Apache httpd/SSL - Revision history

Woozle: Woozle moved page Apache web server/SSL to Apache httpd/SSL: more accurate

2022-04-01T14:49:04Z

Woozle moved page Apache web server/SSL to Apache httpd/SSL: more accurate

← Older revision	Revision as of 14:49, 1 April 2022
(No difference)

Woozle: question

2015-03-18T15:53:04Z

question

← Older revision		Revision as of 15:53, 18 March 2015
Line 1:		Line 1:
	==About==		==About==
	This page is about getting the [[Apache web server]] to work with [[Secure Sockets Layer\|SSL]].		This page is about getting the [[Apache web server]] to work with [[Secure Sockets Layer\|SSL]].
			==Question==
			* '''Q''': Is it possible to serve https on multiple domains from a single IP address?
			** I was originally told that this was technically impossible. I was later told that it is doable, but I haven't yet found instructions. --[[User:Woozle\|Woozle]] ([[User talk:Woozle\|talk]]) 11:53, 18 March 2015 (EDT)
	==How To==		==How To==
	To get SSL working with virtual hosting (or at all, really), I had to do the following:		To get SSL working with virtual hosting (or at all, really), I had to do the following:

Woozle: /* Links */ removing the passphrase

2015-03-17T22:52:37Z

Links: removing the passphrase

← Older revision		Revision as of 22:52, 17 March 2015
Line 63:		Line 63:
	** [http://httpd.apache.org/docs/2.2/mod/mod_ssl.html mod_ssl]: the Apache module which provides SSL/TLS support		** [http://httpd.apache.org/docs/2.2/mod/mod_ssl.html mod_ssl]: the Apache module which provides SSL/TLS support
	* [http://www.thegeekstuff.com/2009/07/linux-apache-mod-ssl-generate-key-csr-crt-file/ How To Generate SSL Key, CSR and Self Signed Certificate For Apache]		* [http://www.thegeekstuff.com/2009/07/linux-apache-mod-ssl-generate-key-csr-crt-file/ How To Generate SSL Key, CSR and Self Signed Certificate For Apache]
			** [http://www.webhosting.uk.com/kb/how-to-remove-the-passphrase-from-an-apache-ssl-key/ How to remove the passphrase from an Apache SSL Key]: necessary if you want Apache to restart unattended after following the instructions from The Geek Stuff

Woozle: /* Links */ 2 more, from tabs

2012-04-12T13:29:23Z

Links: 2 more, from tabs

← Older revision		Revision as of 13:29, 12 April 2012
Line 61:		Line 61:
	==Links==		==Links==
	* [http://httpd.apache.org/docs/2.2/ssl/ Apache 2.2]: official documentation		* [http://httpd.apache.org/docs/2.2/ssl/ Apache 2.2]: official documentation
			** [http://httpd.apache.org/docs/2.2/mod/mod_ssl.html mod_ssl]: the Apache module which provides SSL/TLS support
			* [http://www.thegeekstuff.com/2009/07/linux-apache-mod-ssl-generate-key-csr-crt-file/ How To Generate SSL Key, CSR and Self Signed Certificate For Apache]

Woozle: reference link from SSL page

2012-04-12T13:16:58Z

reference link from SSL page

← Older revision		Revision as of 13:16, 12 April 2012
Line 59:		Line 59:

	One way to test for this problem might have been to attempt to ssh to port 443.		One way to test for this problem might have been to attempt to ssh to port 443.
			==Links==
			* [http://httpd.apache.org/docs/2.2/ssl/ Apache 2.2]: official documentation

Woozle: moved software/Apache/SSL to Apache web server/SSL

2012-04-12T13:13:22Z

moved software/Apache/SSL to Apache web server/SSL

← Older revision	Revision as of 13:13, 12 April 2012
(No difference)

Woozle: extracted from main Apache page; added notes about confused port 443

2012-04-12T13:10:11Z

extracted from main Apache page; added notes about confused port 443

New page

==About==
This page is about getting the [[Apache web server]] to work with [[Secure Sockets Layer|SSL]].
==How To==
To get SSL working with virtual hosting (or at all, really), I had to do the following:
* in [[apache2.conf]]:
# added above the "Include /etc/apache2/sites-enabled/" line:
NameVirtualHost *:443
# added below it:
SSLProtocol -all +TLSv1 +SSLv3
SSLCertificateFile /etc/apache2/certs/server.crt
SSLCertificateKeyFile /etc/apache2/certs/server.key
* in [[ports.conf]]:
<IfModule mod_ssl.c>
# SSL name based virtual hosts are not yet supported, therefore no
# NameVirtualHost statement here
Listen 443 https
</IfModule>
* Pick which domain to serve for [[https]] requests, and add to that site's config file:
<VirtualHost *:443>
SSLEngine on
(copy of essential stuff from <VirtualHost:*>)
</VirtualHost>
* (and finally...) Remember to forward port 443 on the router.

The exact filenames will be different depending on your Apache setup; these were in [[Ubuntu]]. "Listen 443" apparently also works (without the "https").
==Notes==
If the "Listen 443 https" statement is missing, the server may ''appear'' to be responding but having some kind of redirect issue. A sample [[openssl]] session:

'''openssl s_client -host <u>domain.name</u> -port 443'''
<pre>
CONNECTED(00000003)
3074250904:error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number:s3_pkt.c:339:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 5 bytes and written 7 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : SSLv3
Cipher : 0000
Session-ID:
Session-ID-ctx:
Master-Key:
Key-Arg : None
PSK identity: None
PSK identity hint: None
Start Time: 1334194927
Timeout : 7200 (sec)
Verify return code: 0 (ok)
---
</pre>
Since someone else fixed the problem, I'm not sure exactly ''what'' was required, but it appears that [[ssh]] may have been set to respond on port 443 as well as the standard port 22, making it appear that Apache was listening on 443 when it wasn't. Apache was also missing the "Listen 443" directive.

One way to test for this problem might have been to attempt to ssh to port 443.