The Apache + SSL HOWTO
Other ApplicationsStruts Resume
Set your name in
The Apache + SSL HOWTO
Version 1.6.8 (changelog: view source)
Revised September 26, 2002 by Matt Raible for Apache 2.0.42. Original Article at http://tud.at/programm/apache-ssl-win32-howto.php3.NEW! (January 23, 2005) Chris Thompson has written an an updated and simplified Apache+SSL HowTo for Windows.
This page describes the installation of the Win32 version of Apache with the mod_ssl extension. The newest version should always be available from http://tud.at/programm/apache-ssl-win32-howto.php3.
This process worked for many people on Windows NT, 98, ME, 2000 and XP; please mail me your suggestions and bug reports. You can even install Apache with SSL in addition to the Microsoft Internet Information Server if you need to.
Note: sometimes, there are changes between the precompiled apache distributions so that this HOWTO is not correct anymore. In this case, if the current version does not work for you, download an older version - one that was published before the modification date of this HOWTO. Or, if you like adventures, try to make it run, and mail me if you needed to change anything.
Apache with mod_ssl seems to be the only free (as in speech, not in beer) solution for Win32. Please note that Apache on Win32 is considered beta quality as it doesn't reach the stability and performance of Apache on Un*x platforms.
Get the Win32 version of the Apache web server from one of the mirrors. It is called something like
Don't mix Apache versions 1.3 and 2! It won't work. If you find 1.3.x on modssl.org, you cannot expect it to work with 2.0.x.
Install Apache as described in http://www.apache.org/docs/windows.html.
For Linux, to install Apache 2.0.42 with mod_sll installed, I performed the following steps:
I used http://httpd.apache.org/docs-2.0/install.html as a reference.
If you're using Apache 2.0.42 with Tomcat, you can download the binary mod_jk.so from http://jakarta.apache.org/builds/jakarta-tomcat-connectors/jk/release/v1.2.0/bin/linux/i386/mod_jk-2.0.42.so. After downloading, put this file into your
Note: You can skip this step and get a full Apache+SSL distribution from modssl.org, as described below. There will be no fancy installation program but you won't need to overwrite the stock Apache files. This is the better way if you are experienced and don't fear editing configuration files (which you will need to do anyway).
Change at least the following parameters in
Install the Apache service (NT only) and start the server. Verify that everything works before proceeding to the SSL installation because this limits the possible errors.
Try http://www.my-server.dom:443/. It won't be encrypted yet but if this works then the port configuration (port 443) is right.
If you want to compile the mod_ssl.so module, you can use the latest sources, available at http://www.modssl.org/contrib/ftp/source/ for Apache 1.3.x and included in Apache HTTP server sources, accesible as a CVS code repository (see the instructions at http://httpd.apache.org/dev/anoncvs.txt) for Apache 2.0.x.
For Windows, the precompiled module is available at http://hunter.campbus.com/ (where you will find there Apache 1.3 and 2.0 binaries with the corresponding mod_ssl.so module versions included), while binaries for Linux are included in the major Linux distributions. Apache Software Foundation mades a point in not offering the compiled binaries for the SSL module, due to the export regulations for cryptographic software from USA. Don't ask for binaries if they will not be available at the currently indicated locations. Various ISVs provide free binaries for this module in various projects such as NuSphere Technology Platform, Apache-SSL etc.
OpenSSL is required for getting a certificate to use with your web server. You may download its sources and compile it from http://www.openssl.org/source/. Compiled binaries are available at http://gnuwin32.sourceforge.net/packages/openssl.htm for Windows and are included in major Linux distributions.
OpenSSL for Windows might also be obtained by downloading and installing Cygwin from http://www.cygwin.com.
Put the files
The following instructions are adapted from http://www.apache-ssl.org/#FAQ.
Open a shell window (Command Prompt in Windows) and change the current directory to the directory where you have the openssl.exe file (openssl file for Linux).
If you didn't provide a config file, OpenSSL will try to use the file specified by the OPENSSL_CONF environment variable. This variable is usually not defined and if you follow the instructions from the original tutorial (linked at the top of this page), which does not use the
On a Windows system, files with
If you have users with MS Internet Explorer 4.0+ and want them to be able to install the certificate into their certificate storage (by downloading and opening it), you need to create a DER-encoded version of the certificate:
Copy the executable files (*.exe, *.dll, *.so) from the downloaded apache-mod_ssl distribution over your original Apache installation directory (remember to stop Apache first and DO NOT overwrite your edited config files etc.!).
Find the LoadModule directives in your
In newer versions of the distribution for Apache 1.x, it could also be necessary to add
Add the following to the end of
Don't forget to call apache with
NOTE: When using SSL with multiple Virtual Hosts, you must use an ip-based configuration. This is because SSL requires you to configure a specific port (443), whereas name-based specifies all ports (*). You might the following error if you try to mix name-based virtual hosts with SSL.
You might need to use
HKEY_LOCAL_MACHINE/SOFTWARE/Apache Group/Apache/X.Y.Z to the correct number if the
Start the server, this time from the command prompt (not as a service) in order to see the error messages that prevent Apache from starting. If everything is OK, (optionally) press CTRL+C to stop the server and start it as a service if you prefer.
If it doesn't work, Apache should write meaningful messages to the screen and/or into the error.log and SSL.log files in the Apache/logs directory.
If something doesn't work, set all
DON'T e-mail me or the other contributors without having plain Apache installed (Step 1). We will ignore your request; we are not the Free Apache Helpdesk and there is enough good documentation on configuring Apache; if that is not enough for you, you shouldn't run a secure server anyway. Also, DON'T e-mail without having looked into the error.log and SSL.log with
Problems connecting to the server with a browser can have many reasons, many of them on the client (proxy, DNS, general IE dumbness).
So, if you encounter problems connecting with SSL, try another browser and/or look into the settings. If even this doesn't work, you can use OpenSSL to debug the problem.
bb@www$ openssl s_client -connect www1.tud.at:443
connect: Connection refused
bb@www$ openssl s_client -connect apcenter.apcinteractive.net:443
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
Q: I see the following when starting Apache:
Syntax error on line [some number] of ...httpd.conf
A: Did you copy the openssl DLLs to WINNT/SYSTEM32 (or WINDOWS/SYSTEM on Win9x/ME)?
You can verify this by copying
One user told me that he had this problem even when he did everything right. He then found the problem: corrupt openssl DLLs. So if you get this error despite having done everything correctly, try the openssl DLLs from another version from modssl.org/contrib.
Q: I see the following when starting Apache:
Syntax error on line [some number] of apache/conf/httpd.conf:or:
Syntax error on line [some number] of apache/conf/httpd.conf:
A: You didn't add the AddModule line (or not where it belongs, it belongs below the other AddModule lines).
Q: SSL doesn't work in the browser and I see the following in some logfile:
Fri Nov 16 15:46:30 2001 No InterWiki reference defined in properties for Wiki called 'Fri Nov 16 15'!) [error] OpenSSL: error:1407609C:SSLA: How much clearer can an error message get? Your VirtualHost or Listen configuration is wrong.
Q: When trying to connect to https://www.myhost.com I kept getting an error about an unknown protocol. I could however connect to https://10.10.0.14 which is the local ip of the server.
Questions about Java servlets, OpenSSL compilation etc.
Don't ask us about installing servlet extensions, recompiling mod_ssl or Apache with EAPI, recompiled versions etc. We have no idea and won't be able help you. We are just users and not programmers.
Apache Web Server: http://www.apache.org
Author of this document: Balázs Bárány (http://tud.at)
Contributor: Peter Holm (Listen and Port directives)
Last change: 2002-05-18
This document can be redistributed under the GNU Free Documentation License. © Balázs Bárány 1999-2002
These instructions were tested by Matt Raible on Windows XP (SP1) and Red Hat Linux 7.3 with Apache 2.0.42.