How to configure SSL in apache?

Question

I have installed apache in RHEL 6. Everything is working fine. What all changes and configurations should be done to use https://localhost:443/.

If I change the "Listen 80" to 443 it is throwing an SSL connection error

"Error 107 (net::ERR_SSL_PROTOCOL_ERROR): SSL protocol error."

Answer 1

If you are using apache2, then you have to do the following:

Step 1: Use OpenSSL to produce the keys that are used to secure your site. These keys are used when encrypting and decrypting the traffic to your secure site.

$ openssl genrsa -out mydomain.key 1024

This command will create a 1024 bit private key and puts it in the file mydomain.key.

Step 2: Generate your own certificate.

$ openssl req -new -key mydomain.key -x509 -out mydomain.crt

Step 3: Keep the private key in the directory /etc/apache2/ssl.key/ and certificate in the directory /etc/apache2/ssl.crt/.

Note: The ssl.key directory must be only readable by root.

Step 4: Now you need to edit httpd.conf file in /etc/apache2.

Now this file should include content like this:

NameVirtualHost *:80
NameVirtualHost *:443
Listen 443

<VirtualHost *:80>
ServerAdmin webmaster@mydomain.com
DocumentRoot /srv/www/htdocs/mydomain
ServerName www.mydomain.com
ServerAlias mydomain.com
</VirtualHost>


<VirtualHost *:443>
ServerAdmin webmaster@mydomain.com
DocumentRoot /srv/www/htdocs/mydomain-secure
ServerName mail.mydomain.com
SSLEngine on
SSLCertificateFile /etc/apache2/ssl.crt/mydomain.crt
SSLCertificateKeyFile /etc/apache2/ssl.key/mydomain.key
</VirtualHost>


<Directory /srv/www/htdocs/mydomain-secure>
SSLRequireSSL
</Directory>


<VirtualHost *:80>
ServerAdmin webmaster@mydomain.com
DocumentRoot /srv/www/htdocs/mydomain
ServerName mail.mydomain.com
RedirectMatch permanent (/.*) https://mail.mydomain.com$1
</VirtualHost>

Answer 2

Don't change Listen 80 to 443 in /etc/httpd/conf/httpd.conf. SSL is configured in /etc/httpd/conf.d/ssl.conf. On RHEL 6,SSL is enabled and listening by default with a self signed certificate.

You can get to the default site using SSL just by browsing to https://localhost (you don't need to add the port to the end of the URL).

If you want to forward all HTTP requests to HTTPS (which is what I believe you are trying to achieve), you can either add a permanent redirect, or use the Apache module mod_rewrite.

The easiest and most secure way is to set up a permanent redirect. Enable named virtual hosts and add a Redirect directive to the VirtualHost in /etc/httpd/conf/httpd.conf.

NameVirtualHost *:80
<VirtualHost *:80>
   ServerName localhost
   Redirect permanent / https://localhost
</VirtualHost>

Using mod_rewrite, you also create a named virtual host. This is not the recommended method, but will work.

NameVirtualHost *:80
<VirtualHost *:80>
   # Enable the Rewrite engine
   RewriteEngine On
   # Make sure the connection is not already HTTPS
   RewriteCond %{HTTPS} !=on
   # This rewrites the URL and forwards to https
   RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]
</VirtualHost>

If you want to turn SSL off, comment out these lines in /etc/httpd/conf.d/ssl.conf and restart Apache.

LoadModule ssl_module modules/mod_ssl.so
Listen 443