Setting Up Win32 Apache 2.2.x SSL/HTTPS

Apr 25, 2009

This walk through will help you setup Win32 Apache 2.2.x with an SSL test environment using a self signed certificate that I will also show you how to create. I will use my full paths to help with the comprehension.

Apache:
Make sure you have the [modules/mod_ssl.so]. If not, please install the latest [Win32 Binary including OpenSSL 0.9.8i (MSI Installer)].

Open SSL:
Make sure you have OpenSSL installed and that you've added the [<openSSL install path>\bin] to your computers PATH list. You can download Open SSL from: http://gnuwin32.sourceforge.net/packages/openssl.htm

Setup: I use a detailed folder structure to make things easier for multiple certificates.
c:\servers\ssl\
certs
keys
requests

OpenSSL Config File:
This will require an openssl.conf file. I did not have one after my install so I googled for one, and with a couple small adjustments I came out with this version you can download. I don't think any changes will be required.

Open a command promt and go to [c:\servers\ssl\]

Generate Key
openssl genrsa -des3 -out keys/egps.localhost.key 1024

 

Generate Request
openssl req -config openssl.conf -new -key keys/egps.localhost.key -out requests/egps.localhost.csr
Generate self signed certificate
openssl x509 -req -days 1001 -in requests/egps.localhost.csr -signkey keys/egps.localhost.key -out certs/egps.localhost.crt
Generate RSA Key: This is required do to Win32 limitations
openssl rsa -in keys/egps.localhost.key -out keys/egps.localhost.rsa.key
Enter Passphrase entered in key generation step

Setting Up Apache (HTTP.conf): There are multiple ways to do this, and this is just the simplelist way. After you get it working, feel free to rummage through the httpd-ssl.conf file for more options

Make sure you are loading mod_ssl.so and mod_setenvif.so
LoadModule ssl_module modules/mod_ssl.so
LoadModule setenvif_module modules/mod_setenvif.so

Add this near the end of your file, but before you virtual host setup
# SSL CONFIGURATION
AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl .crl
SSLPassPhraseDialog builtin
SSLSessionCache "shmcb:C:/Servers/Apache.2.2/logs/ssl_scache(512000)"
# OR
# SSLSessionCache  none
SSLSessionCacheTimeout 300
SSLMutex default

Now lets add our new Virtual Server to accept requests
<VirtualHost *:443>
     ServerName egps.localhost:443
     DocumentRoot "C:/WebApplications/EGPS"
     JRunConfig Bootstrap 127.0.0.1:51022
     <Directory />
          Options Indexes
     </Directory>

     SSLEngine on

     SSLCertificateFile "C:/Servers/ssl/certs/egps.localhost.crt"
     SSLCertificateKeyFile "C:/Servers/ssl/keys/egps.localhost.rsa.key"
     SSLCertificateChainFile "C:/Servers/ssl/certs/egps.localhost.crt"

     BrowserMatch ".*MSIE.*" \
     nokeepalive ssl-unclean-shutdown
     downgrade-1.0 force-response-1.0
</VirtualHost>


Test It

Now you can start/restart Apache and you should be able to go to [https://egps.localhost]. You'll get a certificate error at first and you will have to "trust it", but this will at least allow you to have a quick and easy and free ssl environment on your dev box.

Multiple Virtual Sites using SSL
You can't have multiple virtual sites setup to use SSL, by default it will always use the first one. To skirt this issue, I setup Apache to listen to additional ports 7000 and 70001. I then changed my VirtualHost from [*:443] to [*:7000] & [*:7001]. It sucks, but I can then access seperatly. In my case [https://egps.localhost:7000] and [https://egps.localhostcf7:7001]

Comments

odel

odel wrote on 01/11/10 8:36 AM

nice tutorial sir, just what i need. can i have a copy of the OpenSSL Config File that you used in this sample? the download link here does not work. thanks in advance.

rodel

Write your comment



(it will not be displayed)



Subscribe to this comment thread