After successfully installing the ssl certificate Let’s Encrypt, you need to download the files located in the “ZIP” folder. This folder must be unpacked. You can order the New SSL Certificate Let’s Encrypt by chicking in the link:  https://hostry.com/solutions/ssl-for-free/

You need to open the folder with the files needed to install the certificate. They need to copy them in a text editor.

Then, issuing the certificate you will need to configure Apache. To configure Apache2, you must save the primary, intermediate certificate and private key to a folder on the server.

After, you need to open the Apache configuration file in a text editor. Apache configuration files are usually stored in /etc/httpd/ or /etc/apache2/. The main configuration file is usually called httpd.conf or apache2.conf

If You need the site to be accessible via a secure connection (HTTPS) and also through an unsecured connection (HTTP) You will need to create a virtual host for each type of connection. Copy the existing virtual host for the http connection and change the port from 80 to 443.

Then in this case You need to add the following:

<VirtualHost 192.168.0.1:443>
     DocumentRoot /var/www/website
     ServerName www.domain.com
     SSLEngine on
     SSLCertificateFile /etc/ssl/crt/certificate.crt
     SSLCertificateKeyFile /etc/ssl/crt/private.key
     SSLCertificateChainFile /etc/ssl/crt/ca_bundle.crt
     </VirtualHost> 

1. SSLCertificateFile should be your primary certificate file for your domain name.
2. SSLCertificateKeyFile should be the key file generated when you created the CSR.
3. SSLCertificateChainFile should be the intermediate certificate file (if any) that was supplied by your certificate authority

After a successful configuration, you must save the changes (Ctrl+S).
It is best to test the configuration in advance for various syntax errors, otherwise Apache simply will not start.

In Finish, restart Apache, using the command:

systemctl restart apache2

Then, issuing the certificate you will need to configure Nginx . You must save the primary, intermediate certificates and private key to a folder on the server

After that, you need to open the nginx configuration file. Usually, it is located in the following way: /etc/nginx/sites-available. As a rule, the file should be called default.

IMPORTANT!

You need to create two independent configurations for the HTTP and HTTPS protocols. A domain must address both protocols. If you do not register the connection via HTTPS, then your site will not be protected, and if it will not be registered through HTTP, the site will not open.

In the default configuration file you need to make changes. In order for your HTTPS to be present in the configuration file, you need to specify the following:

server {
 listen              443 ssl;
 server_name         www.example.com;
 ssl_certificate     etc/ssl/ctr/ca_bundle
 ssl_certificate_key etc/ssl/crt/private.key

 ...

*In this case, server_name is your existing domain (site), where both port 80 and port 443 will be referred to.

• Ca_bundle – Public server certificate. It is sent to each client connecting to the server
• Private.key – The private key should be stored in a file with limited access (permissions should allow the main nginx process to read this file).

After configuration, you must restart nginx:

systemctl restart nginx

Install Python 3.7 on your web server

On Nginx

To use Python 3.x (any version), you must enter the following:

# pacman -S uwsgi-plugin-python

Test python

In the appropriate test.py directory, the contents are listed below:

#-*- coding: utf-8 -*-
def wsgi_app(environment, start_response):
    import sys
    output = sys.version.encode('utf8')
    status = '200 OK'
    headers = [('Content-type', 'text/plain'),
               ('Content-Length', str(len(output)))]
    start_response(status, headers)
    yield output

application = wsgi_app

On Apache

Add /etc/httpd/conf/httpd.conf to the end or edit the corresponding configuration file and then add to the corresponding <VirtualHost> block:

WSGIScriptAlias /wsgi_app /srv/http/test.py

Restart Apache

# systemctl restart httpd

Follow the link in the browser http:// YOUR-SERVER-WEB-ADDRESS-OR-IP/wsgi_app and you can see a text page with all versions of Python and GCC.

Delete the test.py test file you just created and WSGIScriptAlias ​​in your Apache configuration.

On Nginx

Create the file /etc/uwsgi/wsgi_app.ini with the following contents:

[uwsgi]
socket = /run/uwsgi/wsgi_app.sock
uid = http
gid = http
plugins = python
chdir = /usr/share/nginx/html/
wsgi-file=test.py
callable = application

Start service uWSGI wsqi_app:

# systemctl start uwsgi@wsgi_app

You need to give Nginx permission to use uWSGI by editing /etc/nginx/nginx.conf, and for each server block that you want to test, add the following. Alternatively, if you use virtual hosts, edit the configuration file for each host:

location ~ \wsgi_app {
    root /usr/share/nginx/html/;
    include uwsgi_params;
    uwsgi_pass unix:/run/uwsgi/wsgi_app.sock;
}

Restart Nginx:

# systemctl restart nginx

Visit your web browser, http://YOUR-SERVER-WEB-ADDRESS-OR-IP/wsgi_app and you will see a test page with versions of Python and GCC.

Delete the test.py file you just created and the location block you just added /etc/nginx/nginx.conf to wsgi_app.

Restart Nginx

# systemctl restart nginx

Stop serving uWSGI wsgi_app:

# systemctl stop uwsgi@wsgi_app

In the final episode, you need to delete /etc/uwsgi/wsgi_app.ini, test files, who you created earlier.

Install Web Server

The first thing we offer you is installing a web server

yum install httpd php

Personal Home Directory Protection

The following is protection for your home directories. The first thing to understand is that the directories of other users are classified and not visible to anyone, except for the owners, respectively.

We suggest you change all directories to 700; this is to ensure that only the appropriate home directory owners can view their own files

chmod 700 /home
chmod 700 /home/*
chmod 700 /home/*/*

Apply security patch for the Apache to split user privileges

The first thing to learn we need to first install the repository containing the package with the patch. Run the following commands as root or sudo

yum install epel-release
yum install httpd-itk

Through “apache2-mpm-itk” we can see which PHP user should run depending on the virtual host. It adds a new extension in the configuration of AssignUserId virtualhost-user virtualhost-user-group, which allows Apache / PHP to execute user code under a specific user account.

Сreate a virtual host

To create a virtual host in Apache, you can follow this example, which is presented below (for example, taken example.com)

NameVirtualHost example.com

<VirtualHost example.com>

DocumentRoot /home/vhost-user/public_html
ServerName example.com
</VirtualHost>

Next, open the text editor /etc/httpd/conf.d/example-virtualhost.conf and add the contents above. Here is the command to use nano:

nano /etc/httpd/conf.d/example-virtualhost.conf

Configure Apache Web Server to run as another user

After launched the protection of the Apache / PHP server, the following should be added:

AssignUserId vhost-user vhost-user-group

This will look like an example of a virtual host, after the option is added:

NameVirtualHost example.com

<VirtualHost example.com>

DocumentRoot /home/vhost-user/public_html
ServerName example.com
AssignUserId vhost-user vhost-user-group

</VirtualHost>

Next, you need to Hide the version of Apache. To do this, enter the command:

nano /etc/httpd/conf/httpd.conf

Then in the line “ServerTokens” change the parameter after it to “ProductOnly”. This tell to Apache only to show that it is “Apache” and not “Apache / 2.2” or something like that

At the end, restart the Apache server

service httpd restart

Initial stage

The first thing you should start with is backing up the old configuration and all its data. Having done this, you can use the following command

cd ~
mkdir nginx
cp -r /etc/nginx ~/nginx

Next is the removal of the Nginx web server itself

yum remove nginx

Next up is the installation of OpenSSL and all its dependencies

yum install zlib-devel pcre-devel openssl libssl-devel make gcc gcc-c++ -y

Compiling Nginx

Important! You need to use wget in order to be able to get the source code of Nginx

cd ~ wget https://nginx.org/download/nginx-1.8.0.tar.gz

Following is the unpacking of the archive

tar -xvf nginx-1.8.0.tar.gz

Next step is the assembly and installation of the Nginx web server

cd ~/nginx-1.8.0 ./configure --with-http_spdy_module --with-http_ssl_module --with-http_gzip_static_module make install

Configuring Nginx as a working service. For this, it is recommended to use a third-party script from GitHub for the init.d service

cd /etc/init.d wget https://gist.githubusercontent.com/sairam/5892520/raw/b8195a71e944d46271c8a49f2717f70bcd04bf1a/nginx chmod +x nginx

Configuring Nginx

At this point you can move the old configuration back to the folder в /etc/nginx

Web server loading

service nginx start

Nginx Configuration Editing

vi /etc/nginx/nginx.conf

In the “http” block, you need to add the following:

gzip_vary on;

gzip_proxied any;

gzip_comp_level 6;

gzip_buffers 16 8k;

gzip_http_version 1.1;

gzip_types text/plain text/css text/JavaScript;

Exit and save the file by pressing the ESC key :wq, then typing, then press Enter

Reload Nginx

service nginx reload