Introduction

Edit online

This white paper describes how to configure an Apache HTTPS server with mod_nss under RHEL 7 to exploit the cryptographic hardware functions available with IBM® z Systems™. A scenario is provided that you might wish to repeat in your own installation.

There are two security modules that can be used for setting up the SSL/TLS implementation in an Apache HTTPS server:
  • mod_ssl
  • mod_nss
The scenario uses the mod_nss security module.
In addition, the scenario was tested using:
  • A RHEL7.1 operating system that was installed in an LPAR of an IBM zEnterprise® EC12 System.
  • Central Processor Assist for Cryptographic Functions (CPACF).
  • A Crypto Express4 (CEX4) adapter.

The tools and path/file names used in this white paper might be different for other Linux™ software distributions.

The appendix provides a sample SELinux policy module that you can use as a template.