xXbbuKP0<br />

---END NEW CERTIFICATE REQUEST---<br />

Armed with a CSR, the appropriate fee, <strong>and</strong> documentation to prove that you exist, <strong>and</strong><br />

having verified that the domain name you are using is in the same name as in the business<br />

documentation, you can sign up for a certificate with a CA.

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!