This document describes the steps to enable SSL Certificate on Apache Webserver to encrypt a site’s information and create a more secure connection. Additionally, the certificate can show the virtual private server’s identification information to site visitors. Certificate Authorities can issue SSL certificates that verify the virtual server’s details while a self-signed certificate has no 3rd party corroboration.

Install Mod SSL

First to be sure that Apache Mod SSL are installed:

Install SSL module	yum install mod_ssl
Load SSL module in Apache	LoadModule ssl_module modules/mod_ssl.so Listen 443

 

Copy your SSL certificate to your server

First copy your Certificate files to your server, for example to the following locations:

create a new directory where the server key and certificate will be stored	mkdir /etc/httpd/ssl
Certificate	/etc/httpd/ssl/exampledomain.com.crt
Certificate Key	/etc/httpd/ssl/exampledomain.com.key
CA Certificate	/etc/httpd/ssl/bundle.crt

Creating the self-signed SSL certificate

Run the cmmand below:

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/httpd/ssl/apache.key -out /etc/httpd/ssl/apache.crt

This command will prompt terminal to display a lists of fields that need to be filled in. The most important line is “Common Name”. Enter your official domain name here.

Remove default Apache virtual host

By default mod_ssl sets up a virtual host that we don’t need.

Edit /etc/httpd/conf.d/ssl.conf and remove the virtual host definition from

“<VirtualHost _default_:443>” to “</VirtualHost>”.

Enable SSL

Setup your virtual hosts to display the new certificate. Add the directives from the template below to your SSL configuration (for example /etc/httpd/conf.d/vhosts.conf), to enable SSL on your site:

Here’s a template for the virtual host definition:

<VirtualHost *:443>

DocumentRoot /var/www/vhosts/ exampledomain.com /httpdocs

ServerName exampledomain.com

ServerAlias www. exampledomain.com

ErrorLog logs/ exampledomain.com -ssl-error_log

CustomLog logs/ exampledomain.com -ssl-access_log common

<Directory /var/www/vhosts/exampledomain.com /httpdocs>

AllowOverride All

</Directory>

 

SSLEngine on

SSLProtocol -ALL +SSLv3 +TLSv1

SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:!LOW:!SSLv2:!EXPORT

SSLCertificateFile /etc/pki/tls/certs/ exampledomain.com.crt

SSLCertificateKeyFile /etc/pki/tls/private/ exampledomain.com.key

SSLCACertificateFile /etc/pki/tls/certs/gd_bundle.crt

 

<Location/>

SSLRequireSSL

</Location>

 

</VirtualHost>

The SSLEngine On directive turns SSL on.
Restart Apache to reload your changes.

Troubleshooting

• If you get a message like this on httpd restart “[warn] _default_ VirtualHost overlap on port 443, the first has precedence” then you’ve not removed the default virtual host created by mod_ssl.
• You may need to adjust the iptables configuration to allow traffic to TCP port 443.