C H A P T E R 6 |
Installing and Configuring Apache Web Server Software |
This chapter describes how to install and configure Apache Web Servers to use the board and includes the following sections:
The following are the software requirements to configure Apache Web Server to use the board:
Once the SUNWkcl2a package is added, the system is configured with Apache Web Server and mod_ssl 1.3.26.
Note - Apache Web Servers do not use the keystore or user account features described in Chapter 5 Concepts and Terminology. |
![]() |
Caution - Do not configure Apache Web Server for use with the Sun Crypto Accelerator 1000 board and the Sun Crypto Accelerator 4000 board at the same time. Apache will not work correctly. |
Note - The bulk encryption feature for Apache software is enabled by default and cannot be disabled. |
This section describes how to use the apsslcfg script to configure the web server to use the board. This section also describes how to create and install a server certificate.
1. Create an httpd configuration file if you have not already created one.
For Solaris systems, the httpd.conf-example file is usually in the /etc/apache directory. You can use this file as a template and copy it as follows:
2. Replace ServerName with your server name in the httpd.conf file.
4. Select 1 to configure your Apache Web Server to use SSL.
Note - This procedure assumes that you choose option 1 at this prompt. If you want to choose option 2, refer to Using the apsslcfg Script. |
5. Type the path of the Apache binaries.
On Solaris systems, this path is typically /usr/apache.
6. Type the path for the Apache configuration files.
On Solaris systems, this path is typically /etc/apache.
7. Create a remote security access (RSA) keypair for your system.
If you choose not to create a keypair, you must later use apsslcfg to generate one.
If you answer no to this question, skip to To Generate a Server Certificate.
8. Provide the directory for storing the keys.
If this directory does not exist, it is created.
9. Choose a base name for the key material.
This name is appended with different suffixes to distinguish key files, certificate request files, and certificate files from each other.
10. Provide a key length between 512 and 2048 bits.
For most web server applications, 1024 bits is sufficiently strong, but you can choose stronger keys if preferred.
11. Create your PEM pass phrase.
This pass phrase protects the key material. Be sure to select a strong pass phrase, but one that you can remember. If you forget the pass phrase, you will be unable to access your keys.
![]() |
Caution - You must remember the pass phrase you enter. Without the pass phrase, you cannot access your keys. There is no way to retrieve a lost pass phrase. |
1. Create a certificate request using the keys you created in Step 7 of To Configure Apache Web Server.
a. Type the password to access your keys. Then type the appropriate information for the requestor information fields.
TABLE 6-1 provides a description of the requestor information fields.
Two-letter ISO code for the country (for example, the United States is US) |
|
(Optional) Full name of the state, or you may enter a dot (.) |
|
2. Modify the /etc/apache/httpd.conf file as directed.
Information regarding your key and certificate files, and instructions for how to modify the /etc/apache/httpd.conf file appears.
Note - The correct version-number will be displayed for your configuration. |
3. If you chose not to set up a VirtualHost, you must place the SSLEngine, SSLCertificateFile, and SSLCertificateKeyFile directives in the httpd.conf file just above the SSLPassPhraseDialog directive.
If you answered no to the question in Step 7 of Configuring Apache Web Server 2.x, you are given additional information on how to generate key material.
4. Type 0 to quit when you finish with apsslcfg.
1. Copy your certificate request with the headers from the /etc/apache/keys/base-name-certreq.pem file (where base-name was set in Step 9 of To Configure Apache Web Server), and transfer the certificate request to your certificate authority.
2. Once the certificate is generated, create the certificate file /etc/apache/keys/base-name-cert.pem and paste your certificate into the file.
3. Start the Apache Web Server.
The following path assumes your Apache binary directory is /usr/apache/bin. If this is not your binary directory, type the correct path.
4. Enter your PEM pass phrase when prompted.
5. Verify the new SSL-enabled web server with a browser at the following URL: https://server-name:server-port/
Note that the default server-port is 443.
Note - Refer to the mod_SSL and OpenSSL documentation for information on how to self-sign a certificate for testing. |
The Sun Crypto Accelerator 4000 software does not include a mod_ssl library for Apache 2.x Web Servers. This section describes the options you need to include when building the web server, and describes how to configure Apache 2.x to use the board.
To start this process, your OpenSSL implementation must have all of the required patches. This section covers only the board specific options, and is not an exhaustive set of instructions to build the entire Apache 2.x suite. For complete instructions, refer to the documentation available at http://www.apache.org.
1. Preset the SH_LIBS environment variable to comply with the configure script.
2. Change to the installation directory and execute the configure script.
This script has many command-line options, the following are required to configure the web server to use the board:
3. Once the script has finished, do one of the following:
a. If you are building and installing Apache 2.x for the first time, type the following.
b. If you wish to build the mod_ssl shared library for an existing Apache 2.x Web Server, type the following:
This section describes how to configure the web server to use the board by generating and installing a server certificate and enabling the web server for SSL.
1. Generate a key and certificate request.
2. Type the password to protect the key file.
3. Type the "Distinguished Name" values (See TABLE 6-2).
Two-letter ISO code for the country (for example, the United States is US) |
|
(Optional) Full name of the state, or you may enter a dot (.) |
|
Copy your certificate request with the headers into the same directory where your key file was created in Step 1 of To Generate a Server Certificate.
1. Edit the ssl.conf file in the conf subdirectory of the Apache 2.x Web Server installation directory.
There are several directives in the ssl.conf file; the following directives must be configured for the web server to use the board.
Listen port-number ServerName fully-qualified-domain-name SSLEngine on SSLCertificateFile path-to-certificate-file SSLCertificateKeyFile path-to-key-file |
2. Start the Apache Web Server.
This assumes your Apache binary directory is /usr/apache/bin. If this is not your binary directory, type the correct directory.
3. Enter your PEM pass phrase when prompted for it.
4. Verify the new SSL-enabled web server with a browser by going to the following URL:
https://server-name:server-port/
The default server-port is 443.
Note - Refer to the mod_SSL and OpenSSL documentation for information on how to self-sign a certificate for testing. |
You can enable the Apache Web Server to perform an unattended startup at reboot with an encrypted key.
|
1. Verify that the following entry exists in the httpd.conf file:
This directive retrieves a password from a protected password file in the /etc/apache directory.
2. Create a password file that contains only the password in the /etc/apache directory with the following filename convention:
Example: For a server named webserv101 running SSL on port 443 with an RSA key, create the following file in /etc/apache:
Change the permissions and ownership of the password file as follows:
Refer to the mod_SSL and OpenSSL documentation for more information.
Once the SUNWkcl2a software package is installed, the system is configured with Apache Web Server mod_ssl 1.3.26.
If you want to configure the Sun Crypto Accelerator 1000 board with Apache, you must have the following patches.
To configure the Sun Crypto Accelerator 1000 for use with Apache 1.3.26 on a Solaris 8 system with the SUNWkcl2a package installed, you need the following patches:
To configure the Sun Crypto Accelerator 1000 for use with Apache 1.3.26 on a Solaris 9 system with the SUNWkcl2a package installed, you need the following patches:
Copyright © 2004, Sun Microsystems, Inc. All rights reserved.