You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Kevin Ericson <Ke...@Kinetic-Tech.com> on 2003/08/03 00:13:31 UTC
[users@httpd] Vexed over Apache 1.3 and OpenSSL under Windows
Anyone out there know of an easier way to get SSL working under Apache
1.3 on a Windows platform? The OpenSSL site is pretty dismal when it
comes to that. Just downloading the tarballs blew up WinZip and WinRAR
on every machine I've got. Finally FTPed from my RedHat box ran tar,
install Samba, port to Windows only to read the directions that start
with telling me to install PERL, install Visual C++, find a copy of MASM
(haven't used that since the 1980's) and start compiling. And even then
I see absolutely nothing on what to do with integrating it into your
httpd.conf file.
Certainly there's an easier way. Isn't there?
Ok. So maybe there isn't. Give me just one hint, though. Even after all
the compiling and PERLing and macro assembling I read on VeriSign's web
site about generating a CSR. They say to run this command...
openssl req -new -nodes -keyout private.key -out public.csr
I don't see anywhere after all that compiling where an openssl.exe file
is made. I did find one from www.shininglightpro.com but not a lick of
documentation that was of any use (some good documentation on "4 Byte
Semaphores" and "Poly-Point Collision Detection" though).
Am I even going down the right path? Should I be researching mod_ssl or
Apache-SSL or is OpenSSL the way to go? Each one seems to be somehow
tied to the other? I see Stronghold is a commercial
product...oops...www.c2.net is a dead link...surprise, surprise.
Any guidance is appreciated. I don't need a fish, I just need a little
help with somebody showing me how to bait the hook.
TIA
Kevin Ericson, Pres.
Kinetic Technologies, Inc.
1845 Kendall St. #206
Lakewood, CO 80214
303-981-1159
303-274-1384 FAX
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Vexed over Apache 1.3 and OpenSSL under Windows
Posted by Geoff Thorpe <ge...@geoffthorpe.net>.
Hi,
On August 2, 2003 06:13 pm, Kevin Ericson wrote:
> Anyone out there know of an easier way to get SSL working under Apache
> 1.3 on a Windows platform? The OpenSSL site is pretty dismal when it
> comes to that. Just downloading the tarballs blew up WinZip and WinRAR
> on every machine I've got. Finally FTPed from my RedHat box ran tar,
> install Samba, port to Windows only to read the directions that start
> with telling me to install PERL, install Visual C++, find a copy of
> MASM (haven't used that since the 1980's) and start compiling. And even
> then I see absolutely nothing on what to do with integrating it into
> your httpd.conf file.
>
> Certainly there's an easier way. Isn't there?
SSL/TLS is a protocol for securing communications, it doesn't necessarily
have anything to do with TCP/IP, and it certainly isn't obliged to have
anything to do with web servers or clients. HTTPS is what you get if you
run HTTP inside an SSL/TLS tunnel (running over TCP/IP). mod_ssl and
Apache-SSL are bolt-ins to Apache to support HTTPS, they use OpenSSL
libraries to do the cryptographic donkey-work. So, you're better off
checking those web-related packages and associated documentation.
> Ok. So maybe there isn't. Give me just one hint, though. Even after all
> the compiling and PERLing and macro assembling I read on VeriSign's web
> site about generating a CSR. They say to run this command...
>
> openssl req -new -nodes -keyout private.key -out public.csr
If you built OpenSSL yourself, you should have ended up with an openssl
executable. On windows (IIRC) these turn up in an "out**" directory of
some kind, the exact name depending on what type of build you performed.
The "openssl ..." commands (particularly "x509", "ca", "req", etc) are
just helper utilities for manipulating certificates. What you want to do,
and what you do with the results, depend on what you're trying to do -
again, the mod_ssl documentation may be a good place to get a handle on
things.
Also, if you're bound to windows; (a) my sincerest sympathies, (b) I seem
to recall that some precompiled/installer-based bundles can be found
lying around the place. It can be a hassle building serious applications
on light-hearted systems, and networking/security on windows definitely
falls into this category. If you search the mod_ssl (or apache) archives
for "pre-compiled for windows" you're bound to find something turn up.
This could save you oodles of time and hassle.
> Am I even going down the right path? Should I be researching mod_ssl or
> Apache-SSL or is OpenSSL the way to go? Each one seems to be somehow
> tied to the other? I see Stronghold is a commercial
> product...oops...www.c2.net is a dead link...surprise, surprise.
Ah sweet nostalgia, long live C2Net.
> Any guidance is appreciated. I don't need a fish, I just need a little
> help with somebody showing me how to bait the hook.
nice :-)
Cheers,
Geoff
--
Geoff Thorpe
geoff@geoffthorpe.net
http://www.geoffthorpe.net/
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Vexed over Apache 1.3 and OpenSSL under Windows
Posted by Laurent Blume <la...@infores.com>.
I just got up to add SSL to my own Apache2/Windows server (I did have
some experience on doing it on Solaris, so it was quite easy).
Here are the steps I followed:
- I installed Apache 2.0.47 using Apache official installer found there
[1], which does not include SSL, but does install it as a service.
- I downloaded the unofficial 2.0.47 build found there [2], copied
mod_ssl.so from it to my Apache modules/ directory, and the sample
ssl.conf to the conf/ directory.
- I downloaded the also unofficial OpenSSL 0.9.7b built found there [3],
and installed it.
- I created a self-signed certificate following those instructions [4]
(they also explain how to create a certificate request).
- I created ssl.key and ssl.crt directories in the Apache conf/
directory, and put the certificate and key there.
- I modified httpd.conf to load the ssl module (one line to uncomment)
and ssl.conf to look for the right certificate and key names (2 lines to
modify), and have the right name server and such.
I hope I didn't forget anything :-)
I know building from source would be better, but it is such a pain on
Windows... I just wish I could have a Unix box instead :-(
HTH,
Laurent
[1]
http://httpd.apache.org/download.cgi
Win32 binary: apache_2.0.47-win32-x86-no_ssl.msi
[2]
http://www.gknw.net/development/apache/httpd-2.0/win32/
[3]
http://www.shininglightpro.com/index.php?treeloc=35
[4]
http://www.openssl.org/docs/HOWTO/certificates.txt
Kevin Ericson wrote:
> Anyone out there know of an easier way to get SSL working under Apache
> 1.3 on a Windows platform? The OpenSSL site is pretty dismal when it
> comes to that. Just downloading the tarballs blew up WinZip and WinRAR
> on every machine I've got. Finally FTPed from my RedHat box ran tar,
> install Samba, port to Windows only to read the directions that start
> with telling me to install PERL, install Visual C++, find a copy of MASM
> (haven't used that since the 1980's) and start compiling. And even then
> I see absolutely nothing on what to do with integrating it into your
> httpd.conf file.
>
> Certainly there's an easier way. Isn't there?
>
> Ok. So maybe there isn't. Give me just one hint, though. Even after all
> the compiling and PERLing and macro assembling I read on VeriSign's web
> site about generating a CSR. They say to run this command...
>
> openssl req -new -nodes -keyout private.key -out public.csr
>
> I don't see anywhere after all that compiling where an openssl.exe file
> is made. I did find one from www.shininglightpro.com but not a lick of
> documentation that was of any use (some good documentation on "4 Byte
> Semaphores" and "Poly-Point Collision Detection" though).
>
> Am I even going down the right path? Should I be researching mod_ssl or
> Apache-SSL or is OpenSSL the way to go? Each one seems to be somehow
> tied to the other? I see Stronghold is a commercial
> product...oops...www.c2.net is a dead link...surprise, surprise.
>
> Any guidance is appreciated. I don't need a fish, I just need a little
> help with somebody showing me how to bait the hook.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Vexed over Apache 1.3 and OpenSSL under Windows
Posted by Paul Simon <wr...@yahoo.com>.
I'd give you a whole new fishing pole. Go with Apache
2.0. Using Apache 1.x doesn't make any sense to me...
I got Apache2 w/SSL working on a win2000 box after a
lot of fishing. I basically needed to compile Apache
and mod_ssl, using MS Visual C++. Ultimately, I had a
mod_ssl.so module under the modules directory. I can't
remember exactly how I did get mod_ssl. I believe the
mod_ssl source files are included with the Apache2
source files.
I also needed openssl.exe with libeay32.dll and
ssleay32.dll.
After all that was in place I created a certificate
using openssl.exe. Then I configured the apache conf
file to listen for and handle 443 requests.
It was complicated to get this all working... Lot's of
Googling and httpd.org and modssl.org and openssl.org
site. I hope this is helpful.
Paul
--- Kevin Ericson <Ke...@Kinetic-Tech.com> wrote:
> Anyone out there know of an easier way to get SSL
> working under Apache
> 1.3 on a Windows platform? The OpenSSL site is
> pretty dismal when it
> comes to that. Just downloading the tarballs blew up
> WinZip and WinRAR
> on every machine I've got. Finally FTPed from my
> RedHat box ran tar,
> install Samba, port to Windows only to read the
> directions that start
> with telling me to install PERL, install Visual C++,
> find a copy of MASM
> (haven't used that since the 1980's) and start
> compiling. And even then
> I see absolutely nothing on what to do with
> integrating it into your
> httpd.conf file.
>
> Certainly there's an easier way. Isn't there?
>
> Ok. So maybe there isn't. Give me just one hint,
> though. Even after all
> the compiling and PERLing and macro assembling I
> read on VeriSign's web
> site about generating a CSR. They say to run this
> command...
>
> openssl req -new -nodes -keyout private.key -out
> public.csr
>
> I don't see anywhere after all that compiling where
> an openssl.exe file
> is made. I did find one from www.shininglightpro.com
> but not a lick of
> documentation that was of any use (some good
> documentation on "4 Byte
> Semaphores" and "Poly-Point Collision Detection"
> though).
>
> Am I even going down the right path? Should I be
> researching mod_ssl or
> Apache-SSL or is OpenSSL the way to go? Each one
> seems to be somehow
> tied to the other? I see Stronghold is a commercial
> product...oops...www.c2.net is a dead
> link...surprise, surprise.
>
> Any guidance is appreciated. I don't need a fish, I
> just need a little
> help with somebody showing me how to bait the hook.
>
> TIA
>
> Kevin Ericson, Pres.
> Kinetic Technologies, Inc.
> 1845 Kendall St. #206
> Lakewood, CO 80214
> 303-981-1159
> 303-274-1384 FAX
>
>
>
---------------------------------------------------------------------
> The official User-To-User support forum of the
> Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for
> more info.
> To unsubscribe, e-mail:
> users-unsubscribe@httpd.apache.org
> " from the digest:
> users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail:
> users-help@httpd.apache.org
>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org