Apache 2.x win32 + openssl + modssl = ?

[bob4432]

anybody have a good tutorial on adding openssl and modssl to a regular apache install?

thanks,
bob

 

[n0cmonkey]

I think Apache 2 comes with modssl built in.

 

[bob4432]

the apache win32 exes are "no ssl"....i think modssl is there, but it is commented out and openssl is not part of it..uggghh

 

[screw3d]

I used this:
http://smithii.com/node/30

 

[bob4432]

Originally posted by: screw3d
I used this:
http://smithii.com/node/30

does the conf file really change a lot? the issue is is that i have apache set up and tweaked running with about 5 sites w/php/mysql. i am trying to make the setup i have ssl capable. therein lies the problem - i need to move my data to the new config file but since they are so long i don't want to miss anything....

 

[screw3d]

Originally posted by: bob4432

Originally posted by: screw3d
I used this:
http://smithii.com/node/30

does the conf file really change a lot? the issue is is that i have apache set up and tweaked running with about 5 sites w/php/mysql. i am trying to make the setup i have ssl capable. therein lies the problem - i need to move my data to the new config file but since they are so long i don't want to miss anything....

All SSL related conf are in ssl.conf.. there isn't much that you need to change in httpd.conf itself other than adding the directives for mod_ssl module.

On my Windows development server, I need to run "apache -D SSL" to activate SSL.. but your might have it setup another way..

 

[bob4432]

Originally posted by: screw3d

Originally posted by: bob4432

Originally posted by: screw3d
I used this:
http://smithii.com/node/30

does the conf file really change a lot? the issue is is that i have apache set up and tweaked running with about 5 sites w/php/mysql. i am trying to make the setup i have ssl capable. therein lies the problem - i need to move my data to the new config file but since they are so long i don't want to miss anything....

All SSL related conf are in ssl.conf.. there isn't much that you need to change in httpd.conf itself other than adding the directives for mod_ssl module.

On my Windows development server, I need to run "apache -D SSL" to activate SSL.. but your might have it setup another way..

thanks for the info, i am currently running the setup from this site - http://www.devside.net/ on my main rig for testing and am trying to set stuff up so that i can move whatever files i need to to my server machine and then modify my conf file so it works with ssl. i guess the interesting part is how i will start the server with ssl support or if it will do it automatically whenever it gets a https request. this is an areay that i am not at all familiar with. i probably need to see how apache is set to turn on with the http://www.devside.net/ setup....

one bonus is that my isp doesn't block outgoing port 443 so i don't need to run it to another port like i do with the regular http server

EDIT: i found that the setup i have on my test mahcine starts apache with the switch -k runservice guess i need to see what exactly that does

 

[screw3d]

Originally posted by: bob4432

Originally posted by: screw3d

Originally posted by: bob4432

Originally posted by: screw3d
I used this:
http://smithii.com/node/30

does the conf file really change a lot? the issue is is that i have apache set up and tweaked running with about 5 sites w/php/mysql. i am trying to make the setup i have ssl capable. therein lies the problem - i need to move my data to the new config file but since they are so long i don't want to miss anything....

All SSL related conf are in ssl.conf.. there isn't much that you need to change in httpd.conf itself other than adding the directives for mod_ssl module.

On my Windows development server, I need to run "apache -D SSL" to activate SSL.. but your might have it setup another way..

thanks for the info, i am currently running the setup from this site - http://www.devside.net/ on my main rig for testing and am trying to set stuff up so that i can move whatever files i need to to my server machine and then modify my conf file so it works with ssl. i guess the interesting part is how i will start the server with ssl support or if it will do it automatically whenever it gets a https request. this is an areay that i am not at all familiar with. i probably need to see how apache is set to turn on with the http://www.devside.net/ setup....

one bonus is that my isp doesn't block outgoing port 443 so i don't need to run it to another port like i do with the regular http server

EDIT: i found that the setup i have on my test mahcine starts apache with the switch -k runservice guess i need to see what exactly that does

I see that DevSide is using Apache 2.2.3.. I'm not sure if that's a problem because most people are still using 1.3.x or 2.0.x. You might have trouble finding binaries for the Apache modules.. unless of course, you can compile those yourself.

The "-k runservice" runs Apache as a Windows service.. but this switch is only active when invoked by Services.exe.. it won't do anything if you run this in command line.

Since HTTPS runs as a module, the moment you enable mod_ssl, it would be listening for HTTPS requests as long as Apache is running. The "-D SSL" switch merely activates whatever's inside <IfDefine SSL> in my ssl.conf file. If I comment out the line <IfDefine SSL>, I can probably run SSL without the -D switch. Your set up could be different

I'm hardly an expert on Apache though.. please chime in if I'm wrong.

 

[bob4432]

Originally posted by: screw3d

Originally posted by: bob4432

Originally posted by: screw3d

Originally posted by: bob4432

Originally posted by: screw3d
I used this:
http://smithii.com/node/30

does the conf file really change a lot? the issue is is that i have apache set up and tweaked running with about 5 sites w/php/mysql. i am trying to make the setup i have ssl capable. therein lies the problem - i need to move my data to the new config file but since they are so long i don't want to miss anything....

All SSL related conf are in ssl.conf.. there isn't much that you need to change in httpd.conf itself other than adding the directives for mod_ssl module.

On my Windows development server, I need to run "apache -D SSL" to activate SSL.. but your might have it setup another way..

thanks for the info, i am currently running the setup from this site - http://www.devside.net/ on my main rig for testing and am trying to set stuff up so that i can move whatever files i need to to my server machine and then modify my conf file so it works with ssl. i guess the interesting part is how i will start the server with ssl support or if it will do it automatically whenever it gets a https request. this is an areay that i am not at all familiar with. i probably need to see how apache is set to turn on with the http://www.devside.net/ setup....

one bonus is that my isp doesn't block outgoing port 443 so i don't need to run it to another port like i do with the regular http server

EDIT: i found that the setup i have on my test mahcine starts apache with the switch -k runservice guess i need to see what exactly that does

I see that DevSide is using Apache 2.2.3.. I'm not sure if that's a problem because most people are still using 1.3.x or 2.0.x. You might have trouble finding binaries for the Apache modules.. unless of course, you can compile those yourself.

The "-k runservice" runs Apache as a Windows service.. but this switch is only active when invoked by Services.exe.. it won't do anything if you run this in command line.

Since HTTPS runs as a module, the moment you enable mod_ssl, it would be listening for HTTPS requests as long as Apache is running. The "-D SSL" switch merely activates whatever's inside <IfDefine SSL> in my ssl.conf file. If I comment out the line <IfDefine SSL>, I can probably run SSL without the -D switch. Your set up could be different

I'm hardly an expert on Apache though.. please chime in if I'm wrong.

thanks for the additional info. on the setup i want to put on ssl that doesn't have it, it is running apache 2.0.x, the test setup is the 2.2.x setup...

i also found this - http://tud.at/programm/apache-ssl-win32-howto.php3 so i think between all of this i should be able to do it....keeping fingers crossed

 

[bob4432]

on my main server, as soon as i uncomment the load module mod_ssl the server will not start up even though i have already created certs/keys, openssl and its necessary dlls are in the right place...uugghhhh

i have an extra machine laying around i might fire up just for this, wonder if win2kpro will run on 64MB of ram...probably not....need to find some pc100/pc133 for cheap, damn

 

[bob4432]

bump for help...

 

[screw3d]

Check error_log and check your event viewer to find out what's the problem?

 

[bob4432]

ok, things are starting to happen - in a good way. must have been too tired last night. question - do i setup the virtual host in the ssl.conf or the regular httpd.conf?

 

[bob4432]

when i do get an error that shows up in the computer error log, not apache it is this - The Apache2 service terminated with service-specific error 1.

 

[bob4432]

ok, now everything is working and start ups fine. i get a warn in the error.log that says the sslsession cache is not set up but it is in ssl.conf. the other issue is that it seems like the site i am trying to hit is not there??? i don't know why but all things point to it the correct directory and the index is a index.php, which works fine under regular conditions, so i am stumped. i have tried to have the info for where the site is in the virtual hosts in the httpd.conf file turning on all the ssl stuff inside the virtual host, and no work, and i have also configured the ssl.conf virtual setup to point to the correct site, again nothing. any ideas?

other virtual sites work fine and port 443 is not blocked by my isp so....

 

[bob4432]

here is from the error log:

[Mon Jan 15 02:29:09 2007] [notice] Parent: Received shutdown signal -- Shutting down the server.
[Mon Jan 15 02:29:09 2007] [notice] Child 2560: Exit event signaled. Child process is ending.
[Mon Jan 15 02:29:10 2007] [notice] Child 2560: Released the start mutex
[Mon Jan 15 02:29:11 2007] [notice] Child 2560: Waiting for 250 worker threads to exit.
[Mon Jan 15 02:29:11 2007] [notice] Child 2560: All worker threads have exited.
[Mon Jan 15 02:29:11 2007] [notice] Child 2560: Child process is exiting
[Mon Jan 15 02:29:11 2007] [notice] Parent: Child process exited successfully.
[Mon Jan 15 02:29:20 2007] [warn] Init: Session Cache is not configured [hint: SSLSessionCache]
[Mon Jan 15 02:29:21 2007] [notice] bw_mod : Version 0.6 - Initialized [1 Confs]
[Mon Jan 15 02:29:21 2007] [notice] Apache/2.0.59 (Win32) PHP/4.3.11 mod_ssl/2.0.59 OpenSSL/0.9.8d configured -- resuming normal operations
[Mon Jan 15 02:29:21 2007] [notice] Server built: Jul 27 2006 15:55:03
[Mon Jan 15 02:29:21 2007] [notice] Parent: Created child process 2524
[Mon Jan 15 02:29:21 2007] [warn] Init: Session Cache is not configured [hint: SSLSessionCache]
[Mon Jan 15 02:29:21 2007] [notice] bw_mod : Version 0.6 - Initialized [1 Confs]
[Mon Jan 15 02:29:21 2007] [notice] Child 2524: Child process is running
[Mon Jan 15 02:29:21 2007] [notice] Child 2524: Acquired the start mutex.
[Mon Jan 15 02:29:21 2007] [notice] Child 2524: Starting 250 worker threads.
[Mon Jan 15 02:29:26 2007] [warn] (OS 64)The specified network name is no longer available. : winnt_accept: Asynchronous AcceptEx failed.

all other sites work, only one with the issue is the ssl site. i have no idea what the bold line is. running on win2kpro sp4 up-to-date

 

[bob4432]

ok, so after hours of pulling my hair out, it appeas that "s" hosts need their own ip, at least that is what i have read. this machine has many name based virtual hosts, so how do i go about setting up multiple instances of apache? will i need an additional nic in the machine too?