Apache with mod_ssl, Building and Configuration

NOTE: OpenSSL understands a lot more options on the `config' command line. For instance you can add some command line options (like `-DSSL_FORBID_ENULL' for not allowing Null encryptions, or adding `-DSSL_ALLOW_ADH' for allowing Anonymous Diffie-Hellman ciphers, etc) to adjust the OpenSSL internals (see OpenSSL's top-level Makefile for details).

NOTE: When your system already has OpenSSL installed (for instance some Linux distributions ship with OpenSSL installed out-of-the-box) in system locations you can ignore the OpenSSL steps above, too. Then use `SSL_BASE=SYSTEM' instead of `SSL_BASE=../openssl-0.9.x' and mod_ssl will search for OpenSSL's binary, header and library files in $PATH and system locations.

NOTE: The -fPIC option builds OpenSSL with Position Independent Code (PIC) which is only important when building mod_ssl as a Dynamic Shared Object (DSO).

NOTE: The optional `no-threads' keyword above is to increase performance inside OpenSSL, because Apache 1.3 does not use threads anyway. However, OpenSSL, if built without `no-threads', by default builds with multi-threading support. This multi-threading support involves using locking around a lot of internal object manipulation (esp. reference counts). The fact that it is not possible in Apache 1.3 to have threads racing on any kind of object internal to OpenSSL means that any overhead (memory and/or time) relating to these locking mechanisms is wasted by default.

Building the MM shared memory Library

Optionally you now can build the MM Shared Memory library when you want shared memory support in Apache/EAPI. For instance this allows mod_ssl to use a high-performance RAM-based session cache instead of a disk-based one.

• $ tar xvzf mm-1.3.0.tar.gz

• $ cd mm-1.3.0

• $ ./configure --disable-shared

• $ make

• $ cd ..

NOTE: When your system already has MM installed in system locations you can ignore the steps above and then use `EAPI_MM=SYSTEM' instead of `EAPI_MM=../mm-1.1.x' below.

NOTE: Do not forget the --disable-shared option above. Else you've to establish an explicit LD_LIBRARY_PATH which includes the /path/to/mm-1.1.x/.libs/ directory or the compilation of Apache will fail because the shared library cannot be found.

Building Apache with mod_ssl.

Now apply the mod_ssl source extension and source patches to the Apache source tree, configure the Apache sources and build Apache with mod_ssl and OpenSSL.

• $ cd mod_ssl-2.8.14-1.3.27

• $ ./configure --with-apache=../apache_1.3.27 --with-ssl=../openssl-0.9.6j --with-mm=../mm-1.3.0 --prefix=/usr/local/apache

• $ cd ..

• $ cd apache_1.3.27

• $ make

• $ make certificate TYPE=custom

• $ make install

• $ cd ..

You can now test whether your installation has been sucessfull by running

/usr/local/apache/bin/apachectl startssl

and then firing up your browser and going to https://pcname.t1.ws.afnog.org where pcname is the hostname of your workstation. using ssl means you're running two virtual servers

• one on port 80 (the regular server)

• one on port 443 (the ssl server)