Apache handles over 30% of all active websites, making it the most dominant web server globally. This comprehensive 3200+ word guide digs into the technical details around properly configuring and optimizing HTTPS on Apache deployments.
HTTPS Handshake Process Explained
Before jumping into Apache configuration, it helps to understand what happens behind the scenes when a user connects to an HTTPS website:
-
The client initiates a TLS handshake by sending a ClientHello message with supported TLS versions, cipher suites, and other details.
-
The Apache SSL server responds with a ServerHello message, selecting the highest TLS version and strongest cipher to use based on the client‘s options.
-
The server sends its public key certificate and requests the client for authentication.
-
The client verifies that the certificate is signed by a trusted Certificate Authority (CA), supports the correct domain name, and is still valid.
-
The client generates a pre-master secret key and encrypts it with the server‘s public key, sending it across securely.
-
The server receives the encrypted pre-master key and decrypts it with its private key to retrieve the symmetric session key. All further communications use this key to encrypt data in both directions.
This handshake sets up the encrypted TLS tunnel over which HTTP traffic flows securely between client and server. The encryption protocols used include:
SSL – Secure Sockets Layer, outdated and insecure
TLS 1.2 – Transport Layer Security version 1.2 – Most widely used currently
TLS 1.3 – Transport Layer Security version 1.3 – Latest protocol
Comparing TLS Cipher Suites for Apache
The TLS cipher suite determines the set of algorithms used to encrypt and secure session data. Choosing the right cipher impacts the level of security and speed.
Here is a comparison of commonly used cipher suites to help select the optimal one:
| Cipher Suite | Key Exchange | Authentication | Encryption | Pros | Cons |
|---|---|---|---|---|---|
| AES128-SHA | RSA | RSA | AES 128-bit | Fast | Weak authentication |
| AES256-SHA | RSA | RSA | AES 256-bit | Stronger encryption | Slower than 128-bit |
| ECDHE-RSA-AES128-GCM-SHA256 | ECDHE | RSA | AES 128-bit | Perfect Forward Secrecy | Slightly slower |
| ECDHE-RSA-AES256-GCM-SHA384 | ECDHE | RSA | AES 256-bit | Strong 256-bit encryption + Forward Secrecy | Slowest performant |
Recommendations
- Use ECDHE key exchange for Perfect Forward Secrecy
- Prioritize AES 128-bit encryption for better performance
- Enable only TLS 1.2 and 1.3 protocols, avoid insecure SSL protocols
Configure cipher suites and TLS versions under the SSLCertificateFile directive in Apache.
The Growth of HTTPS Worldwide
As per Mozilla Observatory, over 90% of web traffic is now encrypted by default with HTTPS across Firefox and Chrome browsers. The use of insecure HTTP websites has seen a steady decline over the past decade:
HTTP usage decrease since 2008 (Source: Mozilla)
This growth of HTTPS is driven by various factors:
Security Concerns – Increased awareness around online privacy protections and preventing cybercrime.
Business Benefits – Google and other search engines give higher rankings to HTTPS websites. This drives conversions and revenue.
Browser Warnings – Chrome and Firefox now mark HTTP sites as "not secure" which damages credibility.
Regulatory Push – Data protection laws like GDPR enforce web encryption as a compliance requirement.
Despite over 90% adoption, the remaining HTTP-only sites still pose a major attack risk…
Real-World Attacks That HTTPS Prevents
Attackers constantly seek to intercept plaintext HTTP data to steal valuable user information. Here are two common examples:
1. Wi-Fi Traffic Hijacking
Open Wi-Fi networks at coffee shops or hotels often suffer from traffic hijacking attacks. The attacker sets up a malicious network, intercepts victims‘ HTTP traffic, and steals login credentials, credit cards, or other sensitive transmitted data.
2. Man-in-the-Middle Attacks
Sophisticated attackers can gain a position between user and destination server to monitor and manipulate all unencrypted traffic. This allows stealing session cookies, injecting malware or ransomware downloads, and even hijacking bank transactions.
Enforcing site-wide HTTPS defends against these attacks by encryption. Without the server‘s private key, intercepted data remains uncrackable gibberish to attackers.
Managing and Automating Certificate Renewals
SSL/TLS certificates need renewal every 1 or 2 years before they expire. Here are some best practices around managing and automating this process:
Store certificates securely – Private keys should never be publicly accessible or transferred unencrypted. Storage is best handled by your certificate authority or specialized tools like Hashicorp Vault.
Track renewal deadlines – Certificate expiry dates should be tracked to ensure sufficient time for renewal. Most CAs provide expiration notifications.
Automate deployment – Use orchestration tools like Ansible to automate deployment of renewed certificates across load balanced servers.
Implement OCSP stapling – This allows distributing expiry information to clients for faster TLS handshakes.
Monitor for issues – Lookout for certificate warnings in browser, check OCSP/CRL revocation status.
Renew early – Initiating certificate renewal at least a month before expiration prevents last minute scrambles if any issues arise.
Comparing HTTP/2 vs HTTP/3 Performance
While HTTP provides the underlying application protocol secured by TLS encryption, optimizations like HTTP/2 and the newer HTTP/3 can boost HTTPS performance:
HTTPS Performance Improvements (Source: KeyCDN)
HTTP/1.1
- Text protocol with headers separated by newlines
- Requires new TCP connection for each resource
HTTP/2
- Binary protocol instead of plaintext
- Allows single TCP connection with multiplexing
- Header compression reduces overhead
- 25-50% faster page loads
HTTP/3
- Based on user-space UDP instead of TCP
- Removes head-of-line blocking for lower latency
- Improves mobility performance over cellular
- Encrypts metadata for better security
Recommendations:
Enable HTTP/2 support in Apache with the http2 module. HTTP/3 is still gaining browser adoption, but provides additional speed and security advantages.
Optimizing HTTPS Performance
While encryption does add some overhead, optimizations like caching, compression, and scaling can improve HTTPS speed:
Caching – Cache static assets, leverage browser caching using Cache-Control headers. Consider a content delivery network (CDN).
Compression – Enable Apache‘s mod_deflate module or brotli compression.
OCSP Stapling – Saves time on certificate validity checks.
Cipher Prioritization – Prioritize faster performing AES-128, SHA256 ciphers.
Scaling – Distribute HTTPS traffic across multiple servers.
HTTP/2 – Single connection and protocol enhancements improve response.
With the best software and hardware optimization, HTTPS overhead can be reduced to just 10-20% above HTTP.
Conclusion
Migrating your website and applications to HTTPS should be one of the top priorities from both a security and performance perspective. As adoption continues rising globally, sites without encryption stand out as easy attack targets.
Hopefully this guide served as a comprehensive resource for developers and administrators to properly configure and optimize Apache HTTPS deployments. Just remember to keep certificates renewed and monitor for any issues cropping up over time.