aapche ssl certificate not working

baronobeefdip · 01-23-2012, 01:27 PM

i have just installed apache2 in Debian Squeeze, i am working on making ssl certification work in apache. so far i have gotten some commands going in httpd.conf file which is empty by default i am guessing that the contents of the httpd.conf take prescedence over the apache.conf file. i am wrong correct me

after reading all of the literature and resources i have gotten pretty far with this the command prompt never tells me that theres an error anymore i get the okay when the server starts, i created all of the files from openssl like this

Code:

mkdir /etc/apache2/ssl
cd /etc/apache2/ssl
opensopenssl req -new -key key.key -out csr.csr
openssl genrsa -des3 -out key.key 1024
openssl x509 -req -days 365 -in csr.csr -signkey key.key -out crt.crt

and here is the contents of the /etc/apache2/httpd.conf file

Code:

<IfModule mod_ssl>
Listen 443
SSLEngine on
SSLCertificateKeyFile /etc/apache2/ssl/key.key
SSLCertificateFile /etc/apache2/ssl/crt.crt
</IfModule>

when i restart the server everything starts up fine, but when i open up a browser and type in localhost, the it works screen comes up but i don't get a prompt for an ssl certificate it just loads as if the ssl configurations weren't put in there in the first place

Toggan · 01-23-2012, 01:40 PM

Is there anything that comes up in your Apache error logs? Either from when you restart the Apache service or when you try to browse localhost?

baronobeefdip · 01-23-2012, 01:49 PM

no everything starts up and loads up fine like i didn't put the ssl module tag in the httpd.conf file, is there something wrong with the way i entered it in the file inside the 2nd code box. because i think it has something to do with my coding and not the server itself

or am i putting it in the wrong file, is it suppossed to go inside of /etc/apache2/apache.conf instead of /etc/apache2/httpd.conf

bathory · 01-23-2012, 05:22 PM

Hi,

Better take a look at the official debian apache-ssl howto

Regards

baronobeefdip · 01-23-2012, 10:08 PM

I can see that the fellow developers at Debian have found a way to simplify the certification creation and the installation of the modules processes for us but as for getting the server to communicate with ssl requests is a something that has to be done by hand but all i want to know is since it is saying to put all of these commands at the end inside of a virtualhost declaration then where do i put it in if i want it to effect the main host instead of a virtual one would it be like this

/etc/apache2/httpd.conf

Code:

NameVirtualHost *:443
<VirtualHost *:443>
ServerName <hostname>
DocumentRoot /var/www
ErrorLog /var/log/apache2/error.log
CustomLog /var/log/apache2/access.log combined

SSLEngine on
SSLCertificateFile /etc/apache2/ssl/apache.pem
</VirtualHost>

bathory · 01-24-2012, 12:49 AM

Quote:

all i want to know is since it is saying to put all of these commands at the end inside of a virtualhost declaration then where do i put it in if i want it to effect the main host instead of a virtual one would it be like this

The main host (aka default vhost) in debian is defined in /etc/apache2/sites-available/default. So should put your ssl stuff in there.
BTW debian uses /etc/apache2/apache2.conf as the main config file. /etc/apache2/httpd.conf is kept for compatibility and its included in apache2.conf, so you can add your stuff there, if you want.

Regards

baronobeefdip · 01-24-2012, 08:18 AM

Quote:

Originally Posted by bathory

The main host (aka default vhost) in debian is defined in /etc/apache2/sites-available/default. So should put your ssl stuff in there.
BTW debian uses /etc/apache2/apache2.conf as the main config file. /etc/apache2/httpd.conf is kept for compatibility and its included in apache2.conf, so you can add your stuff there, if you want.

Regards

so i guess the VirtualHost declaration to have it listen for port 443 (ssl connections) should go in to /etc/apache2/sites-available/default file or can it go in httpd.conf too, unless you tell me otherwise i'll assume that it should go in /etc/apache2/sites-available/default

and do i need to provide some redirection options to make it go from http to https when i try to access the web site or will it do it automatically if i try to access it with what we covered so far?

bathory · 01-24-2012, 08:57 AM

Quote:

so i guess the VirtualHost declaration to have it listen for port 443 (ssl connections) should go in to /etc/apache2/sites-available/default file or can it go in httpd.conf too, unless you tell me otherwise i'll assume that it should go in /etc/apache2/sites-available/default

If you want to be consistent with the debian apache layout, you should define your default vhost in /etc/apache2/sites-available/default

Quote:

and do i need to provide some redirection options to make it go from http to https when i try to access the web site or will it do it automatically if i try to access it with what we covered so far?

You can use mod_rewrite inside the vhost container to rewrite http to https, if that's what you want.

Regards

baronobeefdip · 01-24-2012, 09:39 AM

i just went through the steps and i can't run the command

Code:

apache2-ssl-certificate

so i don't have a certificate that has been generated all i am getting is a bash: command not found prompt what could i be doing wrong now

i am also not getting the certificate prompt yet again, so is there an issue with the firewall also is there a way to automatically generate a rewrite tag that will re-direct the default web website to the default-ssl website

bathory · 01-24-2012, 10:48 AM

Quote:

so i don't have a certificate that has been generated all i am getting is a bash: command not found prompt what could i be doing wrong now

From this bug report, looks like in newer versions in was replaced by make-ssl-cert (from the ssl-cert package)

Quote:

i am also not getting the certificate prompt yet again, so is there an issue with the firewall

You must enable SSL and use a URL like: https://www.domain.com to see if https works

Quote:

is there a way to automatically generate a rewrite tag that will re-direct the default web website to the default-ssl website

There are may ways to do this with mod_rewrite. One is:

Code:

RewriteEngine on
RewriteCond %{HTTPS} off
RewriteRule  ^(.*)$  https://%{HTTP_HOST}%{REQUEST_URI}

baronobeefdip · 01-26-2012, 10:03 AM

Quote:

Originally Posted by bathory

From this bug report, looks like in newer versions in was replaced by make-ssl-cert (from the ssl-cert package)

There are may ways to do this with mod_rewrite. One is:

Code:

RewriteEngine on
RewriteCond %{HTTPS} off
RewriteRule  ^(.*)$  https://%{HTTP_HOST}%{REQUEST_URI}

right i got that part of the rewrite module but where does it go, in the /etc/apache2/sites-available/default file or somewhere else

bathory · 01-26-2012, 11:05 AM

Quote:

right i got that part of the rewrite module but where does it go, in the /etc/apache2/sites-available/default file or somewhere else

Yes, it goes into that file, assuming that you don't have other vhosts.
Mind that you need to put the rewrite stuff into the vhost that runs on port 80 (not the secure on port 443, obviously)

Regards

baronobeefdip · 01-26-2012, 11:13 AM

and i also see that you specified stuff like "HTTP_HOST" and "REQUEST_URI" are these suppossed to be filled in with something different or leave them as is

and did you make a typo in "REQUEST_URI" i think that I is suppossed to be an L

bathory · 01-26-2012, 11:22 AM

Quote:

Originally Posted by baronobeefdip

and i also see that you specified stuff like "HTTP_HOST" and "REQUEST_URI" are these suppossed to be filled in with something different or leave them as is

and did you make a typo in "REQUEST_URI" i think that I is suppossed to be an L

No, these are http variables, that are used by apache to specify the vhost and the resource requested. (it's URI not URL)
I suggest you to have a look at mod_rewrite documentation.

Regards

baronobeefdip · 02-10-2012, 03:16 PM

so on my localhost config document i would have to put those entries in it (since the /etc/apache2/sites-available/default is the config file for the local host) you want me to put those rewrite entries somewhere in it. and this can be used to redirect the default 80 port service to port 443 and make it go to the https location. the example you have given was a little vague so i want to know how to do it in my case as an example (and i can go on referencing from the example hopefully by then i would have mastered this module) here are my specs

ip address - 192.168.1.101
netmask - 255.255.255.0
gateway - 192.168.1.1
operating system - Debian Squeeze

config file locations
/etc/apache2/httpd.conf
/etc/apache2/sites-available/default
/etc/apache2/sites-available/default-ssl