topic Re: Apache encrypting URL in Operating System - HP-UX

Apache encrypting URL

OFC_EDM — Wed, 07 Sep 2005 12:08:35 GMT

We have a URL where we want to ensure that data is encrypted when going across the wire instead of in plain text.

How can I do this? Is this an ssl.conf setting to setup an https url? If so what do I need to do to access the url with https instead of http.

This is for just one URL. The other sites on the system will be straight http.

Hope this make sense, I'm brand new to this web server config stuff.

Re: Apache encrypting URL

Florian Heigl (new acc) — Wed, 07 Sep 2005 12:28:04 GMT

Hi,

the apache HP delivers is quite ready for this,, but You'll have to take multiple steps:

- edit /etc/rc.config/hpws_apacheconf to enable ssl
- create a host certificate for the server
(In my opinion http://www.openbsd.org/faq/faq10.html#HTTPS has the best explanation of the process of doing that)
- if You want Your certificate signed, either turn to a $$-ca like mentioned or to the only free, but less well supported http://www.cacert.org , but don't just use a self-signed one.
- after that You have to put the website in question into a virtual host definition like

in httpd.conf. I've done this only a few times, but the apache manual has information on it.

After that, the site should be accessible via https *only*.
Check You can't access it via hostname:80 or any other way, and check it's running commercial-grade encryption (firefox/netscape will tell You most easily) as in >=128bit, SSLv3...

You should be fine then.

Re: Apache encrypting URL

OFC_EDM — Wed, 07 Sep 2005 12:31:46 GMT

Currently I'm configuring this on a Linux server. Although we will do this on an HP server soon.

Are the steps different for Apache on Linux?

Re: Apache encrypting URL

Florian Heigl (new acc) — Wed, 07 Sep 2005 12:39:31 GMT

Nope, except that some config files will be diffent. (Last time I counted debian came with about 55 of them for apache :))

look for httpd.conf and ssl.conf and check that openssl is installed.

Re: Apache encrypting URL

OFC_EDM — Thu, 17 Apr 2008 10:43:16 GMT

done