Setting Up Win32 Apache 2.2.x SSL/HTTPS
This walk through will help you setup Win32 Apache 2.2.x with an SSL test environment using a self signed certificate that I will also show you how to create. I will use my full paths to help with the comprehension.
Apache:
Make sure you have the [modules/mod_ssl.so]. If not, please install the latest [Win32 Binary including OpenSSL 0.9.8i (MSI Installer)].
Open SSL:
Make sure you have OpenSSL installed and that you've added the [<openSSL install path>\bin] to your computers PATH list. You can download Open SSL from: http://gnuwin32.sourceforge.net/packages/openssl.htm
Setup: I use a detailed folder structure to make things easier for multiple certificates.c:\servers\ssl\
certs
keys
requests
OpenSSL Config File:
This will require an openssl.conf file. I did not have one after my install so I googled for one, and with a couple small adjustments I came out with this version you can download. I don't think any changes will be required.
Open a command promt and go to [c:\servers\ssl\]
Generate Keyopenssl genrsa -des3 -out keys/egps.localhost.key 1024
Generate Requestopenssl req -config openssl.conf -new -key keys/egps.localhost.key -out requests/egps.localhost.csr
Generate self signed certificateopenssl x509 -req -days 1001 -in requests/egps.localhost.csr -signkey keys/egps.localhost.key -out certs/egps.localhost.crt
Generate RSA Key: This is required do to Win32 limitationsopenssl rsa -in keys/egps.localhost.key -out keys/egps.localhost.rsa.key
Enter Passphrase entered in key generation step
Setting Up Apache (HTTP.conf): There are multiple ways to do this, and this is just the simplelist way. After you get it working, feel free to rummage through the httpd-ssl.conf file for more options
Make sure you are loading mod_ssl.so and mod_setenvif.soLoadModule ssl_module modules/mod_ssl.so
LoadModule setenvif_module modules/mod_setenvif.so
Add this near the end of your file, but before you virtual host setup# SSL CONFIGURATION
AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl .crl
SSLPassPhraseDialog builtin
SSLSessionCache "shmcb:C:/Servers/Apache.2.2/logs/ssl_scache(512000)"
# OR
# SSLSessionCache none
SSLSessionCacheTimeout 300
SSLMutex default
Now lets add our new Virtual Server to accept requests<VirtualHost *:443>
ServerName egps.localhost:443
DocumentRoot "C:/WebApplications/EGPS"
JRunConfig Bootstrap 127.0.0.1:51022
<Directory />
Options Indexes
</Directory>
SSLEngine on
SSLCertificateFile "C:/Servers/ssl/certs/egps.localhost.crt"
SSLCertificateKeyFile "C:/Servers/ssl/keys/egps.localhost.rsa.key"
SSLCertificateChainFile "C:/Servers/ssl/certs/egps.localhost.crt"
BrowserMatch ".*MSIE.*" \
nokeepalive ssl-unclean-shutdown
downgrade-1.0 force-response-1.0
</VirtualHost>
Test It
Now you can start/restart Apache and you should be able to go to [https://egps.localhost]. You'll get a certificate error at first and you will have to "trust it", but this will at least allow you to have a quick and easy and free ssl environment on your dev box.
Multiple Virtual Sites using SSL
You can't have multiple virtual sites setup to use SSL, by default it will always use the first one. To skirt this issue, I setup Apache to listen to additional ports 7000 and 70001. I then changed my VirtualHost from [*:443] to [*:7000] & [*:7001]. It sucks, but I can then access seperatly. In my case [https://egps.localhost:7000] and [https://egps.localhostcf7:7001]
odel wrote on 01/11/10 8:36 AM
rodel