How To Enable HTTPS for Varnish Cache using Hitch on CentOS/RHEL 8?

In today's world of internet security, enabling HTTPS on your website is crucial to ensure the privacy and safety of your users' data. One way to achieve this is by using Varnish Cache and Hitch, a lightweight TLS proxy, to offload SSL/TLS processing from Varnish.

In this article, we will guide you through the process of enabling HTTPS for Varnish Cache using Hitch on CentOS/RHEL 8.

Prerequisites

Before we begin, ensure that you have the following −

• A CentOS/RHEL 8 server

• Root access to the server

• Varnish Cache and Hitch installed

• A valid SSL/TLS certificate and private key

If you don't have Varnish Cache and Hitch installed, you can install them by following these commands −

sudo dnf install varnish hitch

Step 1: Configuring Hitch

First, we need to configure Hitch to listen on a port and forward requests to Varnish Cache. To do this, we will create a new configuration file /etc/hitch/hitch.conf.

Open the file in your favorite text editor −

sudo nano /etc/hitch/hitch.conf

Add the following content to the file −

# Listen on port 443
frontend = "[*]:443"

# Forward requests to Varnish Cache
backend = "[::1]:6081"

# Use the SSL/TLS certificate and private key
pem-file = "/path/to/your/certificate.pem"

Replace /path/to/your/certificate.pem with the path to your SSL/TLS certificate and private key.

Save and close the file.

Step 2: Configuring Varnish Cache

Next, we need to configure Varnish Cache to use Hitch as its SSL/TLS proxy.

Open the Varnish Cache configuration file /etc/varnish/varnish.params in your text editor −

sudo nano /etc/varnish/varnish.params

Add the following content to the file −

# Use Hitch as the SSL/TLS proxy
VARNISH_BACKEND_PORT=8443
VARNISH_BACKEND_SSL=on
VARNISH_BACKEND_SSL_VERIFY_PEER=on
VARNISH_BACKEND_TLS_CERT=/path/to/your/certificate.pem
VARNISH_BACKEND_TLS_KEY=/path/to/your/certificate.pem

Replace /path/to/your/certificate.pem with the path to your SSL/TLS certificate and private key.

Save and close the file.

Step 3: Restart Services

Finally, restart the Hitch and Varnish Cache services to apply the new configurations −

sudo systemctl restart hitch
sudo systemctl restart varnish

While the above steps are sufficient to enable HTTPS for Varnish Cache using Hitch on CentOS/RHEL 8, there are a few additional things you can do to further enhance the security of your website.

Use a Certificate Authority (CA)

Instead of using a self-signed SSL/TLS certificate, consider using a certificate issued by a trusted Certificate Authority (CA). This will improve the trustworthiness of your website in the eyes of your users and prevent warning messages from appearing in their browsers.

You can obtain a certificate from a trusted CA by purchasing one from a commercial provider or using a free CA like Let's Encrypt.

Implement HSTS

HTTP Strict Transport Security (HSTS) is a security feature that instructs web browsers to only communicate with your website over HTTPS for a specified period of time. This can prevent downgrade attacks and improve the overall security of your website.

To implement HSTS, add the following header to your Hitch configuration file −

# Enable HSTS for 1 year
tls-protos = TLSv1.2
ciphers = "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH"
hsts = on
hsts-max-age = 31536000
hsts-include-subdomains = on

This will enable HSTS for 1 year and include all subdomains.

Implement OCSP Stapling

Online Certificate Status Protocol (OCSP) Stapling is a security feature that allows the server to obtain the revocation status of its SSL/TLS certificate from the CA and provide it to the client. This can improve the performance and security of your website by reducing the time it takes to check the revocation status of the certificate.

To implement OCSP Stapling, add the following lines to your Hitch configuration file −

# Enable OCSP Stapling
ocsp-dir = "/var/lib/hitch/ocsp"
verify-ocsp = on

This will enable OCSP Stapling and store the responses in the /var/lib/hitch/ocsp directory.

By implementing these additional security features, you can further enhance the security and trustworthiness of your website.

Here are some additional steps you can take to optimize the performance of Varnish Cache and Hitch −

Use HTTP/2

HTTP/2 is a major revision of the HTTP protocol that significantly improves the performance of web pages. It supports features like server push, multiplexing, and header compression, which can reduce the number of requests and improve the loading speed of your website.

To use HTTP/2, you need to enable it in both Varnish Cache and Hitch. Here's how −

In Varnish Cache, add the following line to the /etc/varnish/varnish.params file −

# Enable HTTP/2
VARNISH_LISTEN_PORT=80,8080 v1

In Hitch, add the following line to the /etc/hitch/hitch.conf file −

# Enable HTTP/2
alpn-protos = h2,h2c,http/1.1

Once you've made these changes, restart the Varnish Cache and Hitch services −

sudo systemctl restart varnish
sudo systemctl restart hitch

Cache Static Content

Caching static content like images, CSS, and JavaScript files can significantly improve the performance of your website. By caching these files in Varnish Cache, you can reduce the number of requests and speed up the loading time for your users.

To cache static content in Varnish Cache, you need to add the following lines to your Varnish Cache configuration file (/etc/varnish/default.vcl) −

# Cache static content for 1 day
sub vcl_recv {
   if (req.url ~ "\.(jpg|jpeg|gif|png|bmp|ico|pdf|flv|swf|css|js)(\?.*|)$") {
      unset req.http.Cookie;
      set req.url = regsub(req.url, "\?.*$", "");
      set req.http.static = "YES";
      if (req.request == "GET") {
         return (hash);
      }
      return (pass);
   }
}

sub vcl_backend_response {
   if (bereq.http.static == "YES") {
      set beresp.ttl = 1d;
   }
}

This will cache static content for 1 day and bypass the cache for other requests.

Monitor Performance

Finally, it's important to monitor the performance of your website and make adjustments as needed. You can use tools like Varnishstat and Hitchstats to monitor the performance of Varnish Cache and Hitch, respectively.

To use Varnishstat, run the following command −

varnishstat

To use Hitchstats, run the following command −

hitch-stats --frontend=127.0.0.1:8443

These tools will give you valuable insights into the performance of your website and help you identify areas for improvement.

By following these steps, you can optimize the performance of Varnish Cache and Hitch and provide your users with a fast and secure browsing experience.

Conclusion

In this article, we have shown you how to enable HTTPS for Varnish Cache using Hitch on CentOS/RHEL 8. By offloading SSL/TLS processing to Hitch, we have improved the performance and security of our website. Remember to keep your SSL/TLS certificate and private key secure and up-to-date to ensure the continued safety of your users' data.