| Prev | Chapter�6.�Production Environments | Next |
|---|
Debian Users: apt-get install openssl before proceeding.
Make sure nsopenssl.so is installed for AOLserver.
Uncomment this line from config.tcl.
#ns_param nsopenssl ${bindir}/nsopenssl.so
+
+Installing SSL Support for an OpenACS service Debian Users: apt-get install openssl before proceeding.
Make sure nsopenssl.so is installed for AOLserver.
Uncomment this line from config.tcl.
#ns_param nsopenssl ${bindir}/nsopenssl.so
Prepare a certificate directory for the service.
[$OPENACS_SERVICE_NAME etc]$ mkdir /var/lib/aolserver/$OPENACS_SERVICE_NAME/etc/certs
[$OPENACS_SERVICE_NAME etc]$ chmod 700 /var/lib/aolserver/$OPENACS_SERVICE_NAME/etc/certs
[$OPENACS_SERVICE_NAME etc]$
mkdir /var/lib/aolserver/$OPENACS_SERVICE_NAME/etc/certs
chmod 700 /var/lib/aolserver/$OPENACS_SERVICE_NAME/etc/certs
It takes two files to support an SSL connection. The certificate is the public half of the key pair - the server sends the certificate to browser requesting ssl. The key is the private half of the key pair. In addition, the certificate must be signed by Certificate Authority or browsers will protest. Each web browser ships with a built-in list of acceptable Certificate Authorities (CAs) and their keys. Only a site certificate signed by a known and approved CA will work smoothly. Any other certificate will cause browsers to produce some messages or block the site. Unfortunately, getting a site certificate signed by a CA costs money. In this section, we'll generate an unsigned certificate which will work in most browsers, albeit with pop-up messages.
Use an OpenSSL perl script to generate a certificate and key.
Debian users: use /usr/lib/ssl/misc/CA.pl instead of /usr/share/ssl/CA
+
+ Mac OS X users: use perl /System/Library/OpenSSL/misc/CA.pl -newcert instead of /usr/share/ssl/CA
[$OPENACS_SERVICE_NAME $OPENACS_SERVICE_NAME]$ cd /var/lib/aolserver/$OPENACS_SERVICE_NAME/etc/certs
[$OPENACS_SERVICE_NAME certs]$ perl /usr/share/ssl/misc/CA -newcert
Using configuration from /usr/share/ssl/openssl.cnf