Apache is the most common web server used now a days, you would have already configured apache many times by now but what about configuring it with SSL i.e. using apache to service on the https protocol, i assume you have already configured the basic apache server and have also enabled the SSL module, if not refer to my previous post on Configuring Apache Web server.
The following post is an extremely simplified step by step guide to configure SSL in apache using Self Signed Certificates you can also use a real certificate issued by a CA if you have it
Prerequisites
1) Apache with SSL module enabled
2) openssl installed
Step 1) Generate a Private Key
We will use the openssl toolkit for generating a RSA Private Key and Certificate Signing Request, as the first step generate the key the command below will create a 1024bit key using 3des
abhishek@kashipur.in:~$ openssl genrsa -des3 -out server.key 1024
Generating RSA private key, 1024 bit long modulus
......................++++++
..................................++++++
unable to write 'random state'
e is 65537 (0x10001)
Enter pass phrase for server.key:
Verifying - Enter pass phrase for server.key:
Step 2) Generate a CSR (Certificate Signing Request)
Once the key is generated you will need to make a CSR or Certificate Signing Request, using the following command you can generate a CSR in this process you would be asked to enter various parameters as shown below
abhishek@kashipur.in:~$ openssl req -new -key server.key -out server.csr
Enter pass phrase for server.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:IN
State or Province Name (full name) [Some-State]:UK
Locality Name (eg, city) []:Kashipur
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Kashipur Networks
Organizational Unit Name (eg, section) []:
Common Name (eg, YOUR name) []:kashipur.net
Email Address []:abhishek at kashipur dot net
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Step 3) Remove Pass phrase from Key
This is completely an optional step if you skip this you will have to run to the server as and when the server restarts to enter the pass phase :) , use the following commands to get rid of this problem
abhishek@kashipur.in:~$ cp server.key server.key.org
abhishek@kashipur.in:~$ openssl rsa -in server.key.org -out server.key
Enter pass phrase for server.key.org:
writing RSA key
Step 4) Generating a Self-Signed Certificate
Once you have your Key and CSR ready its time to generate the Certificate use the following command to generate a certificate
abhishek@kashipur.in:~$ openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
Signature ok
subject=/C=IN/ST=UK/L=Kashipur/O=Kashipur Networks/CN=kashipur.net/emailAddress=abhishek at kashipur dot net
Getting Private key
Step 5) Copy Certificate and Key to Apache Folder
After following the steps above you would have the following files generated
abhishek@kashipur.in:~$ ls -l
-rw-r--r-- 1 abhishek abhishek 952 2009-06-12 14:30 server.crt
-rw-r--r-- 1 abhishek abhishek 704 2009-06-12 14:27 server.csr
-rw-r--r-- 1 abhishek abhishek 887 2009-06-12 14:29 server.key
-rw-r--r-- 1 abhishek abhishek 963 2009-06-12 14:28 server.key.org
Copy the crt and key file to a preferable location inside the apache configuration folder generally /etc/apache2/cert using the following command
abhishek@kashipur.in:~$ cp server.crt server.key /etc/apache2/cert
Step 6) Configure Apache with SSL
Once you have your Certificate and Key copied, modify your httpd.conf to reflect the following
SSLEngine on
SSLCertificateFile /etc/apache2/cert/server.crt
SSLCertificateKeyFile /etc/apache2/cert/server.key
SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
CustomLog logs/ssl_request_log \
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
Ensure apache is listening to Port 443 if not add the Listen Directive. After making these changes preferable verify the configuration file using the following command
abhishek@kashipur.in:~$ apache2ctl configtest
Syntax OK
Once you see Syntax OK you are ready to use https.
Step 7) Restart Apache and test
To apply the configuration changed you need to restart apache which can be done using the following command
root@kashipur.in:~# service apache2 restart
or
root@kashipur.in:~# service httpd restart (in many cases)
Once you restart test it by appending https:// to the URL
Happy HTTPS :)
I recently shifted to Debian GNU/Linux (Lenny), and the first task included configuring my Internet Connection, i use BSNL EVDO Modem to connect to the internet which is not recognized my default in Debian so following is the process by which i configured my BSNL EVDO in Debian
Recent comments
find .