I'm not sure whether it's me or there's omething wrrong with the
Apache documentation but I think it is misleading quit often.
Your SSL configuration will need to contain, at minimum, the following directives.
LoadModule ssl_module modules/mod_ssl.so Listen 443 <VirtualHost *:443> ServerName www.example.com SSLEngine on SSLCertificateFile "/path/to/www.example.com.cert" SSLCertificateKeyFile "/path/to/www.example.com.key" </VirtualHost>
So from the above, I assume that the
SSLEngine directive is a must.
SSLEngine Directive Description: SSL Engine Operation Switch Syntax: SSLEngine on|off|optional Default: SSLEngine off Context: server config, virtual host Status: Extension Module: mod_ssl This directive toggles the usage of the SSL/TLS Protocol Engine. This is should be used inside a <VirtualHost> section to enable SSL/TLS for a that virtual host. By default the SSL/TLS Protocol Engine is disabled for both the main server and all configured virtual hosts. Example <VirtualHost _default_:443> SSLEngine on #... </VirtualHost> In Apache 2.1 and later, SSLEngine can be set to optional. This enables support for RFC 2817, Upgrading to TLS Within HTTP/1.1. At this time no web browsers support RFC 2817.
Especially the part where it says - by default the SSL/TLS Protocol Engine is disabled for both the main server and all configured virtual hosts.
First, I don't understand what do they actual mean when saying SSL/TLS Protocol engine. As I understand to enable SSL/TLS support we need to install the
mod_ssl module as it is not installed by default - is this the engine hey talk about ?
mod_ssl is installed
httpd starts to listen not only on
80 but on
443 as well.
Third, when I look at the
ssl.conf configuration file, there's the following line
SSLEngine on. The Apache documentation says that the main server config and whatever comes after before e.g. Virtual Hosts directives is parsed into one - so why do I need the
SSLEngine directive in each VirtualHost?
Fourth, I have created two Virtual Host e.g. and definde the
ServerNamedirective for each host and the SSLCertificate directives, so that each will respond with the right certificate depending on the
SNI value send by the browser AND I did NOT include the SSLEngine directive inside the two Virtual Hosts and the web content is served via
https and Apache returns the correct SSL certificates.
Why does the documentation says it is required but it works without?
Looking forward to your comments!
PS. Remember I'm only human. I spent a fair amount on reading the documentation and on reproductions - if I missed something, please apologize, it was not due to laziness, sometimes we may overlook simple thinks that are right in front of our nose.