Index: openacs-4/packages/acs-core-docs/www/install-ssl.html =================================================================== RCS file: /usr/local/cvsroot/openacs-4/packages/acs-core-docs/www/install-ssl.html,v diff -u -r1.7 -r1.7.2.1 --- openacs-4/packages/acs-core-docs/www/install-ssl.html 16 Feb 2005 00:21:03 -0000 1.7 +++ openacs-4/packages/acs-core-docs/www/install-ssl.html 26 Aug 2005 00:02:30 -0000 1.7.2.1 @@ -1,24 +1,26 @@ -Installing SSL Support for an OpenACS service
Alex logo
Prev Chapter�6.�Production Environments Next

Installing SSL Support for an OpenACS service

Debian Users: apt-get install openssl before proceeding.

  1. Make sure nsopenssl.so is installed for AOLserver.

  2. Uncomment this line from config.tcl.

    #ns_param   nsopenssl       ${bindir}/nsopenssl.so
-

  3. Prepare a certificate directory for the service.

    [$OPENACS_SERVICE_NAME etc]$ mkdir /var/lib/aolserver/$OPENACS_SERVICE_NAME/etc/certs
-[$OPENACS_SERVICE_NAME etc]$ chmod 700 /var/lib/aolserver/$OPENACS_SERVICE_NAME/etc/certs
+Installing SSL Support for an OpenACS service
    Alex logo
    Prev Chapter�6.�Production Environments Next
    Installing SSL Support for an OpenACS service
    Debian Users: apt-get install openssl before proceeding.
    1. Make sure nsopenssl.so is installed for AOLserver.
    2. Uncomment this line from config.tcl.
      #ns_param   nsopenssl       ${bindir}/nsopenssl.so
+
    3. Prepare a certificate directory for the service.
      [$OPENACS_SERVICE_NAME etc]$ mkdir /var/lib/aolserver/$OPENACS_SERVICE_NAME/etc/certs
+[$OPENACS_SERVICE_NAME etc]$ chmod 700 /var/lib/aolserver/$OPENACS_SERVICE_NAME/etc/certs
 [$OPENACS_SERVICE_NAME etc]$ 
 mkdir /var/lib/aolserver/$OPENACS_SERVICE_NAME/etc/certs
 chmod 700 /var/lib/aolserver/$OPENACS_SERVICE_NAME/etc/certs
    4. It takes two files to support an SSL connection.  The certificate is the public half of the key pair - the server sends the certificate to browser requesting ssl.  The key is the private half of the key pair.  In addition, the certificate must be signed by Certificate Authority or browsers will protest.  Each web browser ships with a built-in list of acceptable Certificate Authorities (CAs) and their keys.  Only a site certificate signed by a known and approved CA will work smoothly.  Any other certificate will cause browsers to produce some messages or block the site.  Unfortunately, getting a site certificate signed by a CA costs money.  In this section, we'll generate an unsigned certificate which will work in most browsers, albeit with pop-up messages.
      Use an OpenSSL perl script to generate a certificate and key.
      
           Debian users: use /usr/lib/ssl/misc/CA.pl instead of /usr/share/ssl/CA
-        
      [$OPENACS_SERVICE_NAME $OPENACS_SERVICE_NAME]$ cd /var/lib/aolserver/$OPENACS_SERVICE_NAME/etc/certs
-[$OPENACS_SERVICE_NAME certs]$ perl /usr/share/ssl/misc/CA -newcert
+        
      
+          Mac OS X users: use perl /System/Library/OpenSSL/misc/CA.pl -newcert instead of /usr/share/ssl/CA
+        
      [$OPENACS_SERVICE_NAME $OPENACS_SERVICE_NAME]$ cd /var/lib/aolserver/$OPENACS_SERVICE_NAME/etc/certs
+[$OPENACS_SERVICE_NAME certs]$ perl /usr/share/ssl/misc/CA -newcert
 Using configuration from /usr/share/ssl/openssl.cnf
 Generating a 1024 bit RSA private key
 ...++++++
 .......++++++
 writing new private key to 'newreq.pem'
 Enter PEM pass phrase:
      Enter a pass phrase for the CA certificate.  Then, answer the rest of the questions.  At the end you should see this:
      Certificate (and private key) is in newreq.pem
-[$OPENACS_SERVICE_NAME certs]$
      newreq.pem contains our certificate and private key.  The key is protected by a passphrase, which means that we'll have to enter the pass phrase each time the server starts.  This is impractical and unnecessary, so we create an unprotected version of the key.  Security implication: if anyone gets access to the file keyfile.pem, they effectively own the key as much as you do.  Mitigation: don't use this key/cert combo for anything besides providing ssl for the web site.
      [root misc]# openssl rsa -in newreq.pem -out keyfile.pem
+[$OPENACS_SERVICE_NAME certs]$
      newreq.pem contains our certificate and private key.  The key is protected by a passphrase, which means that we'll have to enter the pass phrase each time the server starts.  This is impractical and unnecessary, so we create an unprotected version of the key.  Security implication: if anyone gets access to the file keyfile.pem, they effectively own the key as much as you do.  Mitigation: don't use this key/cert combo for anything besides providing ssl for the web site.
      [root misc]# openssl rsa -in newreq.pem -out keyfile.pem
 read RSA key
 Enter PEM pass phrase:
 writing RSA key
-[$OPENACS_SERVICE_NAME certs]$ 
      To create the certificate file, we take the combined file, copy it, and strip out the key.
      [$OPENACS_SERVICE_NAME certs]$ cp newreq.pem certfile.pem
-[root misc]# emacs certfile.pem
      Strip out the section that looks like
      -----BEGIN RSA PRIVATE KEY-----
+[$OPENACS_SERVICE_NAME certs]$ 
      To create the certificate file, we take the combined file, copy it, and strip out the key.
      [$OPENACS_SERVICE_NAME certs]$ cp newreq.pem certfile.pem
+[root misc]# emacs certfile.pem
      Strip out the section that looks like
      -----BEGIN RSA PRIVATE KEY-----
 Proc-Type: 4,ENCRYPTED
 DEK-Info: DES-EDE3-CBC,F3EDE7CA1B404997
 S/Sd2MYA0JVmQuIt5bYowXR1KYKDka1d3DUgtoVTiFepIRUrMkZlCli08mWVjE6T