Possible locations of ssl.conf and httpd.conf

Question

I'm trying to write a script in python that takes a certificate file and the private key, and installs the SSL certificate on the Apache server. The ssl.conf file on my machine is located in the directory /etc/httpd/conf.d/ which I think is normal. However, what are the other directories the ssl.conf file can be in, depending on the distrubution?

And is ssl.conf a feature for only Apache 2? If the server running is Apache 1, do I need to locate and edit the httpd.conf file?

Answer 1

You can specify a cert per-virtualhost... (makes use of server indications which is supported by nearly every modern browser). As far as making a script to install the cert automagically... This would largely be distro-specific (unless you do a lot of extra coding to make it happen) most RHEL platforms (if not all) put stuff in /etc/httpd/... where debian-flavored put it in /etc/apache2/... and who knows where else it can end up on other distros.

If you're sticking with one specific distro... keep in mind that there's also a lot of different ways to do your configs. you can have 1 singular megalithic config file that contains everything... and you can break it out into smaller components that load other configs... (i.e. how httpd.conf loads conf.d/*.conf)... or even break it up with individual configs per-site, per-module, and a dozen other ways...

By default, however, most platforms still running apache 1... traditionally have 1 megalithic config that configures all of apache... and I don't think there is an option to load additional config files. Apache 2.0.41 introduced the include with wildcards to allow things like:

Include /etc/httpd/conf.d/*.conf
Include /etc/httpd/mods-enabled/*.load

which encouraged a lot more of the broken-up configs.

As a good idea, I would highly suggest you standardize your environments as much as possible. Trying to support multiple environments with multiple types of configs and multiple versions of everything is an absolute nightmare. Additionally, Apache 1 is beyond EoL. Sure, hotfixes might still be released... but I wouldn't rely on it for any kind of secure environment. I have yet to find anything that is only available in Apache 1. Apache 2 as been stable for 8 years now... it's time to upgrade.

Answer 2

On Apache 1 mod_ssl was not a built-in module, and there where a couple different modules for enabling SSL I think in most cases the expectation was that you would just include the required directives in your existing configuration files.

I doubt you can write a generic script that will apply accross all platforms there is too much variation, and for complex configurations your script almost certain to break things rather then be successful.

There is not requirement for putting configuration related to ssl in the ssl.conf file. On my hosts where I have about 30 virtual hosts, the ssl.conf is mostly unused I store the virtual host specific settings (certs) in the configuration file for that virtual host.

But to answer your question on Debian based systems you will find the per-server settings in /etc/apache2/mods-available/ssl.conf.

Answer 3

It cannot be done. The closest you have is apxs -q SYSCONFDIR.

You'd need distro-specific handling.

Even then a random sysadmin needn't follow any convention.

Answer 4

FWIW, there is an Apache Wiki page that tries to record distro-specific layouts.