First of all, we need SSL to be installed and Apache to have the SSL module installed. You can check whether OpenSSL is installed with the command:
# dpkg --list | grep openssl
ii openssl 0.9.8k-7ubuntu8.5 Secure Socket Layer (SSL) binary and related
ii python-openssl 0.10-1 Python wrapper around the OpenSSL library
If the command returned nothing - we go install OpenSSL - it won't work without it.
Installing OpenSSL
# aptitude update
# aptitude install openssl
mod_ssl in ApacheWe also need mod_ssl to be enabled in Apache. Let's check:
# cd /etc/apache2/mods-enabled
# ls | grep ssl
ssl.conf
ssl.load
If the command returned nothing - we need to enable this module. To do this, run:
# ln -s /etc/apache2/mods-available/ssl.conf /etc/apache2/mods-enabled/ssl.conf
# ln -s /etc/apache2/mods-available/ssl.load /etc/apache2/mods-enabled/ssl.load
Here it is assumed that mod_ssl is installed in Apache. For example, it comes bundled with a LAMP server, but if Apache was built by you from source and there's no ssl module, you'll have to build it separately.
Generating certificates.Create a directory where the certificates will be stored. You can store them either in Apache's own directory, or in any location accessible to Apache, for example, in the site's directory.
# cd /etc/apache2
# mkdir sslcerts
# chown www-data:www-data sslcerts
# cd sslcerts
Now let's move on to creating the certificates.
# openssl genrsa -des3 -rand /dev/random -out server.key 1024
Here you will be asked to enter a passphrase, which will be used later to authorize the server key. Enter this phrase carefully - we will need it in all the following steps, including specifying it in the Apache config!
Note. If the process hangs and does nothing - interrupt it with Ctrl+C and use "/dev/urandom" instead of "/dev/random".
Next.
# openssl rsa -in server.key -out server.pem
Enter pass phrase for server.key:
writing RSA key
# openssl req -new -key server.key -out mysite.csr
Here you will be asked to enter some data to be placed in the certificate. Enter whatever you think is appropriate, except for the Common name field. In this field you must specify the FQDN address of the site the certificate will be issued for (for example, mysite.ru). If you don't do this, browsers will consider it an error and flag the certificate as having an incorrect Common name. On the other hand, browsers don't like a self-signed certificate (as in our case) anyway, so one more error or one less - it's up to you, especially if you want to use a single certificate for several sites at once.
Instead of mysite.csr you can use a name similar to the site's name - this is already a file belonging to the site.
You can skip the extra attributes entirely.
Next.
# openssl x509 -req -days 3650 -in mysite.csr -signkey server.key -out mysite.crt
The number 3650 is the number of days the certificate will be valid. The standard value - 365 - is often too little, because administrators frequently forget to renew certificates every year.
The following points should be noted here:
a) The server.* files are the files on the basis of which all other site certificates will be generated. We generated them once.
b) For another site (second, third, etc.), there is no need to generate the server.key and server.pem files again!
c) You will have to use the same passphrase to generate the remaining certificates (for other sites).
Configuring ApacheOur certificates are ready, it's time to configure Apache to support SSL/HTTPS.
1) Go to /etc/apache2/mods-enabled and edit the ssl.conf file
Find the line
SSLPassPhraseDialog builtin
and replace it with
SSLPassPhraseDialog |/etc/apache2/sslpwd.sh
2) Open the file /etc/apache2/ports.conf for editing
In the "<IfModule mod_ssl.c>" block, before the closing of the block, after the "Listen 443" line, add the line "NameVirtualHost *:443":
<IfModule mod_ssl.c>
# If you add NameVirtualHost *:443 here, you will also have to change
# the VirtualHost statement in /etc/apache2/sites-available/default-ssl
# to <VirtualHost *:443>
# Server Name Indication for SSL named virtual hosts is currently not
# supported by MSIE on Windows XP.
Listen 443
NameVirtualHost *:443
</IfModule>
3) Edit the file /etc/apache2/sites-available/default-ssl and change "<VirtualHost _default_:443>" to "<VirtualHost *:443>":
<VirtualHost *:443>
4) Create a new file /etc/apache2/sslpwd.sh with the following content:
#!/bin/sh
/bin/echo "ваша_ключевая_фраза"
where instead of "ваша_ключевая_фраза" ("your_passphrase") specify the phrase you used when creating the certificates, also in quotes (that's safer). And give this file execute permissions:
# cd /etc/apache2
# chmod 755 sslpwd.sh
5) Now we need to configure the site itself so it can work with SSL. To do this, open our site's config from /etc/apache2/sites-enabled/mysite.ru
Instead of mysite.ru - the name of your site's config file.
In order for the site to be available over SSL, you need to set up a separate config for port 443. Note that the same server name (ServerName) can have both HTTP and HTTPS configs. Below is an example of a site config that can be made available over both HTTPS and HTTP.
# HTTPS-version
<VirtualHost *:443>
ServerName mysite.ru
ServerAlias www.mysite.ru
DocumentRoot /www/mysite.ru
DirectoryIndex index.php
SSLEngine on
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
BrowserMatch ".*MSIE.*" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
SSLCertificateFile /etc/apache2/sslcerts/mysite.crt
SSLCertificateKeyFile /etc/apache2/sslcerts/server.pem
</VirtualHost>
# And HTTP-version
<VirtualHost *:80>
ServerName mysite.ru
ServerAlias www.mysite.ru
DocumentRoot /www/mysite.ru
DirectoryIndex index.php
</VirtualHost>
6) Restart Apache:
# /etc/init.d/apache2 restart
That's it, the mysite.ru site will be available over both HTTP and HTTPS. You can, of course, close off the HTTP version. To do this, just remove the whole section:
<VirtualHost *:80>
Applies to: Apache 2.x and Debian Lenny/Squeeze
Comments