N15N

Talking with Apache the more secure way via SSL

Computer

This article is a summary of commands to configure the Apache Webserver to extend SSL coded content. Mainly intended as a private mnemonic it's maybe useful for others, too.

Create a RSA private key

(Triple-DES encrypted and PEM formatted):

openssl genrsa -des3 -out ca.key 1024

Decrypted version (officially not recommended) of this private key (lets apache start without asking for a password) via:

openssl rsa -in ca.key -out ca.key.unsecure

Generating a self-signed Certificate

Create a Certificate (X509 structure) with the RSA key you've just made:

openssl req -new -x509 -days 365 -key ca.key -out ca.crt

Informations you are going to be asked for:

  • Password to decrypt your key (Enter pass phrase for ca.key:)
  • Two letter code for geographic informations (Country Name (2 letter code): [AU]
  • Organization Name (eg, company) [Internet Widgits Pty Ltd]:)
  • The CN has to be set to the full qualified domain name (F.Q.D.N) your server is known by. (Common Name (eg, hostname) []:)
  • Your email address to be incorporated into your certification request. (Email Address []:)

Apache's virtual host configuration

Global settings

  • NameVirtualHost *:443 (see Apache docs)
  • Listen 10.10.10.10:443 (From which addresses requests are answered, there can be more than one; optional filter)

For each virtual host

<VirtualHost *:443>
ServerName the_server's_name
DocumentRoot "/var/www/foo/htdocs"
<Directory /var/www/foo>
(...)
</Directory>
# Enable/Disable SSL for this virtual host.
SSLEngine on
## SSL Cipher Suite:
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
#Gentoo Wiki http://en.gentoo-wiki.com/wiki/Apache2/SSL_Certificates#Configuring_Apache
SSLOptions StrictRequire
SSLProtocol all -SSLv2
SSLCertificateFile /etc/ssl/apache2/ca.crt
SSLCertificateKeyFile /etc/ssl/apache2/ca.key.unsecure
<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory "/var/www/localhost/cgi-bin">
SSLOptions +StdEnvVars
</Directory>
<IfModule log_config_module>
CustomLog /var/log/apache2/ssl_request_log \
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
</IfModule>
</VirtualHost>

Links

Monday, March 14. 2011
Comments (0) | Trackbacks (0)
Select language: English, Deutsch

Comments
Display comments as (Linear | Threaded)

No comments

Add Comment

E-Mail addresses will not be displayed and will only be used for E-Mail notifications.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA
 
Submitted comments will be subject to moderation before being displayed.
 

Quicksearch

Sprache

Topics