Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
| docs:apache_web_server:ssl [2010/10/01 12:25] – billh | docs:apache_web_server:ssl [2010/12/09 09:25] (current) – billh | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| ====== ssl for Apache ====== | ====== ssl for Apache ====== | ||
| - | The steps below were done using Apache 2.0.63. | ||
| - | ===== setup ===== | + | ===== setup (apache 2.2.x) ===== |
| + | See the setup section below, but understand that newer apache' | ||
| + | [warn] Init: Name-based SSL virtual hosts only work for clients with TLS server name indication support (RFC 4366) | ||
| + | </ | ||
| + | |||
| + | To avoid seeing the warning, you can change the LogLevel parameter in httpd.conf to somethiing other than " | ||
| + | |||
| + | ===== setup (apache 2.0.63) | ||
| - setup Apache2 as usual (make sure to get the version with SSL support) | - setup Apache2 as usual (make sure to get the version with SSL support) | ||
| - in httpd.conf, comment out Port 80, and use Listen lines instead< | - in httpd.conf, comment out Port 80, and use Listen lines instead< | ||
| Line 8: | Line 14: | ||
| Listen 80 | Listen 80 | ||
| Listen 443</ | Listen 443</ | ||
| - | - make certs and keys (repeat for other name based virtual hosts) | + | - make certs and keys (see appropriate sections below) |
| - | - example on Windows 7, using a cygwin terminal, creating a wildcard certificate | + | - in httpd.conf, add ssl support by uncommenting this line:< |
| - | | + | LoadModule ssl_module modules/ |
| + | </ | ||
| + | - in httpd.conf, set up named based virtual hosts:< | ||
| + | NameVirtualHost *:80 | ||
| + | NameVirtualHost *:443 | ||
| + | |||
| + | < | ||
| + | DocumentRoot "/ | ||
| + | ServerName my-server | ||
| + | </ | ||
| + | </ | ||
| + | - tweak ssl.conf to have the following (probably best to remove the _default_ virtual host entry)< | ||
| + | # see http:// | ||
| + | SSLMutex sem | ||
| + | SSLRandomSeed startup builtin | ||
| + | SSLSessionCache none | ||
| + | |||
| + | SSLLog logs/ | ||
| + | SSLLogLevel info | ||
| + | # You can later change " | ||
| + | |||
| + | < | ||
| + | DocumentRoot "/ | ||
| + | ServerName my-server | ||
| + | SSLEngine On | ||
| + | SSLCertificateFile conf/ | ||
| + | SSLCertificateKeyFile conf/ | ||
| + | </ | ||
| + | </ | ||
| + | - Don't forget to call apache with -D SSL if the IfDefine directive is active in the config file! On Unix, it would look like this:< | ||
| + | apachectl -D SSL -k start | ||
| + | </ | ||
| + | |||
| + | ===== make ssl key and certificate (cygwin method) ===== | ||
| + | This example | ||
| + | | ||
| openssl req -config / | openssl req -config / | ||
| Line 40: | Line 81: | ||
| An optional company name []: | An optional company name []: | ||
| </ | </ | ||
| - | * (this is making your private key) enter password as you created it above< | + | - (this is making your private key) enter password as you created it above< |
| openssl rsa -in privkey.pem -out myname.local.key | openssl rsa -in privkey.pem -out myname.local.key | ||
| Line 46: | Line 87: | ||
| writing RSA key | writing RSA key | ||
| </ | </ | ||
| - | * (this is creating the self signed certificate) < | + | - (this is creating the self signed certificate) < |
| openssl x509 -in myname.local.csr -out myname.local.cert -req -signkey myname.local.key -days 10000 | openssl x509 -in myname.local.csr -out myname.local.cert -req -signkey myname.local.key -days 10000 | ||
| Line 53: | Line 94: | ||
| Getting Private key | Getting Private key | ||
| </ | </ | ||
| - | * copy files to your apache server< | + | - copy files to your apache server< |
| cp myname.local.cert / | cp myname.local.cert / | ||
| cp myname.local.key / | cp myname.local.key / | ||
| </ | </ | ||
| - | - if the above example works for you, don't bother trying the steps below from a windows command | + | |
| - | - the Apache2 SSL archive comes with an openssl binary in Apache2/ | + | ===== make ssl key and certificate (windows command |
| - | - open a command terminal and go to Apache2/ | + | - the Apache2 SSL archive comes with an openssl binary in Apache2/ |
| - | - substitute your domain in place of my-server< | + | - open a command terminal and go to Apache2/ |
| + | - substitute your domain in place of my-server< | ||
| openssl req -config ../ | openssl req -config ../ | ||
| openssl rsa -in privkey.pem -out my-server.key | openssl rsa -in privkey.pem -out my-server.key | ||
| openssl x509 -in my-server.csr -out my-server.cert -req -signkey my-server.key -days 10000 | openssl x509 -in my-server.csr -out my-server.cert -req -signkey my-server.key -days 10000 | ||
| </ | </ | ||
| - | | + | |
| - | - in httpd.conf, add ssl support by uncommenting this line:< | + | |
| - | LoadModule ssl_module modules/ | + | |
| - | </ | + | |
| - | - in httpd.conf, set up named based virtual hosts:< | + | |
| - | NameVirtualHost *:80 | + | |
| - | NameVirtualHost *:443 | + | |
| - | < | + | ===== See Also ===== |
| - | | + | |
| - | ServerName my-server | + | |
| - | </ | + | |
| - | </ | + | |
| - | - tweak ssl.conf to have the following (probably best to remove the _default_ virtual host entry)< | + | |
| - | # see http:// | + | |
| - | SSLMutex sem | + | |
| - | SSLRandomSeed startup builtin | + | |
| - | SSLSessionCache none | + | |
| - | + | ||
| - | SSLLog logs/ | + | |
| - | SSLLogLevel info | + | |
| - | # You can later change " | + | |
| - | + | ||
| - | < | + | |
| - | DocumentRoot "/ | + | |
| - | ServerName my-server | + | |
| - | SSLEngine On | + | |
| - | SSLCertificateFile conf/ | + | |
| - | SSLCertificateKeyFile conf/ | + | |
| - | </ | + | |
| - | </ | + | |
| - | - Don't forget to call apache with -D SSL if the IfDefine directive is active in the config file! On Unix, it would look like this:< | + | |
| - | apachectl -D SSL -k start | + | |
| - | </ | + | |
| ===== External Links ===== | ===== External Links ===== | ||
| * http:// | * http:// | ||