Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This is my first time trying to set-up an ssl for one a site, and I'm running it on a server that has 3 other sites already hosted.

I'm running apache2.?? and the install came with an ssl.conf page.

The ssl.conf has the following settings

LoadModule ssl_module modules/mod_ssl.so
Listen 443
AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl    .crl

<VirtualHost *:443>
    ServerAdmin me@securesite.com
    DocumentRoot /var/www/html/securesite
    ServerName securesite.com
    ErrorLog logs/securesite-error_log
    CustomLog logs/securesite-access_log common
    SSLEngine on
    SSLCertificateFile /etc/httpd/ssl.crt/securesite.com.crt
    SSLCertificateKeyFile /etc/httpd/ssl.key/server.key
    SSLCertificateChainFile /etc/httpd/ssl.crt/gd_bundle.crt
</VirtualHost>

When I run 'apachectl configtest', I don't get any errors, but running 'apachectl -k restart', I get 'httpd not running, trying to start'.

I have two questions

1) Is there an error in the way I'm defining my virtualhost for 443?? the rest of my entries point to <VirtualHost *:80>. When I comment out the above entry, apache runs fine.

2) do I need to set-up a redirect from port 80 for secure site? Because most users are going to go to http: or www. , and I need to send them to https: does apache do this automatically? or do i need to create an entry with a redirect?

share|improve this question
    
I've gone through the error logs (I normally can't find anything in there that I can make sense of), and found '(98)Address already in use: make_sock: could not bind to address [::]:443 (98)Address already in use: make_sock: could not bind to address 0.0.0.0:443 no listening sockets available, shutting down Unable to open logs'. I'm guessing that would cause the problem. Now I'm looking at what is using the port, and how to release it. Can/Should I ssl on another port? –  pedalpete Mar 17 '10 at 16:15
    
Alright, so you need to find out what's binding to that port. First shutdown apache and then do 'lsof -P | grep IPv'. If something else is running on 443 you should see it listed. If nothing is running restart apache and run the command again. Is 443 listed? If yes then you might have another apache configuration file that already has an entry to use 443. –  anonymouse Mar 18 '10 at 0:43

2 Answers 2

Have you checked the http log for error messages?

Try commenting out SSLCertificateChainFile and see if that helps. I run a lot of ssl enabled sites and i've never needed to use that file.

Setup your own self signed certificate for testing if you haven't already done so. http://www.akadia.com/services/ssh_test_certificate.html

If you're running securesite.com on both port 80 and 443 then yes, you will need to do some type of redirect if you want to force clients to https. You can use a .htaccess file to direct certain pages, directories, or the entire site into using https.

share|improve this answer
    
thanks anonymouse, I've added a comment to the original entry with some stuff from the error logs. That is the best tutorial/description of SSL i've seen. Particularly clear, and really great that it talks about removing the passphrase, as I wouldn't have done that otherwise. –  pedalpete Mar 17 '10 at 16:17

If I have a clean server I need to install SSL on these are the steps I normally take.

First I edit SSLCipherSuite and SSLProtocol in /etc/httpd/conf.d/ssl.conf to harden the install a bit.


/etc/httpd/conf.d/ssl.conf


SSLCipherSuite ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM
SSLProtocol -ALL +SSLv3 +TLSv1

Then I create /etc/httpd/conf/ssl.crt, /etc/httpd/conf/ssl.key, /etc/httpd/conf/ssl.csr folders. You could just as well put these in the existing /etc/pki/tls folder but I like keeping my website stuff seperate from any other CA stuff that may be going on on the server. I put the key and the certificate and optionally the csr into the folders I created. If there are any intermediate certificates I chain them togeter into one file and put it in the /etc/httpd/conf/ssl.crt folder as intermediate.pem.

I normally keep the configuration for each virtual host in its own file under /etc/httpd/conf.d/vhosts/. (make sure your main apache configuration is set to read in any *.conf files from this folder). So I may have a file called /etc/httpd/conf.d/vhosts/www.mysite.com.conf. This file will contain two directives one for port 80 and one for port 443. If I want everyone to use SSL you could do a mod-rewrite like in this example.



/etc/httpd/conf.d/vhosts/www.mysite.com.conf


[VirtualHost 192.168.0.1:80]
    ServerName www.mysite.com
    ServerAlias mysite.com
    RewriteEngine On
    RewriteCond %{HTTPS} off
    RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
[/VirtualHost]

[VirtualHost 192.168.0.1:443]
    ServerName www.mysite.com
    ServerAlias mysite.com
    DocumentRoot /var/www/vhosts/www.mysite.com/httpdocs
    SSLEngine on
    SSLVerifyClient none
    SSLCertificateFile /etc/httpd/conf/ssl.crt/www.mysite.com.crt
    SSLCertificateKeyFile /etc/httpd/conf/ssl.key/server.key
    SSLCACertificateFile /etc/httpd/conf/ssl.crt/intermediate.pem
    ErrorLog /var/log/vhosts/www.mysite.com-error_log
    CustomLog /var/log/vhosts/www.mysite.com-access_log common
[/VirtualHost]

Replace the []'s with <>'s even in pre tags it was trying to read them as html and not showing properly.

So directly to your questions:

1) I have never seen or used SSLCertificateChainFile Im assuming its the intermediate certificate bundle which I would use SSLCACertificateFIle for.

2) If you want to force everyone to HTTPS you will need to do a redirect or a mod-rewrite. Apache will gladly host both HTTP and HTTPS content at the same time and for most people this is what they want. It can be a major PITA to get all the external resources you pull into your site to be HTTPS which will throw warning messages to your users if you use HTTPS on say your home page. If this is not a problem for you though then by all means use HTTPS everywhere.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.