Configuring Apache HTTP Server

The GlassFish Loadbalancer Configurator automatically performs the necessary configurations for the Apache HTTP Server. The Loadbalancer Plug-In supports Apache HTTP Server 2.2.x.

You must compile Apache HTTP Server with SSL support if you plan on using the load balancer Auto Apply feature. SSL configuration must be performed on the web server prior to installing the Loadbalancer Plug-In. The Auto Apply feature enables changes made to a configuration through the GlassFish Server Administration Console or from the command line with the apply-http-lb-changes(1) subcommand to be automatically sent over the wire to the web server configuration directory. If you will not be using the load balancer Auto Apply feature, you can skip the SSL configuration portions of these procedures.

The following topics are addressed here:

• Configuring Apache Before Installing the GlassFish Loadbalancer Plug-In

• Configuring Apache After Installing the GlassFish Loadbalancer Plug-In

• Starting Apache on Solaris and Linux

Configuring Apache Before Installing the GlassFish Loadbalancer Plug-In

To use SSL mode in Apache, you must compile and build your Apache installation from the Apache source files with SSL enabled. This section describes the minimum requirements and high-level steps needed to successfully compile Apache HTTP Server to run the Loadbalancer Plug-In. These requirements and steps only apply to the Solaris and Linux versions of the software. The Windows version of Apache is not supported.

There are two tasks that you need to perform here to configure Apache with SSL support before installing the Loadbalancer Plug-In:

• To Build and Install Apache With SSL Support

• To Create a Security Certificate for Apache

To Build and Install Apache With SSL Support

The procedure explains how to download OpenSSL and Apache HTTP Server 2.2.x software, and then how to build Apache HTTP Server with SSL support.

1. Download and unpack the OpenSSL software source files.

   • OpenSSL software for Windows and Linux is available from http://www.openssl.org/source/.

   • OpenSSL for Solaris is available from http://www.sunfreeware.com/.

   Note that 32–bit OpenSSL is needed when running 32–bit Apache HTTP server.

2. Compile and build OpenSSL.

   For full installation instructions, see the file named INSTALL in the directory where you uncompressed OpenSSL. That file has information on installing OpenSSL in a user-specified location.

   For more information about OpenSSL, see the OpenSSL Web site.

3. Download and unpack Apache HTTP Server 2.2.x software.

   Apache is available from http://httpd.apache.org.

4. Compile and build Apache.

   Be sure to enter the entire “./configure ...” command on a single line.

   • For 32–bit:

     cd http-2.2_x
     export CFLAGS="-m32"
     ./configure --with-mpm=worker --with-included-apr --with-ssl=open-ssl-install-path 
     --prefix=apache-install-path --enable-ssl --enable-so

   • For 64–bit:

     cd http-2.2_x
     export CFLAGS="-m64"
     export LDFLAGS="-m64"
     export LD_LIBRARY_PATH=/usr/lib/64:/usr/sfw/lib/64
     ./configure --with-mpm=worker --with-included-apr --with-ssl=open-ssl-install-path 
     --prefix=apache-install-path --enable-ssl --enable-so
     CC=/usr/dist/share/sunstudio_sparc/SUNWspro/bin/cc

   In the above commands:

   http-2.2_x

   Apache package name including version number; replace x with the actual dot release number of the package you are using

   --with-mpm=worker

   Enable multithreading support

   --with-included-apr

   Also build the Apache Portable Runtime (APR)

   --with-ssl open-ssl-install-path

   Full path to the directory in which OpenSSL is installed

   --prefix apache-install-path

   Full path the directory in which Apache will be built

   --enable-ssl

   Enable support for SSL/TLS

   --enable-so

   Enable Dynamic Shared Object (DSO) module capability

   Note that you only need to use the --enable-ssl, --enable-so, and --with-ssl options if your Apache server will be accepting HTTPS requests or using the Auto Apply feature.

5. Compile Apache as described in the installation instructions for the version you are using.

   For more information, see the Apache Web site.

   In general, the steps are:

   1. make
   2. make install
6. Proceed with the instructions in To Create a Security Certificate for Apache .

To Create a Security Certificate for Apache

These steps are required to support HTTPS requests and the Auto Apply feature on the Apache HTTP Server.

For detailed information on setting up a security certificate on Apache, see the instructions on http://httpd.apache.org/docs/2.2/ssl/ssl_faq.html and http://www.modssl.org/docs/2.8/ssl_faq.html. The following procedure is adapted from those web sites.

1. Set up the following environment variable:

   OPENSSL_CONF=open-ssl-installation-directory/apps/openssl.cnf.

2. Create the server certificate and key by executing the following command:

   openssl req -new -x509 -keyout newreq.pem -out newreq.pem -days 365

   When asked for a common name, give the host name on which you plan to run Apache. For all other prompts, enter values that meet any specific requirements you have.

   This command creates newreq.pem.

3. Open the newly-created newreq.pem from the location where the openssl command was run.
4. Copy the lines beginning with BEGIN CERTIFICATE and ending with END CERTIFICATE and paste them in apache-install-dir/conf/server.crt.

   For example:

   -----BEGIN CERTIFICATE-----
   ....
   ...
   -----END CERTIFICATE-----

5. Copy the lines beginning with BEGIN RSA PRIVATE KEY and END RSA PRIVATE KEY and paste them in apache-install-dir/conf/server.key.

   For example:

   -----BEGIN RSA PRIVATE KEY-----
   ...
   ...
   ...
   -----END RSA PRIVATE KEY-----

6. Make sure that the variables SSLCertificateKeyFile and SSLCertificateFile in apache-install-dir/conf/extra/httpd-ssl.conf have the correct values.
7. Ensure that the ServerName is not www.example.com.

   The ServerName should be the actual host name where Apache will run, matching the Common Name you entered when creating the server certificate and key.

8. Proceed with the instructions in Installing the Loadbalancer Plug-In.
9. After installing the Loadbalancer Plug-In, proceed with the instructions in Configuring Apache After Installing the GlassFish Loadbalancer Plug-In.

Configuring Apache After Installing the GlassFish Loadbalancer Plug-In

This section explains the additional Apache HTTP Server configuration steps that are required after you install the GlassFish Loadbalancer Plug-In.

The following topics are addressed here:

• Configuring Security Files to Work With the Load Balancer

• Providing Access Permissions to Apache User

• Loadbalancer Plug-In Initialization

• Modifying Directory Access Permissions to Enable Auto Apply

Configuring Security Files to Work With the Load Balancer

The Loadbalancer Plug-In requires access to NSS libraries. To enable this access, append the name of the directory that contains the NSS libraries to the LD_LIBRARY_PATH in the apache-install-dir/bin/envvars file. On most UNIX platforms, the NSS libraries are located in the /usr/lib/mps directory.

You may also need to add the following lines to the apache-install-dir/bin/envvars file if GlassFish Server reports that the HTTPS listeners are not healthy.

NSS_STRICT_NOFORK=DISABLED
export NSS_STRICT_NOFORK

These lines may be required because the latest NSS libraries do not allow NSS forking. Adding these lines enables NSS forking.

Providing Access Permissions to Apache User

Ensure that the Apache user has the required access permissions to the apache-install-location/conf/ directory and files in this directory. The Apache user is the UNIX user under which the Apache server responds to requests. This user is defined in the file httpd.conf. If you installed Apache as a root user, read the note about configuring the Apache user and group in apache-install-location/conf/httpd.conf.

Loadbalancer Plug-In Initialization

To ensure that the Loadbalancer Plug-In is initialized when Apache is started, grant the Apache user read access and write access to the following files:

• apache-install-location/conf/loadbalancer.xml

• apache-install-location/conf/sun-loadbalancer_1_2.dtd

Modifying Directory Access Permissions to Enable Auto Apply

To ensure that the Auto Apply feature operates correctly, grant the Apache user read access, write access, and execute access to the apache-install-location/conf/ directory.

If the Apache user is in the same group as the owner of this directory, change the mode to 775.

See Auto Apply for more information about this feature.

Starting Apache on Solaris and Linux

In general, you should start Apache with the same user ID that was used when installing GlassFish Server. You must start Apache as root under the following circumstances:

• If you are using port numbers below 1024

• If Apache runs as a different user than the user that starts GlassFish Server

Use the following command to start Apache 2.2.x:

apachectl start

If necessary, check the Apache web site for the latest information on starting the Apache server.