TLS 1.3 is a version of the Transport Layer Security (TLS) protocol that was published in 2018 as a proposed standard in RFC 8446. It offers security and performance improvements over its predecessors.

This guide will demonstrate how to enable TLS 1.3 using the Apache web server on Ubuntu 18.04.

Requirements

  • Server running Ubuntu 18.04.
  • A valid domain name and properly configured A/AAAA/CNAME DNS records for your domain.
  • A valid TLS certificate. We will get one from Let's Encrypt.
  • Apache version 2.4.36 or greater.
  • OpenSSL version 1.1.1 or greater.

Before you begin

Check the Ubuntu version.

lsb_release -ds
# Ubuntu 18.04.4 LTS

Create a new non-root user account with sudo access and switch to it.

adduser johndoe --gecos "John Doe"
usermod -aG sudo johndoe
su - johndoe

NOTE: Replace johndoe with your username.

Set up the timezone.

sudo dpkg-reconfigure tzdata

Ensure that your system is up to date.

sudo apt update && sudo apt upgrade -y

Install the needed packages.

sudo apt install -y zip unzip curl wget git socat

Install the acme.sh client and obtain a TLS certificate from Let's Encrypt

It is recommended to install acme.sh as root. So become a root user with su command.

sudo su - root

Install acme.sh.

git clone https://github.com/acmesh-official/acme.sh
cd acme.sh 
sudo ./acme.sh --install --accountemail your_email@example.com
cd ~
source ~/.bashrc

Check the version.

acme.sh --version
# https://github.com/acmesh-official/acme.sh
# v2.8.6

Obtain RSA and ECDSA certificates for your domain.

# RSA
acme.sh --issue --standalone -d example.com --keylength 2048
# ECC/ECDSA
acme.sh --issue --standalone -d example.com --keylength ec-256

NOTE: Replace example.com in commands with your domain name.

Create sensible directories to store your certs and keys in. We will use /etc/letsencrypt.

mkdir -p /etc/letsencrypt/example.com
mkdir -p /etc/letsencrypt/example.com_ecc

Install and copy certificates to /etc/letsencrypt.

# RSA
acme.sh --install-cert -d example.com --cert-file /etc/letsencrypt/example.com/cert.pem --key-file /etc/letsencrypt/example.com/private.key --fullchain-file /etc/letsencrypt/example.com/fullchain.pem 
# ECC/ECDSA
acme.sh --install-cert -d example.com --ecc --cert-file /etc/letsencrypt/example.com_ecc/cert.pem --key-file /etc/letsencrypt/example.com_ecc/private.key --fullchain-file /etc/letsencrypt/example.com_ecc/fullchain.pem

After running the above commands, your certificates and keys will be in the following locations:

  • RSA: /etc/letsencrypt/example.com
  • ECC/ECDSA: /etc/letsencrypt/example.com_ecc

You can now return to the normal sudo user.

exit

Install Apache

Apache added support for TLS 1.3 in version 2.4.36. Ubuntu 18.04 system comes with Apache that is little to old for TLS 1.3. You will need to compile a version that supports TLS 1.3 or use a third-party PPA. In this tutorial, we will use the PPA option that is pretty safe and secure in the Linux community. If you are concerned about security, consider building Apache from the source code.

Download and install the latest 2.4 version of Apache from Ondrej PPA.

sudo add-apt-repository ppa:ondrej/apache2
sudo apt update
sudo apt install -y apache2

Check the version.

sudo apache2 -v
# Server version: Apache/2.4.41 (Ubuntu)
# Server built:   2019-08-21T20:43:21

Start and enable Apache.

sudo systemctl start apache2.service
sudo systemctl enable apache2.service

Configure Apache for TLS 1.3

Now that we have successfully installed Apache, we are ready to configure it to start using TLS 1.3 on our server.

First, enable the SSL module.

sudo a2enmod ssl

To activate the new module, you need to restart Apache.

sudo systemctl restart apache2

Run sudo vim /etc/apache2/sites-available/example.com.conf, and populate the file with the following basic configuration.

<IfModule mod_ssl.c>
  <VirtualHost *:443>
    ServerName example.com

    SSLEngine on
    SSLProtocol all -SSLv2 -SSLv3

    # RSA
    SSLCertificateFile "/etc/letsencrypt/example.com/fullchain.pem"
    SSLCertificateKeyFile "/etc/letsencrypt/example.com/private.key"
    # ECC
    SSLCertificateFile "/etc/letsencrypt/example.com_ecc/fullchain.pem"
    SSLCertificateKeyFile "/etc/letsencrypt/example.com_ecc/private.key"

  </VirtualHost>
</IfModule>

Save the file and exit with : + W + Q.

Activate the new configuration file by linking the file to the sites-enabled directory.

sudo a2ensite example.com.conf

Check the configuration.

sudo apachectl configtest

Reload Apache to activate the new configuration.

sudo systemctl reload apache2

Open your site via HTTPS protocol in your web browser. To verify TLS 1.3, you can use browser dev tools or SSL Labs service. The screenshots below show Chrome's security tab with TLS 1.3 in action.

Insert screenshot here
Insert screenshot here

You have successfully enabled TLS 1.3 in Apache on your Ubuntu 18.04 server. Just like with HTTP/2, TLS 1.3 is another exciting protocol update that we can expect to benefit from for years to come. The final version of TLS 1.3 was defined in August 2018, so there’s no better time to start embracing this technology.