Differences
This shows you the differences between two versions of the page.
| Next revision | Previous revision | ||
| docs:apache_web_server:ssl [2008/03/06 16:34] – created billh | docs:apache_web_server:ssl [2010/12/09 09:25] (current) – billh | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| ====== ssl for Apache ====== | ====== ssl for Apache ====== | ||
| - | The steps below were done using Apache 2.0.63. | ||
| - | ===== setup ===== | + | ===== setup (apache 2.2.x) ===== |
| + | See the setup section below, but understand that newer apache' | ||
| + | [warn] Init: Name-based SSL virtual hosts only work for clients with TLS server name indication support (RFC 4366) | ||
| + | </ | ||
| + | |||
| + | To avoid seeing the warning, you can change the LogLevel parameter in httpd.conf to somethiing other than " | ||
| + | |||
| + | ===== setup (apache 2.0.63) | ||
| - setup Apache2 as usual (make sure to get the version with SSL support) | - setup Apache2 as usual (make sure to get the version with SSL support) | ||
| - in httpd.conf, comment out Port 80, and use Listen lines instead< | - in httpd.conf, comment out Port 80, and use Listen lines instead< | ||
| Line 8: | Line 14: | ||
| Listen 80 | Listen 80 | ||
| Listen 443</ | Listen 443</ | ||
| - | - make certs and keys (repeat for other name based virtual hosts) | + | - make certs and keys (see appropriate sections below) |
| - | - the Apache2 SSL archive comes with an openssl binary in Apache2/ | + | |
| - | - open a command terminal and go to Apache2/ | + | |
| - | - substitute your domain in place of my-server< | + | |
| - | openssl req -config ../ | + | |
| - | openssl rsa -in privkey.pem -out my-server.key | + | |
| - | openssl x509 -in my-server.csr -out my-server.cert -req -signkey my-server.key -days 10000 | + | |
| - | </ | + | |
| - | - copy the .cert and .key file from the previous step to a new directory of Apache2/ | + | |
| - in httpd.conf, add ssl support by uncommenting this line:< | - in httpd.conf, add ssl support by uncommenting this line:< | ||
| LoadModule ssl_module modules/ | LoadModule ssl_module modules/ | ||
| Line 50: | Line 48: | ||
| apachectl -D SSL -k start | apachectl -D SSL -k start | ||
| </ | </ | ||
| + | |||
| + | ===== make ssl key and certificate (cygwin method) ===== | ||
| + | This example is on Windows 7, using a cygwin terminal, creating a wildcard certificate | ||
| + | - (this is making the request) the wildcard part is the asterisk when asked for the CN; enter something like 1234 for the password< | ||
| + | openssl req -config / | ||
| + | |||
| + | Generating a 1024 bit RSA private key | ||
| + | .......++++++ | ||
| + | ..............++++++ | ||
| + | writing new private key to ' | ||
| + | Enter PEM pass phrase: | ||
| + | Verifying - Enter PEM pass phrase: | ||
| + | ----- | ||
| + | You are about to be asked to enter information that will be incorporated | ||
| + | into your certificate request. | ||
| + | What you are about to enter is what is called a Distinguished Name or a DN. | ||
| + | There are quite a few fields but you can leave some blank | ||
| + | For some fields there will be a default value, | ||
| + | If you enter ' | ||
| + | ----- | ||
| + | Country Name (2 letter code) [AU]:US | ||
| + | State or Province Name (full name) [Some-State]: | ||
| + | Locality Name (eg, city) []: | ||
| + | Organization Name (eg, company) [Internet Widgits Pty Ltd]: | ||
| + | Organizational Unit Name (eg, section) []:IS | ||
| + | Common Name (eg, YOUR name) []: | ||
| + | Email Address []: | ||
| + | |||
| + | Please enter the following ' | ||
| + | to be sent with your certificate request | ||
| + | A challenge password []: | ||
| + | An optional company name []: | ||
| + | </ | ||
| + | - (this is making your private key) enter password as you created it above< | ||
| + | openssl rsa -in privkey.pem -out myname.local.key | ||
| + | |||
| + | Enter pass phrase for privkey.pem: | ||
| + | writing RSA key | ||
| + | </ | ||
| + | - (this is creating the self signed certificate) < | ||
| + | openssl x509 -in myname.local.csr -out myname.local.cert -req -signkey myname.local.key -days 10000 | ||
| + | |||
| + | Signature ok | ||
| + | subject=/ | ||
| + | Getting Private key | ||
| + | </ | ||
| + | - copy files to your apache server< | ||
| + | cp myname.local.cert / | ||
| + | cp myname.local.key / | ||
| + | </ | ||
| + | |||
| + | ===== make ssl key and certificate (windows command line method) ===== | ||
| + | - the Apache2 SSL archive comes with an openssl binary in Apache2/ | ||
| + | - open a command terminal and go to Apache2/bin | ||
| + | - substitute your domain in place of my-server< | ||
| + | openssl req -config ../ | ||
| + | openssl rsa -in privkey.pem -out my-server.key | ||
| + | openssl x509 -in my-server.csr -out my-server.cert -req -signkey my-server.key -days 10000 | ||
| + | </ | ||
| + | - copy the .cert and .key file from the previous step to a new directory of Apache2/ | ||
| + | |||
| + | ===== See Also ===== | ||
| + | * [[docs: | ||
| ===== External Links ===== | ===== External Links ===== | ||
| * http:// | * http:// | ||