Here you can find step by step SSL installation with Apache2
If you have Apache 2.x installed already then you're good to go as you don't need anything extra installed.
If you haven't got it installed then you can do so easily:
“earth:~# apt-get install apache2
Reading Package Lists... Done
Building Dependency Tree... Done
The following extra packages will be installed:
apache2-common apache2-mpm-worker apache2-utils rapidsslonline ssl-cert
Suggested packages:
apache2-doc ca-certificates
The following NEW packages will be installed:
apache2 apache2-common apache2-mpm-worker apache2-utils rapidsslonline ssl-cert
0 upgraded, 6 newly installed, 0 to remove and 0 not upgraded.
Need to get 2040kB of archives.
After unpacking 6218kB of additional disk space will be used.
Do you want to continue? [Y/n]”
Once the server is installed you need to do three things to get a working SSL setup:
1 Generate, or import, a certificate.
2 Enable Apaches SSL support.
3 Configure your SSL options.
Generating A Certificate
Generating a certificate from scratch will give you something which will be used to protect the traffic exchanged between clients and your server, however it will be signed by a untrusted certificate authority so it will generate warnings.
Importing a paid and "trusted" certificate will avoid this problem, but that is beyond the scope of this simple introduction.
Generating Cheapest SSL certificate for Apache2 may be accomplished using the apache2-ssl-certificate script. This will ask you questions interactively then generate the certificate file appropriately.
Illustration of session:
“earth:~# apache2-ssl-certificate
creating selfsigned certificate
replace it with one signed by a certification authority (CA)
enter your ServerName at the Common Name prompt
If you want your certificate to expire after x days call this programm
with -days x
Generating a 1024 bit RSA private key
............++++++
..........................++++++
writing new private key to '/etc/apache2/ssl/apache.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:
State or Province Name (full name) [Some-State]: Scotland
Locality Name (eg, city) []: Edinburgh
Organization Name (eg, company; recommended) []: eThan Hunt
Organizational Unit Name (eg, section) []:
server name (eg. ssl.domain.tld; required!!!) []: eThan
Email Address []: ethan@domain.com”
Enabling SSL Support
To use Cheap SSL facilities of Apache2 you must enable the module mod_ssl, this can be achieved using the helper tool a2enmod
As root run:
“earth:~# a2enmod ssl
Module ssl installed; run /etc/init.d/apache2 force-reload to enable.”
Once this is done you'll have Apache setup to accept SSL connections, but the server will still only be listening for incoming HTTP requests on port 80 - and not SSL connections on port 443. To fix this you must add a line to the file /etc/apache2/ports.conf:
“Listen 443”
With these two steps out of the way you now have an Apache setup which will listen for and accept SSL connections. The next step is to modify your virtual hosts to use it.
Configuring your SSL Hosts
With a certificate setup, and the server updated to load and listen for incoming SSL connections you're almost finished. The final step is to ensure that your virtual hosts, or main host, will accept SSL options.
I use virtual hosts upon my machine and this just means adding a couple of options to each one I wish to use SSL:
“SSLEngine on
SSLCertificateFile /etc/apache2/ssl/apache.pem”
For reference here is a complete example which should be easy to modify/understand:
“NameVirtualHost *:443
NameVirtualHost *:80
ServerName eThan.my.flat
DocumentRoot /var/www/
ErrorLog /var/log/apache2/error.log
CustomLog /var/log/apache2/access.log combined
ServerName eThan.my.flat
DocumentRoot /var/www/
ErrorLog /var/log/apache2/error.log
CustomLog /var/log/apache2/access.log combined
SSLEngine on
SSLCertificateFile /etc/apache2/ssl/apache.pem
Resource URL:
http://www.debian-administration.org/article/349/Setting_up_an_SSL_server_with_Apache2
If you have Apache 2.x installed already then you're good to go as you don't need anything extra installed.
If you haven't got it installed then you can do so easily:
“earth:~# apt-get install apache2
Reading Package Lists... Done
Building Dependency Tree... Done
The following extra packages will be installed:
apache2-common apache2-mpm-worker apache2-utils rapidsslonline ssl-cert
Suggested packages:
apache2-doc ca-certificates
The following NEW packages will be installed:
apache2 apache2-common apache2-mpm-worker apache2-utils rapidsslonline ssl-cert
0 upgraded, 6 newly installed, 0 to remove and 0 not upgraded.
Need to get 2040kB of archives.
After unpacking 6218kB of additional disk space will be used.
Do you want to continue? [Y/n]”
Once the server is installed you need to do three things to get a working SSL setup:
1 Generate, or import, a certificate.
2 Enable Apaches SSL support.
3 Configure your SSL options.
Generating A Certificate
Generating a certificate from scratch will give you something which will be used to protect the traffic exchanged between clients and your server, however it will be signed by a untrusted certificate authority so it will generate warnings.
Importing a paid and "trusted" certificate will avoid this problem, but that is beyond the scope of this simple introduction.
Generating Cheapest SSL certificate for Apache2 may be accomplished using the apache2-ssl-certificate script. This will ask you questions interactively then generate the certificate file appropriately.
Illustration of session:
“earth:~# apache2-ssl-certificate
creating selfsigned certificate
replace it with one signed by a certification authority (CA)
enter your ServerName at the Common Name prompt
If you want your certificate to expire after x days call this programm
with -days x
Generating a 1024 bit RSA private key
............++++++
..........................++++++
writing new private key to '/etc/apache2/ssl/apache.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:
State or Province Name (full name) [Some-State]: Scotland
Locality Name (eg, city) []: Edinburgh
Organization Name (eg, company; recommended) []: eThan Hunt
Organizational Unit Name (eg, section) []:
server name (eg. ssl.domain.tld; required!!!) []: eThan
Email Address []: ethan@domain.com”
Enabling SSL Support
To use Cheap SSL facilities of Apache2 you must enable the module mod_ssl, this can be achieved using the helper tool a2enmod
As root run:
“earth:~# a2enmod ssl
Module ssl installed; run /etc/init.d/apache2 force-reload to enable.”
Once this is done you'll have Apache setup to accept SSL connections, but the server will still only be listening for incoming HTTP requests on port 80 - and not SSL connections on port 443. To fix this you must add a line to the file /etc/apache2/ports.conf:
“Listen 443”
With these two steps out of the way you now have an Apache setup which will listen for and accept SSL connections. The next step is to modify your virtual hosts to use it.
Configuring your SSL Hosts
With a certificate setup, and the server updated to load and listen for incoming SSL connections you're almost finished. The final step is to ensure that your virtual hosts, or main host, will accept SSL options.
I use virtual hosts upon my machine and this just means adding a couple of options to each one I wish to use SSL:
“SSLEngine on
SSLCertificateFile /etc/apache2/ssl/apache.pem”
For reference here is a complete example which should be easy to modify/understand:
“NameVirtualHost *:443
NameVirtualHost *:80
ServerName eThan.my.flat
DocumentRoot /var/www/
ErrorLog /var/log/apache2/error.log
CustomLog /var/log/apache2/access.log combined
ServerName eThan.my.flat
DocumentRoot /var/www/
ErrorLog /var/log/apache2/error.log
CustomLog /var/log/apache2/access.log combined
SSLEngine on
SSLCertificateFile /etc/apache2/ssl/apache.pem
Resource URL:
http://www.debian-administration.org/article/349/Setting_up_an_SSL_server_with_Apache2