I have installed apache in RHEL 6. Everything is working fine. What all changes and configurations should be done to use https://localhost:443/.

If I change the "Listen 80" to 443 it is throwing an SSL connection error

"Error 107 (net::ERR_SSL_PROTOCOL_ERROR): SSL protocol error."

If you are using apache2, then you have to do the following:

Step 1: Use OpenSSL to produce the keys that are used to secure your site. These keys are used when encrypting and decrypting the traffic to your secure site.

$ openssl genrsa -out mydomain.key 1024

This command will create a 1024 bit private key and puts it in the file mydomain.key.

Step 2: Generate your own certificate.

$ openssl req -new -key mydomain.key -x509 -out mydomain.crt

Step 3: Keep the private key in the directory /etc/apache2/ssl.key/ and certificate in the directory /etc/apache2/ssl.crt/.

Note: The ssl.key directory must be only readable by root.

Step 4: Now you need to edit httpd.conf file in /etc/apache2.

Now this file should include content like this:

NameVirtualHost *:80
NameVirtualHost *:443
Listen 443

<VirtualHost *:80>
ServerAdmin webmaster@mydomain.com
DocumentRoot /srv/www/htdocs/mydomain
ServerName www.mydomain.com
ServerAlias mydomain.com
</VirtualHost>


<VirtualHost *:443>
ServerAdmin webmaster@mydomain.com
DocumentRoot /srv/www/htdocs/mydomain-secure
ServerName mail.mydomain.com
SSLEngine on
SSLCertificateFile /etc/apache2/ssl.crt/mydomain.crt
SSLCertificateKeyFile /etc/apache2/ssl.key/mydomain.key
</VirtualHost>


<Directory /srv/www/htdocs/mydomain-secure>
SSLRequireSSL
</Directory>


<VirtualHost *:80>
ServerAdmin webmaster@mydomain.com
DocumentRoot /srv/www/htdocs/mydomain
ServerName mail.mydomain.com
RedirectMatch permanent (/.*) https://mail.mydomain.com$1
</VirtualHost>
  • The first three lines are not necessary. 1. NameVirtualHost is deprecated and will be removed in future versions of Apache. Its currently already a no-op. 2. Listen 443 can cause problems if apache is already configured to listen on port 443 which on many linux distributions is already the case. Only add if you are sure that this line is not configured else where. – lanoxx Aug 31 '17 at 8:46

Don't change Listen 80 to 443 in /etc/httpd/conf/httpd.conf. SSL is configured in /etc/httpd/conf.d/ssl.conf. On RHEL 6,SSL is enabled and listening by default with a self signed certificate.

You can get to the default site using SSL just by browsing to https://localhost (you don't need to add the port to the end of the URL).

If you want to forward all HTTP requests to HTTPS (which is what I believe you are trying to achieve), you can either add a permanent redirect, or use the Apache module mod_rewrite.

The easiest and most secure way is to set up a permanent redirect. Enable named virtual hosts and add a Redirect directive to the VirtualHost in /etc/httpd/conf/httpd.conf.

NameVirtualHost *:80
<VirtualHost *:80>
   ServerName localhost
   Redirect permanent / https://localhost
</VirtualHost>

Using mod_rewrite, you also create a named virtual host. This is not the recommended method, but will work.

NameVirtualHost *:80
<VirtualHost *:80>
   # Enable the Rewrite engine
   RewriteEngine On
   # Make sure the connection is not already HTTPS
   RewriteCond %{HTTPS} !=on
   # This rewrites the URL and forwards to https
   RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]
</VirtualHost>

If you want to turn SSL off, comment out these lines in /etc/httpd/conf.d/ssl.conf and restart Apache.

LoadModule ssl_module modules/mod_ssl.so
Listen 443
  • Actually, if you add the mod_ssl package for RHEL6, it creates an /etc/httpd/conf.d/ssl.conf, which loads the module and sets up <VirtualHost _default_:443>, with all the necessary parameters, each with comments. The mod_ssl package isn't automatically installed if you installed the httpd package. – jsbillings Aug 6 '12 at 17:15
  • 1
    I would like to add just one thing to your rewrite: use [R=301,L] instead of just [R,L], this way the rewrite is using the permanent option of the HTTP 3xx status codes. – dcestari May 14 '15 at 0:06

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.