0

This is my first time trying to set-up an ssl for one a site, and I'm running it on a server that has 3 other sites already hosted.

I'm running apache2.?? and the install came with an ssl.conf page.

The ssl.conf has the following settings

LoadModule ssl_module modules/mod_ssl.so
Listen 443
AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl    .crl

<VirtualHost *:443>
    ServerAdmin [email protected]
    DocumentRoot /var/www/html/securesite
    ServerName securesite.com
    ErrorLog logs/securesite-error_log
    CustomLog logs/securesite-access_log common
    SSLEngine on
    SSLCertificateFile /etc/httpd/ssl.crt/securesite.com.crt
    SSLCertificateKeyFile /etc/httpd/ssl.key/server.key
    SSLCertificateChainFile /etc/httpd/ssl.crt/gd_bundle.crt
</VirtualHost>

When I run 'apachectl configtest', I don't get any errors, but running 'apachectl -k restart', I get 'httpd not running, trying to start'.

I have two questions

1) Is there an error in the way I'm defining my virtualhost for 443?? the rest of my entries point to <VirtualHost *:80>. When I comment out the above entry, apache runs fine.

2) do I need to set-up a redirect from port 80 for secure site? Because most users are going to go to http: or www. , and I need to send them to https: does apache do this automatically? or do i need to create an entry with a redirect?

2
  • I've gone through the error logs (I normally can't find anything in there that I can make sense of), and found '(98)Address already in use: make_sock: could not bind to address [::]:443 (98)Address already in use: make_sock: could not bind to address 0.0.0.0:443 no listening sockets available, shutting down Unable to open logs'. I'm guessing that would cause the problem. Now I'm looking at what is using the port, and how to release it. Can/Should I ssl on another port?
    – pedalpete
    Mar 17, 2010 at 16:15
  • Alright, so you need to find out what's binding to that port. First shutdown apache and then do 'lsof -P | grep IPv'. If something else is running on 443 you should see it listed. If nothing is running restart apache and run the command again. Is 443 listed? If yes then you might have another apache configuration file that already has an entry to use 443.
    – anonymouse
    Mar 18, 2010 at 0:43

2 Answers 2

1

Have you checked the http log for error messages?

Try commenting out SSLCertificateChainFile and see if that helps. I run a lot of ssl enabled sites and i've never needed to use that file.

Setup your own self signed certificate for testing if you haven't already done so. http://www.akadia.com/services/ssh_test_certificate.html

If you're running securesite.com on both port 80 and 443 then yes, you will need to do some type of redirect if you want to force clients to https. You can use a .htaccess file to direct certain pages, directories, or the entire site into using https.

1
  • thanks anonymouse, I've added a comment to the original entry with some stuff from the error logs. That is the best tutorial/description of SSL i've seen. Particularly clear, and really great that it talks about removing the passphrase, as I wouldn't have done that otherwise.
    – pedalpete
    Mar 17, 2010 at 16:17
1

If I have a clean server I need to install SSL on these are the steps I normally take.

First I edit SSLCipherSuite and SSLProtocol in /etc/httpd/conf.d/ssl.conf to harden the install a bit.


/etc/httpd/conf.d/ssl.conf


SSLCipherSuite ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM
SSLProtocol -ALL +SSLv3 +TLSv1

Then I create /etc/httpd/conf/ssl.crt, /etc/httpd/conf/ssl.key, /etc/httpd/conf/ssl.csr folders. You could just as well put these in the existing /etc/pki/tls folder but I like keeping my website stuff seperate from any other CA stuff that may be going on on the server. I put the key and the certificate and optionally the csr into the folders I created. If there are any intermediate certificates I chain them togeter into one file and put it in the /etc/httpd/conf/ssl.crt folder as intermediate.pem.

I normally keep the configuration for each virtual host in its own file under /etc/httpd/conf.d/vhosts/. (make sure your main apache configuration is set to read in any *.conf files from this folder). So I may have a file called /etc/httpd/conf.d/vhosts/www.mysite.com.conf. This file will contain two directives one for port 80 and one for port 443. If I want everyone to use SSL you could do a mod-rewrite like in this example.



/etc/httpd/conf.d/vhosts/www.mysite.com.conf


[VirtualHost 192.168.0.1:80]
    ServerName www.mysite.com
    ServerAlias mysite.com
    RewriteEngine On
    RewriteCond %{HTTPS} off
    RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
[/VirtualHost]

[VirtualHost 192.168.0.1:443]
    ServerName www.mysite.com
    ServerAlias mysite.com
    DocumentRoot /var/www/vhosts/www.mysite.com/httpdocs
    SSLEngine on
    SSLVerifyClient none
    SSLCertificateFile /etc/httpd/conf/ssl.crt/www.mysite.com.crt
    SSLCertificateKeyFile /etc/httpd/conf/ssl.key/server.key
    SSLCACertificateFile /etc/httpd/conf/ssl.crt/intermediate.pem
    ErrorLog /var/log/vhosts/www.mysite.com-error_log
    CustomLog /var/log/vhosts/www.mysite.com-access_log common
[/VirtualHost]

Replace the []'s with <>'s even in pre tags it was trying to read them as html and not showing properly.

So directly to your questions:

1) I have never seen or used SSLCertificateChainFile Im assuming its the intermediate certificate bundle which I would use SSLCACertificateFIle for.

2) If you want to force everyone to HTTPS you will need to do a redirect or a mod-rewrite. Apache will gladly host both HTTP and HTTPS content at the same time and for most people this is what they want. It can be a major PITA to get all the external resources you pull into your site to be HTTPS which will throw warning messages to your users if you use HTTPS on say your home page. If this is not a problem for you though then by all means use HTTPS everywhere.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .