From HTTP to HTTPS: Securing a Landing Page on XAMPP with a Public Domain

Dari HTTP ke HTTPS: Mengamankan Landing Page di XAMPP dengan Domain Publik

Bicara soal keamanan website, khususnya SSL/HTTPS, saya jadi inget pertama kali nyoba pasang sertifikat di XAMPP. Dulu mah masih pake self-signed, terus pas mau bikin live, kepikiran banget buat beli yang resmi. Apalagi sekarang, masalah privasi dan keamanan data udah jadi hal yang umum. Jadi gini, saya mau cerita rencana implementasi SSL untuk website landing page yang jalan di XAMPP Apache di server Windows. Intinya gimana caranya bikin website yang tadinya cuma HTTP jadi HTTPS, dan diakses pake domain publik.

Arsitektur yang Direncanakan

Sebelum masuk ke teknisnya, kita lihat dulu alurnya. Domain → DNS → IP Publik → Router/Firewall → Server Lokal Windows → Apache/XAMPP. Sederhana sih sebenernya, tapi setiap titik punya peran penting. Karena websitenya cuma landing page, pilihannya ya sertifikat DV (Domain Validation) Single Domain. Ga perlu OV, EV, atau Wildcard kecuali emang ada kebijakan khusus dari organisasi.

Biaya dan Pilihan SSL

Soal biaya, sertifikat SSL berbayar itu kisarannya sekitar Rp200.000 sampai Rp700.000 per tahun. Tergantung penerbit dan paketnya. Karena domain saya pake Rumahweb, saya bisa beli langsung SSL dari Rumahweb. Terus nanti dipasang manual di Apache XAMPP. Lumayan ribet dikit, tapi lebih terkontrol.

Langkah Awal Sebelum SSL

Tahap pertama, pastiin dulu A Record domain dan hostname www (kalo perlu) diarahin ke IP publik. Terus, lakuin port forwarding TCP 80 dan 443 dari router/firewall ke server XAMPP. Jangan lupa, Windows Firewall juga harus ngizinin koneksi ini. Sebelum SSL dipasang, website harus udah bisa diakses lewat HTTP dari internet. Ini penting banget, biar kita yakin kalo konfigurasi dasarnya udah bener.

Bikin CSR dan Private Key

Nah, setelah HTTP aman, kita mulai bikin CSR (Certificate Signing Request) pake OpenSSL XAMPP. Ini pake RSA 2048-bit. Prosesnya ngasilin dua file: .csr sama private key .key. File .csr ini nanti kita pake buat proses validasi dan penerbitan sertifikat. Sedangkan private key, jangan sampe kebocoran. Simpen di tempat yang aman.

Setelah sertifikat terbit, kita dapet file certificate dan CA bundle/chain. Simpen di lokasi khusus, misalnya C:\SSL\, dan jangan di dalam folder website publik.

Konfigurasi Apache buat HTTPS

Ini bagian yang agak teknis. Apache dikonfigurasi pake VirtualHost di port 443. Di situ kita aktifin SSL/TLS, tentuin ServerName, ServerAlias, DocumentRoot, sama lokasi file certificate, private key, dan certificate chain. Jangan sampe salah path, soalnya Apache bakal error kalo ga nemu file-file itu.

Setelah HTTPS berhasil, VirtualHost port 80 kita pake buat redirect permanen dari HTTP ke HTTPS. Jadi semua akses website bakal pake koneksi terenkripsi. Ini penting biar pengunjung ga bisa akses versi HTTP-nya.

Restart dan Pengujian

Langkah terakhir: restart Apache dan uji coba. Pastiin ga ada error di konfigurasi, HTTPS bisa diakses, redirect HTTP → HTTPS jalan, dan browser nunjukin koneksi aman (ada gembok hijau).

Catatan Penting

Yang perlu diingat, SSL cuma ngamainkan komunikasi antara client dan server. Ini bukan pengganti firewall, backup, keamanan aplikasi, update sistem, pengamanan private key, atau monitoring. Jadi tetep harus jaga semua aspek keamanan secara keseluruhan.

Gitu aja sih. Semoga ngebantu.

From HTTP to HTTPS: Securing a Landing Page on XAMPP with a Public Domain

Talking about website security, especially SSL/HTTPS, reminds me of the first time I tried installing a certificate on XAMPP. Back then, I was still using self-signed certificates. But when I wanted to go live, I really thought about getting a proper one. Especially now, privacy and data security have become common concerns. So, let me share my plan for implementing SSL for a landing page website running on XAMPP Apache on a Windows server. The main goal is to figure out how to turn a plain HTTP website into HTTPS and access it through a public domain.

The Planned Architecture

Before diving into the technical details, let's look at the flow. Domain → DNS → Public IP → Router/Firewall → Local Windows Server → Apache/XAMPP. It's actually quite simple, but each point plays a crucial role. Since the website is just a landing page, the choice is a DV (Domain Validation) Single Domain certificate. There's no need for OV, EV, or Wildcard unless there's a specific organizational policy.

Costs and SSL Options

Regarding costs, paid SSL certificates range from around Rp200,000 to Rp700,000 per year. It depends on the issuer and the package. Since my domain is with Rumahweb, I can directly purchase the SSL from Rumahweb. Then, I'll install it manually on Apache XAMPP. It's a bit more complicated, but it gives me more control.

Initial Steps Before SSL

The first step is to make sure the A Record for the domain and the www hostname (if needed) are pointed to the public IP. Then, perform port forwarding for TCP 80 and 443 from the router/firewall to the XAMPP server. Also, don't forget that Windows Firewall must allow these connections. Before installing SSL, the website must already be accessible via HTTP from the internet. This is crucial so that we're sure the basic configuration is correct.

Creating CSR and Private Key

Once HTTP is set up, we start creating a CSR (Certificate Signing Request) using OpenSSL from XAMPP. This uses RSA 2048-bit. The process produces two files: a .csr and a private key .key. The .csr file will be used for the validation and certificate issuance process. The private key, however, must be kept secret. Store it in a safe place.

After the certificate is issued, we get the certificate file and the CA bundle/chain. Store them in a special location, for example C:\SSL\, and not inside the public website folder.

Configuring Apache for HTTPS

This is the more technical part. Apache is configured using a VirtualHost on port 443. There, we enable SSL/TLS, specify the ServerName, ServerAlias, DocumentRoot, and the locations of the certificate file, private key, and certificate chain. Make sure the paths are correct, because Apache will throw an error if it can't find these files.

After HTTPS is successful, the VirtualHost on port 80 is used for a permanent redirect from HTTP to HTTPS. So, all website access will use an encrypted connection. This is important so that visitors can't access the HTTP version.

Restart and Testing

The final step is to restart Apache and perform testing. Make sure there are no configuration errors, HTTPS is accessible, the HTTP → HTTPS redirect works, and the browser shows a secure connection (a green padlock).

Important Notes

It's important to remember that SSL only secures the communication between the client and the server. It is not a replacement for a firewall, backups, application security, system updates, private key protection, or monitoring. So, we must still maintain all aspects of security as a whole.

That's about it. Hope this helps.

Terima kasih sudah mampir! Jika kamu menikmati konten ini dan ingin menunjukkan dukunganmu, bagaimana kalau mentraktirku secangkir kopi? 😊 Ini adalah gestur kecil yang sangat membantu untuk menjaga semangatku agar terus membuat konten-konten keren. Tidak ada paksaan, tapi secangkir kopi darimu pasti akan membuat hariku jadi sedikit lebih cerah. ☕️

☕ Buy Me Coffee