Apache SSL configuration with sample

Many a times, you might want to set up an Apache httpd server as front end that talks to back end application servers such as Oracle WebLogic or Apache Tomcat. While httpd acts as a proxy, you might also want to use it as an SSL server. It will ensure that the communication between browser and apache httpd is secure. But, have you ever thought how easy it is to set up SSL using apache? Believe me, it is really easy. Apache configuration is so powerful (I agree, sometimes it is painful if you don’t know what you are usingJ) and needs very minimal configuration.

The minimum things that you would need are: -

a) Server certificate

                - Your browser user can identify which server he/she is connecting to. This is PEM encoded certificate. If you open the certificate in an editor like notepad, you can see scrambled text which starts with -----BEGIN CERTIFICATE----- and ends with -----END CERTIFICATE-----.

b) Private key to decrypt the encrypted data

                - Please make sure that your private key is kept secure. You can use key that use either RSA or DSA.

c) Certificate chain from your certificate authority

                - The end certificate in the chain will be a root certificate. If you don’t have the complete chain, SSL might not work.

If you have all the above, then you can easily set up 'one-way' SSL which is otherwise known as 'Server authentication'. Please see below the snippet that is the minimal configuration required:

Listen 443

<VirtualHost *:443>

     SSLEngine on

     SSLCertificateFile public.crt

     SSLCertificateKeyFile private.key

     SSLCertificateChainFile intermediate.crt      

</VirtualHost>

The mod_ssl module also allows you to access certain environment variables which you may use them for debugging purpose. Use the following line that will allow you to create a separate log file for capturing SSL related information. You may also decide to switch on logging only in development.

CustomLog logs/ssl_request_log "%t %h %l %u %{SSL_PROTOCOL}x %{SSL_CIPHER}x %{HTTPS}x %{REFERER}i %{X-Forwarded-For}i \"%r\" %s %b"

One common issue that every one might face is with configuring 443 for SSL. you might get an error that is given below: -

(13)Permission denied: AH00072: make_sock: could not bind to address xx.xxx.xx.xx:443

no listening sockets available, shutting down

AH00015: Unable to open logs

Please make sure that you have 'root' access which is required for using standard ports 80 for http and 443 for https.

Hope this information will be useful for you.