Home > Debian (Linux) | Webserver > RapidSSL-Zertifikat unter Debian mit Apache2 installieren

RapidSSL-Zertifikat unter Debian mit Apache2 installieren

14.03.2013 22:00

Verwendetes System:

Debian Squeeze amd64
Apache/2.2.16 (Debian)

Installation eines „GeoTrust RapidSSL Wildcard“-Zertifikats unter Apache2 (Debian).
Exemplarisch wird hier als Hostname my-hostname.de verwendet.

Hostname setzen

Die folgenden Zeilen an die Datei /etc/hosts anfügen, ggf. alte Einträge löschen ( vi /etc/hosts ):

127.0.0.1 my-hostname.de my-hostname localhost
127.0.1.1 my-hostname.de my-hostname

1 2	127.0.0.1 my-hostname.de my-hostname localhost 127.0.1.1 my-hostname.de my-hostname

Hostnamen in die Datei /etc/hostname schreiben ( vi /etc/hostname):

my-hostname.de

1	my-hostname.de

Den Hostnamen im System setzen:

hostname my-hostname.de

1	hostname my-hostname.de

Konfiguration des Webservers

Änderungen an der /etc/apache2/ports.conf:

Wenn ihr nur die Verfügbarkeit auf Port 443 (https) wünscht und keine Reaktion auf Port 80 (http), kommentiert die Zeile

Listen 80

Listen 80

einfach aus. Zusätzlich gebt dem NameVirtualHost noch den epliziten Port hinzu. Restliche Einstellungen sollten bereits so vorhanden sein.

Inhalt meiner /etc/apache2/ports.conf:

# If you just change the port or add more ports here, you will likely also
# have to change the VirtualHost statement in
# /etc/apache2/sites-enabled/000-default
# This is also true if you have upgraded from before 2.2.9-3 (i.e. from
# Debian etch). See /usr/share/doc/apache2.2-common/NEWS.Debian.gz and
# README.Debian.gz<br><br>NameVirtualHost *:443
#Listen 80

<IfModule mod_ssl.c>
    # If you add NameVirtualHost *:443 here, you will also have to change
    # the VirtualHost statement in /etc/apache2/sites-available/default-ssl
    # to <VirtualHost *:443>
    # Server Name Indication for SSL named virtual hosts is currently not
    # supported by MSIE on Windows XP.
    Listen 443
</IfModule>

<IfModule mod_gnutls.c>
    Listen 443
</IfModule>

# If you just change the port or add more ports here, you will likely also

# have to change the VirtualHost statement in

# /etc/apache2/sites-enabled/000-default

# This is also true if you have upgraded from before 2.2.9-3 (i.e. from

# Debian etch). See /usr/share/doc/apache2.2-common/NEWS.Debian.gz and

# README.Debian.gz<br><br>NameVirtualHost *:443

#Listen 80

# If you add NameVirtualHost *:443 here, you will also have to change

# the VirtualHost statement in /etc/apache2/sites-available/default-ssl

# to <VirtualHost *:443>

# Server Name Indication for SSL named virtual hosts is currently not

# supported by MSIE on Windows XP.

Listen 443

</IfModule>

Listen 443

</IfModule>

Inhalt meiner /etc/apache2/config-default:

ServerAdmin server@my-hostname.de
ErrorLog /var/www/logs/error.log
LogLevel warn
CustomLog /var/www/logs/access.log combined

<Directory />
    AllowOverride All
    Options +FollowSymLinks -Indexes
</Directory>

ServerAdmin server@my-hostname.de

ErrorLog /var/www/logs/error.log

LogLevel warn

CustomLog /var/www/logs/access.log combined

AllowOverride All

Options +FollowSymLinks -Indexes

</Directory>

Inhalt meiner /etc/apache2/config-default-ssl:

Include /etc/apache2/config-default

SSLEngine on
SSLCertificateFile /etc/apache2/ssl/apache.pem
#SSLCertificateKeyFile /etc/apache2/ssl/apache.key

<FilesMatch ".(cgi|shtml|phtml|php)$">
    SSLOptions +StdEnvVars
</FilesMatch>

<Directory /usr/lib/cgi-bin>
    SSLOptions +StdEnvVars
</Directory>

BrowserMatch "MSIE [2-6]" 
    nokeepalive ssl-unclean-shutdown 
    downgrade-1.0 force-response-1.0
# MSIE 7 and newer should be able to use keepalive
BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown

Include /etc/apache2/config-default

SSLEngine on

SSLCertificateFile /etc/apache2/ssl/apache.pem

#SSLCertificateKeyFile /etc/apache2/ssl/apache.key

SSLOptions +StdEnvVars

</FilesMatch>

SSLOptions +StdEnvVars

</Directory>

BrowserMatch "MSIE [2-6]"

nokeepalive ssl-unclean-shutdown

downgrade-1.0 force-response-1.0

# MSIE 7 and newer should be able to use keepalive

BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown

Inhalt meiner /etc/apache2/sites-available/default:

<VirtualHost *:443>
        ServerName my-hostname.de
        ServerAlias my-hostname.de

        Include /etc/apache2/config-default-ssl

        DocumentRoot /var/www/htdocs
        <Directory />
                Options FollowSymLinks
                AllowOverride None
        </Directory>
        <Directory /var/www/htdocs>
                Options Indexes FollowSymLinks MultiViews
                AllowOverride None
                Order allow,deny
                allow from all
        </Directory>

        ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
        <Directory "/usr/lib/cgi-bin">
                AllowOverride None
                Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
                Order allow,deny
                Allow from all
        </Directory>

        ErrorLog ${APACHE_LOG_DIR}/error.log

        # Possible values include: debug, info, notice, warn, error, crit,
        # alert, emerg.
        LogLevel warn

        CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

ServerName my-hostname.de

ServerAlias my-hostname.de

Include /etc/apache2/config-default-ssl

DocumentRoot /var/www/htdocs

Options FollowSymLinks

AllowOverride None

</Directory>

Options Indexes FollowSymLinks MultiViews

AllowOverride None

Order allow,deny

allow from all

</Directory>

ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/

AllowOverride None

Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch

Order allow,deny

Allow from all

</Directory>

ErrorLog ${APACHE_LOG_DIR}/error.log

# Possible values include: debug, info, notice, warn, error, crit,

# alert, emerg.

LogLevel warn

CustomLog ${APACHE_LOG_DIR}/access.log combined

</VirtualHost>

Inhalt meiner /etc/apache2/sites-available/default-ssl:

<IfModule mod_ssl.c>
<VirtualHost *:443>
        Include /etc/apache2/config-default-ssl
</VirtualHost>
</IfModule>

Include /etc/apache2/config-default-ssl

</VirtualHost>

</IfModule>

Erstellung eines Test-Zertifikats

um die Funktionen des Webservers zu prüfen, würde ich erst einmal ein unsigniertes Testzertifikat erstellen. Das geht so:

mkdir /etc/apache2/ssl
/usr/sbin/make-ssl-cert /usr/share/ssl-cert/ssleay.cnf /etc/apache2/ssl/apache.pem

1 2	mkdir /etc/apache2/ssl /usr/sbin/make-ssl-cert /usr/share/ssl-cert/ssleay.cnf /etc/apache2/ssl/apache.pem

Bestellung des „GeoTrust RapidSSL Wildcard“-Zertifikats

Zertifikat beantragt als Apache 2 ohne CSR.

Änderungen an der /etc/apache2/config-default-ssl:

SSLEngine on
SSLCertificateFile /etc/apache2/ssl/my-hostname.crt
SSLCertificateKeyFile /etc/apache2/ssl/my-hostname.key

SSLEngine on

SSLCertificateFile /etc/apache2/ssl/my-hostname.crt

SSLCertificateKeyFile /etc/apache2/ssl/my-hostname.key

Schlussendlich noch den Apache neu starten:

/etc/init.d/apache2 restart

1	/etc/init.d/apache2 restart

Quellen

Google+

Syntax-Highlighting auf Blogger aktivieren

Debian updaten

Schreibe einen Kommentar Antworten abbrechen

Diese Website verwendet Akismet, um Spam zu reduzieren. Erfahre mehr darüber, wie deine Kommentardaten verarbeitet werden.