First of all, we need SSL to be installed and Apache to have the SSL module installed. You can check whether OpenSSL is installed with the command:
# pkg_info | grep openssl
openssl-1.0.0_3 SSL and crypto library
If the command returned nothing - we go install OpenSSL - it won't work without it.
Installing OpenSSLGo to /usr/ports/security/openssl and install it.
# cd /usr/ports/security/openssl
# make config
// I left everything at the default here
# make install clean
mod_ssl in ApacheWe also need Apache to be built with HTTPS/SSL support. Let's check this.
# cd /usr/local/etc/apache22
# cat httpd.conf | grep mod_ssl
LoadModule ssl_module libexec/apache22/mod_ssl.so
If the command returned nothing - Apache was most likely built without mod_ssl support. In that case, rebuild Apache with SSL support:
# cd /usr/ports/www/apache22
# make deinstall
# make config
// enable mod_ssl support here
# make reinstall clean
Generating certificates.Create a directory where the certificates will be stored. You can store them either in Apache's own directory, or in any location accessible to Apache, for example, in the site's directory.
# cd /usr/local/etc/apache22
# mkdir sslcerts
# chown www:www sslcerts
# cd sslcerts
Now let's move on to creating the certificates.
# openssl genrsa -des3 -rand /dev/random -out server.key 1024
Here you will be asked to enter a passphrase, which will be used later to authorize the server key. Enter this phrase carefully - we will need it in all the following steps, including specifying it in the Apache config!
Next.
# openssl rsa -in server.key -out server.pem
Enter pass phrase for server.key:
writing RSA key
# openssl req -new -key server.key -out mysite.csr
Here you will be asked to enter some data to be placed in the certificate. Enter whatever you think is appropriate, except for the Common name field. In this field you must specify the FQDN address of the site the certificate will be issued for (for example, mysite.ru). If you don't do this, browsers will consider it an error and flag the certificate as having an incorrect Common name. On the other hand, browsers don't like a self-signed certificate (as in our case) anyway, so one more error or one less - it's up to you, especially if you want to use a single certificate for several sites at once.
Instead of mysite.csr you can use a name similar to the site's name - this is already a file belonging to the site.
You can skip the extra attributes entirely.
Next.
# openssl x509 -req -days 3650 -in mysite.csr -signkey server.key -out mysite.crt
The number 3650 is the number of days the certificate will be valid. The standard value - 365 - is often too little, because administrators frequently forget to renew certificates every year.
The following points should be noted here:
a) The server.* files are the files on the basis of which all other site certificates will be generated. We generated them once.
b) For another site (second, third, etc.), there is no need to generate the server.key and server.pem files again!
c) You will have to use the same passphrase to generate the remaining certificates (for other sites).
Configuring ApacheOur certificates are ready, it's time to configure Apache to support SSL/HTTPS. To do this, open the file /usr/local/etc/apache22/httpd.conf for editing.
1) You need to make sure the line
LoadModule ssl_module libexec/apache22/mod_ssl.so
is uncommented.
2) Now find the line
NameVirtualHost *:80
and add the same line, but with port 443:
NameVirtualHost *:443
Here it is assumed, of course, that you are using the concept of virtual hosts (VirtualHost).
3) Find the line:
Include etc/apache22/extra/httpd-ssl.conf
and uncomment it.
4) Save the file and close it.
Create a new file /usr/local/etc/apache22/sslpwd.sh with the following content:
#!/bin/sh
/bin/echo "ваша_ключевая_фраза"
where instead of "ваша_ключевая_фраза" ("your_passphrase") specify the phrase you used when creating the certificates, also in quotes (that's safer). And give this file execute permissions:
# cd /usr/local/etc/apache22
# chmod 755 sslpwd.sh
5) In the /usr/local/etc/apache22/extra directory there is a file httpd-ssl.conf, open it for editing.
Find the phrase
SSLPassPhraseDialog builtin
and replace it with
SSLPassPhraseDialog |/usr/local/etc/apache22/sslpwd.sh
With this we achieve starting SSLEngine without prompting for the passphrase from the console when Apache starts.
6) In this same file, find the line "VirtualHost <_default_:443>" and comment out everything, including it, from it up to and including the line "</VirtualHost>", otherwise your <VirtualHost> sites will not work.
7) Save the file and close it.
8) Now we need to configure the site itself so it can work with SSL. To do this, open our site's config (if your site configs are located directly in httpd.conf - then open that).
In order for the site to be available over SSL, you need to set up a separate config for port 443. Note that the same server name (ServerName) can have both HTTP and HTTPS configs. Below is an example of a site config that can be made available over both HTTPS and HTTP.
# HTTPS-version
<VirtualHost *:443>
ServerName mysite.ru
ServerAlias www.mysite.ru
DocumentRoot /www/mysite.ru
DirectoryIndex index.php
SSLEngine on
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory "/usr/local/www/apache22/cgi-bin">
SSLOptions +StdEnvVars
</Directory>
BrowserMatch ".*MSIE.*" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
SSLCertificateFile /usr/local/etc/apache22/sslcerts/mysite.crt
SSLCertificateKeyFile /usr/local/etc/apache22/sslcerts/server.pem
</VirtualHost>
# And HTTP-version
<VirtualHost *:80>
ServerName mysite.ru
ServerAlias www.mysite.ru
DocumentRoot /www/mysite.ru
DirectoryIndex index.php
</VirtualHost>
9) Save and close.
10) Restart Apache:
# /usr/local/etc/rc.d/apache22 restart
That's it, the mysite.ru site will be available over both HTTP and HTTPS. You can, of course, close off the HTTP version. To do this, just remove the whole section:
<VirtualHost *:80>
Applies to: Apache 2.x on FreeBSD, any version
Comments