Skip to content
IT // Adventures

Configuring Apache Httpd with SSL

Creating and configuring SSL certificates for Apache Httpd, step by step.

2 min read
Contents

Since the documentation on using SSL certificates with Apache HTTPd isn’t always easy to understand, here is a short summary of the configuration of my lab system.

The following steps were performed on a Windows Server, but should work on Linux with minor adjustments.

Prerequisites

  • Apache was compiled with OpenSSL support
  • An SSL certificate is available (as a .pfx or pem archive)
  • Port 443 is open in the firewall

Preparing the Certificates

We need

  • The SSL certificate, Base64-encoded (.cer or .crt)
  • The private key for the certificate WITHOUT password protection (.key)
  • The certificate of the certification authority (or authorities), i.e. the “Intermediate CA” certificate. For RapidSSL, the “Intermediate CA” certificate chain.

Since our certificates usually come as a .pfx file (containing the certificate and the password-protected private key), we first have to split it up. OpenSSL is the right tool for this and ships with Apache. The corresponding .exe is in the /bin directory of the Apache server.

First, copy the .pfx file to the same directory as openssl.exe.

On the command line, first extract the private key:

openssl.exe pkcs12 -in wildcard-domain.at-2013.pfx -nocerts -out wildcard-domain.at-2013-encrypted.key

In this step you first have to enter the password for the .pfx file and then set a new password twice (for the generated .key file).

Then export the actual certificate from the .pfx file:

openssl.exe pkcs12 -in wildcard-domain.at-2013.pfx -clcerts -nokeys -out wildcard-domain.at-2013.crt

Again, you have to enter the password for the .pfx file.

Since Apache can’t ask for the private key password on every service restart, the key created in step 2 still has to be decrypted:

openssl rsa -in wildcard-domain.at-2013-encrypted.key -out wildcard-domain.at-2013.key

OpenSSL asks for a password once more, this time the one you set in step 2.

It’s best to put the files wildcard-domain.at-2013.crt (SSL certificate), wildcard-domain.at-2013.key (private key) and the certificate of the certification authority (or authorities) in the Apache subdirectory /conf/ssl. IMPORTANT: Please be sure to delete the files you no longer need!

Apache Config

Enable the following entries in httpd.conf:

LoadModule ssl_module modules/mod_ssl.so
LoadModule socache_shmcb_module modules/mod_socache_shmcb.so

Include conf/extra/httpd-ssl.conf

Global SSL Options

Set the global SSL options in the file “httpd-ssl.conf”:

SSLRandomSeed startup builtin
SSLRandomSeed connect builtin
SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
SSLPassPhraseDialog  builtin
SSLSessionCache "shmcb:D:/Apache/logs/ssl_scache(512000)"
SSLSessionCacheTimeout 300
Listen 443

Vhost Config

The certificate itself has to be specified in the vHost entry. The name in the certificate must of course match the “Servername” and “ServerAlias” entries of the vHost.

<VirtualHost *:443>
    [... default settings, hostname, directories ...]
    SSLEngine on
    SSLCertificateFile "D:/Apache/conf/ssl/wildcard-domain.at-2013.crt"
    SSLCertificateKeyFile "D:/Apache/conf/ssl/wildcard-domain.at-2013.key"
    SSLCertificateChainFile "D:/Apache/conf/ssl/RapidSSL-Intermediate-CA.cer"
    <FilesMatch "\.(cgi|shtml|phtml|php)$">
        SSLOptions +StdEnvVars
    </FilesMatch>
    BrowserMatch "MSIE [2-5]" nokeepalive ssl-unclean-shutdown downgrade-1.0 force-response-1.0
</VirtualHost>