up vote 2 down vote favorite
share [g+] share [fb]

I enabled HTTPS on the Apache server built-in to Mac OS X 10.6 (on my MacBook Pro) by uncommenting:

Include /private/etc/apache2/extra/httpd-ssl.conf

...in /etc/apache2/httpd.conf and modifying /etc/apache2/extra/httpd-ssl.conf to include:

DocumentRoot "/Users/dspitzer/foo/bar"
ServerName dot.com:443
ServerAdmin dspitzer@dot.com
...
SSLCertificateFile "/private/etc/apache2/cert.pem"
SSLCertificateKeyFile "/private/etc/apache2/key.pem"

Then I restart apache (with sudo apachectl restart) and go to https://localhost/ in Safari, where I get:

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access /
on this server.</p>
</body></html>

I've tried changing 443 in /etc/apache2/extra/httpd-ssl.conf to 8443 and going to https://localhost:8443/ and I get the same error.

I read http://serverfault.com/questions/88037/why-am-i-getting-this-403-forbidden-error and confirmed that execute permission is given for all parent directories of the vhost dir: /Users/dspitzer/foo/bar.

Is there a log file somewhere that might give me a clue?

Update: There is an index.html file in the document (at /Users/dspitzer/foo/bar/index.html).

Update 2: I found the following in /private/var/log/apache2/error_log:

[Tue Apr 27 20:42:36 2010] [error] [client ::1] client denied by server configuration: /Users/dspitzer/foo/bar/
[Tue Apr 27 20:42:36 2010] [error] [client ::1] client denied by server configuration: /Users/dspitzer/foo/bar/favicon.ico, referer: https://localhost/

Is there a clue there I'm missing?

link|improve this question
86% accept rate
Try adding an index.html file in the DocumentRoot. You might find that it is displaying a directory listing that is forbidden – Seanchán Torpéist Apr 28 '10 at 0:17
feedback

2 Answers

up vote 4 down vote accepted

The problem is the default web server configuration, which looks like this:

<Directory />
  Options FollowSymLinks
  AllowOverride None
  Order deny,allow
  Deny from all
</Directory>

<Directory "/Library/WebServer/Documents">
  Options Indexes FollowSymLinks MultiViews
  AllowOverride None
  Order allow,deny
  Allow from all
</Directory>

The first block explicitly disallows all access to anywhere in the filesystem; the second explicitly allows access to /Library/WebServer/Documents (the default DocumentRoot). Add another block to match your new DocumentRoot, and it will work as well. For example:

<Directory "/Users/dspitzer/foo/bar">
  Options Indexes FollowSymLinks MultiViews
  AllowOverride None
  Order allow,deny
  Allow from all
</Directory>

This can go either in the main httpd.conf file, or in the VirtualHost in httpd-ssl.conf.

link|improve this answer
feedback
up vote 0 down vote

There is no need to change the https port. See if the path /Users/dspitzer/foo/bar/ is included in the tag and apache has access to it.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.