Installing SSL Support for an OpenACS service

Prev	Chapter�6.�Production Environments	Next

Debian Users: apt-get install openssl before proceeding.

Make sure nsopenssl.so is installed for AOLserver.

Uncomment this line from config.tcl.

#ns_param   nsopenssl       ${bindir}/nsopenssl.so
+Installing SSL Support for an OpenACS servicePrev Chapter�6.�Production Environments  Next
Installing SSL Support for an OpenACS service
Debian Users: apt-get install openssl before proceeding.
Make sure nsopenssl.so is installed for AOLserver.
Uncomment this line from config.tcl.
#ns_param   nsopenssl       ${bindir}/nsopenssl.so
 
Prepare a certificate directory for the service.
[$OPENACS_SERVICE_NAME etc]$ mkdir /var/lib/aolserver/$OPENACS_SERVICE_NAME/etc/certs
 [$OPENACS_SERVICE_NAME etc]$ chmod 700 /var/lib/aolserver/$OPENACS_SERVICE_NAME/etc/certs
 [$OPENACS_SERVICE_NAME etc]$ 
 mkdir /var/lib/aolserver/$OPENACS_SERVICE_NAME/etc/certs
-chmod 700 /var/lib/aolserver/$OPENACS_SERVICE_NAME/etc/certs
It takes two files to support an SSL connection.  The certificate is the public half of the key pair - the server sends the certificate to browser requesting ssl.  The key is the private half of the key pair.  In addition, the certificate must be signed by Certificate Authority or browsers will protest.  Each web browser ships with a built-in list of acceptable Certificate Authorities (CAs) and their keys.  Only a site certificate signed by a known and approved CA will work smoothly.  Any other certificate will cause browsers to produce some messages or block the site.  Unfortunately, getting a site certificate signed by a CA costs money.  In this section, we'll generate an unsigned certificate which will work in most browsers, albeit with pop-up messages.
Use an OpenSSL perl script to generate a certificate and key.
[$OPENACS_SERVICE_NAME $OPENACS_SERVICE_NAME]$ cd /var/lib/aolserver/$OPENACS_SERVICE_NAME/etc/certs
+chmod 700 /var/lib/aolserver/$OPENACS_SERVICE_NAME/etc/certs
It takes two files to support an SSL connection.  The certificate is the public half of the key pair - the server sends the certificate to browser requesting ssl.  The key is the private half of the key pair.  In addition, the certificate must be signed by Certificate Authority or browsers will protest.  Each web browser ships with a built-in list of acceptable Certificate Authorities (CAs) and their keys.  Only a site certificate signed by a known and approved CA will work smoothly.  Any other certificate will cause browsers to produce some messages or block the site.  Unfortunately, getting a site certificate signed by a CA costs money.  In this section, we'll generate an unsigned certificate which will work in most browsers, albeit with pop-up messages.
Use an OpenSSL perl script to generate a certificate and key.

+          Debian users: use /usr/lib/ssl/misc/CA.pl instead of /usr/share/ssl/CA
+        
[$OPENACS_SERVICE_NAME $OPENACS_SERVICE_NAME]$ cd /var/lib/aolserver/$OPENACS_SERVICE_NAME/etc/certs
 [$OPENACS_SERVICE_NAME certs]$ perl /usr/share/ssl/misc/CA -newcert
 Using configuration from /usr/share/ssl/openssl.cnf
 Generating a 1024 bit RSA private key
@@ -22,4 +24,8 @@
 S/Sd2MYA0JVmQuIt5bYowXR1KYKDka1d3DUgtoVTiFepIRUrMkZlCli08mWVjE6T
 (11 lines omitted)
 1MU24SHLgdTfDJprEdxZOnxajnbxL420xNVc5RRXlJA8Xxhx/HBKTw==
------END RSA PRIVATE KEY-----
Prev Home  Next
Staged Deployment for Production Networks Up  Set up Log Analysis Reports
docs@openacs.org
View comments on this page at openacs.org
+-----END RSA PRIVATE KEY-----

+ If you start up using the etc/daemontools/run script, you will + need to edit this script to make sure the ports are bound for + SSL. Details of this are in the run script. +

Prev	Home	Next
Staged Deployment for Production Networks	Up	Set up Log Analysis Reports