- Apache Httpd Ssl Configuration
- Apache Ssl Virtual Host Configuration
- Apache Httpd Ssl Configuration Linux
Create a CSR using OpenSSL & install your SSL certificate on your Apache server
Otherwise, your server may need you to manually restart Apache with the command 'apachectl startssl' during server re-boot, which typically involves the removal of the and that enclose your SSL configuration.
Use the instructions on this page to use OpenSSL to create your certificate signing request (CSR) and then to install your SSL certificate on your Apache server.
Restart Note: After you've installed your SSL/TLS certificate and configured the server to use it, you must restart your Apache instance.
Here is a short note on how to configure Apache to use a certificate file for SSL or How to enable https in Apache httpd server. After you enable SSL in the web server configuration, you should be able to access the application using https. Install The modssl Plugin. Make sure that modssl is installed. Install Apache webserver with SSL/TLS support To install the packages required, simply run as root: # yum install httpd modssl -y If the server already have httpd installed, you only need to install modssl, all the required configuration is done by the installer. The SSLCertificateFile and SSLCertificateKeyFile directives in the SSL.conf file must point to the corresponding certificate and key files. If you are using Apache virtual host feature, each virtual host you want to secure must have its own private key and server certificate. Generate a Private Key SSL uses keys to encrypt and decrypt messages. If you do not have access to your Apache server’s virtual hosts files, use an.htaccess file to rewrite HTTP requests to HTTPS. Add the following lines to a file named.htaccess file in your domain’s root directory (create the file if it doesn’t exist).
For Ubuntu instructions, see Ubuntu Server with Apache2: Create CSR & Install SSL Certificate (OpenSSL). For other OS/platform instructions, see Create a CSR (Certificate Signing Request).
You can use these instructions to create OpenSSL CSRs and install all types of DigiCert SSL certificates on your Apache server: Standard SSL, EV SSL, Multi-Domain SSL, EV Multi-Domain SSL, and Wildcard SSL.
To create your certificate signing request (CSR), see Apache: Creating Your CSR with OpenSSL.
Para un tutorial en español visite la página Apache Crear CSR.
To install your SSL certificate, see Apache: Installing & Configuring Your SSL Certificate.
Visite nuestras instrucciones en español para Apache Instalar Certificado SSL.
I. Apache: Creating Your CSR with OpenSSL
Use the instructions in this section to create your own shell commands to generate your Apache CSR with OpenSSL.
Recommended: Save yourself some time. Use the DigiCert OpenSSL CSR Wizard to generate an OpenSSL command to create your Apache CSR. Just fill out the form, click Generate, and then paste your customized OpenSSL command into your terminal.
How to Generate a CSR for Apache Using OpenSSL
If you prefer to build your own shell commands to generate your Apache CSR, follow the instructions below.
Log in to your server via your terminal client (ssh).
Run Command
At the prompt, type the following command:
Note: Make sure to replace server with the name of your server.
Generate Files
You've now started the process for generating the following two files:
- Private-Key File: Used to generate the CSR and later to secure and verify connections using the certificate.
- Certificate Signing Request (CSR) file: Used to order your SSL certificate and later to encrypt messages that only its corresponding private key can decrypt.
When prompted for the Common Name (domain name), type the fully qualified domain (FQDN) for the site that you are going to secure.
Note: If you're generating an Apache CSR for a Wildcard certificate, make sure your common name starts with an asterisk (e.g., *.example.com).
When prompted, type your organizational information, beginning with your geographic information.
Note: You may have already set up default information.
Now, your OpenSSL .csr file is created.
Order Your SSL/TLS Certificate
Open the .csr file you created with a text editor.
Copy the text, including the -----BEGIN NEW CERTIFICATE REQUEST----- and -----END NEW CERTIFICATE REQUEST----- tags, and paste it in to the DigiCert order form.
Save Private Key
Save (back up) the generated .key file. You need it later to install your SSL certificate.
Install Certificate
After you've received your SSL certificate from DigiCert, you can install it on your server.
II. Apache: Installing & Configuring Your SSL Certificate
If you still need to create a certificate signing request (CSR) and order your certificate, see Apache: Creating Your CSR with OpenSSL.
After we've validated and issued your SSL certificate, you can install it on your Apache server (where the CSR was generated) and configure the server to use the certificate.
How to Install and Configure Your SSL Certificate on Your Apache Server
Copy the certificate files to your server.
Log in to your DigiCert account and download the intermediate (DigiCertCA.crt) and your primary certificate (your_domain_name.crt) files.
Copy these files, along with the .key file you generated when creating the CSR, to the directory on the server where you keep your certificate and key files.
Note: Make them readable by root only to increase security.
Find the Apache configuration file (httpd.conf) you need to edit.
The location and name of the configuration file can vary from server to server—especially if you're using a special interface to manage your server configuration.
Apache's main configuration file is typically named httpd.conf or apache2.conf. Possible locations for this file include /etc/httpd/ or /etc/apache2/. For a comprehensive listing of default installation layouts for Apache HTTPD on various operating systems and distributions, see Httpd Wiki - DistrosDefaultLayout.
Often, the SSL certificate configuration is located in a <VirtualHost> block in a different configuration file. The configuration files may be under a directory like /etc/httpd/vhosts.d/, /etc/httpd/sites/, or in a file called httpd-ssl.conf.
One way to locate the SSL Configuration on Linux distributions is to search using grep, as shown in the example below.
Run the following command:
Note: Make sure to replace /etc/httpd/ with the base directory for your Apache installation.
Identify the SSL <VirtualHost> block you need to configure.
If your site needs to be accessible through both secure (https) and non-secure (http) connections, you need a virtual host for each type of connection. Make a copy of the existing non-secure virtual host and configure it for SSL as described in step 4.
If your site only needs to be accessed securely, configure the existing virtual host for SSL as described in step 4.
Configure the <VirtualHost> block for the SSL-enabled site
Below is a very simple example of a virtual host configured for SSL. The parts listed in blue are the parts you must add for SSL configuration.
Make sure to adjust the file names to match your certificate files.
SSLCertificateFile is your DigiCert certificate file (e.g., your_domain_name.crt).
SSLCertificateKeyFile is the .key file generated when you created the CSR (e.g., your_private.key).
SSLCertificateChainFile is the DigiCert intermediate certificate file (e.g., DigiCertCA.crt)
Note: If the SSLCertificateChainFile directive does not work, try using the SSLCACertificateFile directive instead.
Test your Apache configuration file before restarting.
As a best practice, check your Apache configuration file for any errors before restarting Apache.
Caution: Apache won't start again if your configuration files have syntax errors.
Run the following command to test your configuration file (on some systems, it's apache2ctl):
Restart Apache.
You can use apachectl commands to stop and start Apache with SSL support.
Restart Notes:
If Apache doesn't restart with SSL support, try using apachectl startssl instead of apachectl start. If SSL support only loads with apachectl startssl, we recommend you adjust the apache startup configuration to include SSL support in the regular apachectl start command. Otherwise, your server may require to manually restart Apache using apachectl startssl in the event of a server reboot. This usually involves removing the <IfDefine SSL> and </IfDefine> tags that enclose your SSL configuration.
Congratulations! You've successfully installed your SSL certificate.
Testing Your SSL/TLS Certificate Installation
Browser Test
For best results, make sure to close your web browser first and then re-launch it.
Visit your site with the secure https URL (i.e., go to https://www.example.com not http://www.example.com).
Be sure to test your site with more than just Internet Explorer. IE downloads missing intermediate certificates; whereas, other browsers give an error if all the certificates in the certificate chain aren't installed properly.
DigiCert® SSL Installation Diagnostic Tool
If your site's publicly accessible, use our Server Certificate Tester to test your SSL/TLS certificate installation; it detects common installation problems.
Troubleshooting
If your web site's publicly accessible, our SSL Certificate Tester tool can help you diagnose common problems.
If you receive a 'not trusted' warning, view the certificate details to see if it's the certificate you expect. Check the Subject, Issuer, and Valid To fields.
If it's the certificate you expect and the SSL certificate is issued by DigiCert, then your SSLCertificateChainFile is not configured correctly.
If you don't see the certificate you expect, then you may have another SSL <VirtualHost> block before the one you recently configured.
Name based virtual hosts aren't possible with https unless you use the same certificate for all virtual hosts (e.g., a Wildcard or a Multi-Domain SSL certificate).
This is not an Apache limitation, but an SSL protocol limitation. Apache must send a certificate during the SSL handshake before it receives the HTTP request that contains the Host header. Therefore, Apache always sends the SSLCertificateFile from the first <VirtualHost> block that matches the IP and port of the request.
For help moving your certificates to additional servers or across server platforms, see our OpenSSL export instructions.
If you need to disable SSL version 2 compatibility in order to meet PCI Compliance requirements, add the following directive to your Apache configuration file:
If the directive already exists, you may need to modify it to disable SSL version 2.
For instructions on how to fix common errors and for additional tips, see Troubleshooting Apache SSL Certificate Errors.
Apache Server Configuration
For information about Apache server configurations that can strengthen your SSL environment, see the following resources:
For Instructions on disabling the SSL v3 protocol, see Apache: Disabling the SSL v3 Protocol.
For information about enabling perfect forward secrecy, see Enabling Perfect Forward Secrecy.
Home > Articles
␡- SSL Configuration
This chapter is from the book
This chapter is from the book
SSL Configuration
The previous sections introduced the (not-so-basic) concepts behind SSL and you have learned how to generate keys and certificates. Now, finally, you can configure Apache to support SSL. mod_ssl must either be compiled statically or, if you have compiled as a loadable module, the appropriate LoadModule directive must be present in the file.
If you compiled Apache yourself, a new Apache configuration file, named ssl.conf, should be present in the conf/ directory. That file contains a sample Apache SSL configuration and is referenced from the main httpd.conf file via an Include directive.
If you want to start your configuration from scratch, you can add the following configuration snippet to your Apache configuration file:
With the previous configuration, you set up a new virtual host that will listen to port 443 (the default port for HTTPS) and you enable SSL on that virtual host with the SSLEngine directive.
You need to indicate where to find the server's certificate and the file containing the associated key. You do so by using SSLCertificateFile and SSLCertificateKeyfile directives.
Starting the Server
Now you can stop the server if it is running, and start it again. If your key is protected by a pass phrase, you will be prompted for it. After this, Apache will start and you should be able to connect securely to it via the https://http://www.example.com/ URL.
If you compiled and installed Apache yourself, in many of the vendor configuration files, you can see that the SSL directives are surrounded by an <IfDefine SSL> block. That allows for conditional starting of the server in SSL mode. If you start the httpd server binary directly, you can pass it the -DSSL flag at startup. You can also use the apachectl script by issuing the apachectl startssl command. Finally, if you always want to start Apache with SSL support, you can just remove the <ifDefine> section and start Apache in the usual way.
If you are unable to successfully start your server, check the Apache error log for clues about what might have gone wrong. For example, if you cannot bind to the port, make sure that another Apache is not running already. You must have administrator privileges to bind to port 443; otherwise, you can change the port to 8443 and access the URL via https://http://www.example.com:8443.
Configuration Directives
mod_ssl provides comprehensive technical reference documentation. This information will not be reproduced here; rather, I will explain what is possible and which configuration directives you need to use. You can then refer to the online SSL documentation bundled with Apache for the specific syntax or options.
Algorithms
You can control which ciphers and protocols are used via the SSLCipherSuite and SSLProtocol commands. For example, you can configure the server to use only strong encryption with the following configuration:
See the Apache documentation for a detailed description of all available ciphers and protocols.
Client Certificates
Similarly to how clients can verify the identity of servers using server certificates, servers can verify the identity of clients by requiring a client certificate and making sure that it is valid.
SSLCACertificateFile and SSLCACertificatePath are two Apache directives used to specify trusted Certificate Authorities. Only clients presenting certificates signed by these CAs will be allowed access to the server.
The SSLCACertificateFile directive takes a file containing a list of CAs as an argument. Alternatively, you could use the SSLCACertificatePath directive to specify a directory containing trusted CA files. Those files must have a specific format, described in the documentation. SSLVerifyClient enables or disables client certificate verification. SSLVerifyDepth controls the number of delegation levels allowed for a client certificate. The SSLCARevocationFile and SSLCARevocationPath directives enable you to specify certificate revocation lists to invalidate certificates.
Performance
SSL is a protocol that requires intensive calculations. mod_ssl and OpenSSL allow several ways to speed up the protocol by caching some of the information about the connection. You can cache certain settings using the SSLSessionCache and SSLSessionCacheTimeout directives. There is also built-in support for specialized cryptographic hardware that will perform the CPU-intensive computations and offload the main processor. The SSLMutex directive enables you to control the internal locking mechanism of the SSL engine. The SSLRandomSeed directive enables you to specify the mechanism to seed the random-number generator required for certain operations. The settings of both directives can have an impact on performance.
Logging
mod_ssl hooks into Apache's logging system and provides support for logging any SSL-related aspect of the request, ranging from the protocol used to the information contained in specific elements of a client certificate. This information can also be passed to CGI scripts via environment variables by using the StdEnvVars argument to the Options directive. You can get a listing of the available SSL variables at http://httpd.apache.org/docs-2.0/ssl/ssl_compat.html.
The SSLOptions Directive
Many of these options can be applied in a per-directory or per-location basis. The SSL parameters might be renegotiated for those URLs. This can be controlled via the SSLOptions directive.
The SSLPassPhraseDialog directive can be used to avoid having to enter a pass phrase at startup by designating an external program that will be invoked to provide it.
Access Control
The SSLRequireSSL directive enables you to force clients to access the server using SSL. The SSLRequire directive enables you to specify a set of rules that have to be met before the client is allowed access. SSLRequire syntax can be very complex, but itallows an incredible amount of flexibility. Listing 17.1 shows a sample configuration from the mod_ssl documentation that restricts access based on the client certificate and the network the request came from. Access will be granted if one of the following is met:
The SSL connection does not use an export (weak) cipher or a NULL cipher, the certificate has been issued by a particular CA and for a particular group, and the access takes place during workdays (Monday to Friday) and working hours (8:00 a.m. to 8:00 p.m.).
The client comes from an internal, trusted network.
You can check the documentation for SSLRequire for a complete syntax reference.
Apache Httpd Ssl Configuration
Listing 17.1 SSLRequire Example
Apache Ssl Virtual Host Configuration
Reverse Proxy with SSL
Apache Httpd Ssl Configuration Linux
Although at the time this book was written the SSL reverse proxy functionality was not included in mod_ssl for Apache 2.0, it is likely to be included in the future. That functionality enables you to encrypt the reverse proxy connection to backend servers and to perform client and server certificate authentication on that connection. The related directives are SSLProxyMachineCertificatePath, SSLProxyMachineCertificateFile, SSLProxyVerify, SSLProxyVerifyDepth, SSLProxyCACertificatePath, SSLProxyEngine, and SSLProxyCACertificateFile. Their syntax is similar to their regular counterparts. You can find more information about the Apache reverse proxy in Hour 15.