Debian Squeeze, Apache with gnu_tls, SNI, Serendipity, no-www

As Debian Squeeze does not include OpenSSL 1.0, we need gnu_tls to get SNI working with Apache2.

apt-get install libapache2-mod-gnutls
a2dismod ssl
a2enmod gnutls

 

The last line automatically adds

>IfModule mod_gnutls.c<
    Listen 443
>/IfModule<

to /etc/apache2/ports.conf so we don’t have to do that manually.

Generate the CertificateFile and the KeyFile (self signed):

• Generate a Private Key
  openssl genrsa -des3 -out emp_server.key 1024
• Generate a CSR (Certificate Signing Request)
  openssl req -new -key emp_server.key -out emp_server.csr
• Remove Passphrase from Key
  cp emp_server.key emp_server.key.orig
  openssl rsa -in emp_server.key.orig -out emp_server.key
• Generating a Self-Signed Certificate
  openssl x509 -req -days 1500 -in emp_server.csr -signkey emp_server.key -out emp_server.crt

Now add those files (and add permanent redirect from http to https) to the domain config in /etc/apache2/site-available/example.com:

<VirtualHost *:80>
...
    Redirect permanent /    https://example.com
...
<VirtualHost *:443>
    ServerName example.com:443
    ServerAlias www.example.com:443
    DocumentRoot /var/example.com/serendipity
...
    # Enable/Disable SSL for this virtual host.
    GnuTLSEnable on
    GnuTLSCertificateFile /etc/ssl/private/emp_server.crt
    GnuTLSKeyFile /etc//ssl/private/emp_server.key
    GnuTLSPriorities NORMAL
</VirtualHost>

 

Don’t forget to open your Firewall on port 443 for SSL/TLS to work (and that’s TCP, not UDP ;).

To get Serendipity to redirect all www.example.com request to example.com (no-www) add the following to yur /var/example.com/serendipity/.htaccess file:

# http://no-www.org/ - Make your site Class B
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^(.*)$ http://%1/$1 [R=301,L]

 

Restart Apache and you are done.

Sources:

• Hosting Multiple SSL Web Sites On One IP Address With Apache 2.2 And GnuTLS (Debian Lenny)
• How to create a self-signed SSL Certificate

Tagged as: apache, debian, gnu_tls, openssl, sni, squeeze | Author: Martin Leyrer
[Sonntag, 20120415, 17:31 | permanent link | 0 Kommentar(e)