TLS 1.3 is a version of the Transport Layer Security (TLS) protocol that was published in 2018 as a proposed standard in RFC 8446. It offers security and performance improvements over its predecessors.
This guide will demonstrate how to enable TLS 1.3 using the Apache web server on Ubuntu 18.04.
- Server running Ubuntu 18.04.
- A valid domain name and properly configured
CNAMEDNS records for your domain.
- A valid TLS certificate. We will get one from Let's Encrypt.
- Apache version
- OpenSSL version
Before you begin
Check the Ubuntu version.
lsb_release -ds # Ubuntu 18.04.4 LTS
Create a new
non-root user account with
sudo access and switch to it.
adduser johndoe --gecos "John Doe" usermod -aG sudo johndoe su - johndoe
johndoe with your username.
Set up the timezone.
sudo dpkg-reconfigure tzdata
Ensure that your system is up to date.
sudo apt update && sudo apt upgrade -y
Install the needed packages.
sudo apt install -y zip unzip curl wget git socat
acme.sh client and obtain a TLS certificate from Let's Encrypt
It is recommended to install
root. So become a
root user with
sudo su - root
git clone https://github.com/acmesh-official/acme.sh cd acme.sh sudo ./acme.sh --install --accountemail firstname.lastname@example.org cd ~ source ~/.bashrc
Check the version.
acme.sh --version # https://github.com/acmesh-official/acme.sh # v2.8.6
Obtain RSA and ECDSA certificates for your domain.
# RSA acme.sh --issue --standalone -d example.com --keylength 2048 # ECC/ECDSA acme.sh --issue --standalone -d example.com --keylength ec-256
example.com in commands with your domain name.
Create sensible directories to store your certs and keys in. We will use
mkdir -p /etc/letsencrypt/example.com mkdir -p /etc/letsencrypt/example.com_ecc
Install and copy certificates to
# RSA acme.sh --install-cert -d example.com --cert-file /etc/letsencrypt/example.com/cert.pem --key-file /etc/letsencrypt/example.com/private.key --fullchain-file /etc/letsencrypt/example.com/fullchain.pem # ECC/ECDSA acme.sh --install-cert -d example.com --ecc --cert-file /etc/letsencrypt/example.com_ecc/cert.pem --key-file /etc/letsencrypt/example.com_ecc/private.key --fullchain-file /etc/letsencrypt/example.com_ecc/fullchain.pem
After running the above commands, your certificates and keys will be in the following locations:
You can now return to the normal
Apache added support for TLS 1.3 in version 2.4.36. Ubuntu 18.04 system comes with Apache that is little to old for TLS 1.3. You will need to compile a version that supports TLS 1.3 or use a third-party PPA. In this tutorial, we will use the PPA option that is pretty safe and secure in the Linux community. If you are concerned about security, consider building Apache from the source code.
Download and install the latest 2.4 version of Apache from Ondrej PPA.
sudo add-apt-repository ppa:ondrej/apache2 sudo apt update sudo apt install -y apache2
Check the version.
sudo apache2 -v # Server version: Apache/2.4.41 (Ubuntu) # Server built: 2019-08-21T20:43:21
Start and enable Apache.
sudo systemctl start apache2.service sudo systemctl enable apache2.service
Configure Apache for TLS 1.3
Now that we have successfully installed Apache, we are ready to configure it to start using TLS 1.3 on our server.
First, enable the SSL module.
sudo a2enmod ssl
To activate the new module, you need to restart Apache.
sudo systemctl restart apache2
sudo vim /etc/apache2/sites-available/example.com.conf, and populate the file with the following basic configuration.
<IfModule mod_ssl.c> <VirtualHost *:443> ServerName example.com SSLEngine on SSLProtocol all -SSLv2 -SSLv3 # RSA SSLCertificateFile "/etc/letsencrypt/example.com/fullchain.pem" SSLCertificateKeyFile "/etc/letsencrypt/example.com/private.key" # ECC SSLCertificateFile "/etc/letsencrypt/example.com_ecc/fullchain.pem" SSLCertificateKeyFile "/etc/letsencrypt/example.com_ecc/private.key" </VirtualHost> </IfModule>
Save the file and exit with : + W + Q.
Activate the new configuration file by linking the file to the
sudo a2ensite example.com.conf
Check the configuration.
sudo apachectl configtest
Reload Apache to activate the new configuration.
sudo systemctl reload apache2
Open your site via HTTPS protocol in your web browser. To verify TLS 1.3, you can use browser dev tools or SSL Labs service. The screenshots below show Chrome's security tab with TLS 1.3 in action.
You have successfully enabled TLS 1.3 in Apache on your Ubuntu 18.04 server. Just like with HTTP/2, TLS 1.3 is another exciting protocol update that we can expect to benefit from for years to come. The final version of TLS 1.3 was defined in August 2018, so there’s no better time to start embracing this technology.