30

I have an EC2 instance that is using Amazon's custom linux install with built in apache. This install also has openssl installed. That being said, there does not appear to be a mod_ssl.so to load up in httpd.conf.

So, I want to know the best way to get apache to be ssl enabled so I can setup my SSL virtual host (note that I have already setup the cert/signatures). Ideally, I would like to not have to rebuild/reinstall apache.

6 Answers 6

34

Try this command:

 yum install mod_ssl 
5
  • 12
    Cheers. For Apache 2.4 users: I had to use yum install mod24_ssl. Dec 1, 2014 at 11:21
  • 4
    yes, yum install mod24_ssl worked fine on my amazon ec2 server. Jul 3, 2015 at 5:11
  • 2
    could someone please explain why everyone always posts yum without sudo? it never works without sudo, so why don't you write it?
    – Anthony
    Feb 4, 2016 at 15:33
  • @Anthony you simply run sudo su command first to switch to the root user, then you can run yum without sudo
    – hakJav
    Jan 21, 2021 at 16:52
  • that's not the answer to my question. it was mostly rhetorical and what you said is not a valid workaround in terms of explanations. it is literally the answer, but not in the way i'm suggesting. new users won't understand to do that and linux essentially doesn't work without sudo, so it should be written all the time.
    – Anthony
    Jan 22, 2021 at 17:08
27

A summary of what needs to be done to enable SSL on apache server on EC2:

  1. Get SSL certificate (which you already did)
  2. Install mod_ssl as Jose Vega said
  3. Add the following lines to your httpd.conf 3.
NameVirtualHost *:443

<VirtualHost *:443>
    ServerName www.example.com
#    other configurations
SSLEngine on
SSLCertificateFile /etc/httpd/conf/ssl.crt/mydomain.crt
SSLCertificateKeyFile /etc/httpd/conf/ssl.key/mydomain.key
</VirtualHost>

Finally, don't forget to open port 443 on your EC2 instance

2
  • 3
    I wasted few hours trying to find out why I can't access my site with SSL and only to notice that I forget to open port 443 in my security group! If not because of your reminder I could have spent another few hours trying to debug this.
    – Stanley
    Sep 30, 2013 at 15:42
  • Absolutely great! Worth to mention that default directory for .crt and .key file on EC2 server /etc/pki/tls/private/ Aug 11, 2016 at 10:07
12

I managed to enable SSL on my ec2 instance and to install a free ssl certificate from startssl.com. I made a few mistakes, this is the basic approach:

  1. Signup to startssl.com by clicking Control Panel link
    • Complete the signup process. You will need to verify your email address.
  2. Validate your domain under Validation Wizard -> Domain Name Validation
  3. Get a Certificate by Certificate Wizard
    • Choose: Web Server SSL/TLS Certificate
    • Enter a password that will be used to encrypt the private key. You will need this later.
    • I chose keysize of 4096
    • Save the encrypted private key as ssl.encrypted.key someplace
    • ?? I forget what happened next
    • Save the certificate file as ssl.crt someplace. For me I had to wait 30 minute then it appeared under Tool Box -> Retrive Certificate
  4. Use openssl to decrypt the encrypted ssl.encrypted.key file
    • sudo openssl rsa -in ssl.encrypted.key -out ssl.unencrpted.key
    • startssl.com also have a decrypt option on their website, but it didn't work for me
  5. putty/ssh onto your ec2 machine
  6. install mod_ssl
    • sudo yum install mod_ssl
  7. Replace the default certificate and key
    • sudo vi /etc/pki/tls/certs/localhost.crt
    • Paste in the contents of ssl.crt
    • Make sure it pastes correctly! I always lose the first 6 characters
    • Use :%d to delete the existing certificate if required
    • [ESC] wq
    • sudo vi /etc/pki/tls/private/localhost.key
    • Paste in the contents of ssl.unencrypted.key
    • Again make sure it pastes correctly!
    • [ESC] wq
  8. Check the configuration
    • apachectl configtest
  9. Restart
    • sudo service httpd restart
    • I had issues restarting and I think what fixed it was sudo kill -9 httpd
1
  • I've done all these steps - sudo vi /etc/pki/tls/certs/localhost.crt caused problems for me. Replacing its contents with the contents of my ssl.crt file causes problems. Httpd wouldn't start because of it - apachectl configtest said Syntax OK but httpd still wouldn't start. Restoring the file fixed httpd so that was definitely the source. Any ideas?
    – Max Hudson
    Sep 30, 2015 at 22:02
8

You should install the SSL module, since mod SSL does not ship with most instances by default, but that depends on the Apache version you are using in your AWS instance. To check which one you are using, you can run this command in your command line:

httpd -v

For Apache 2.2

yum install mod_ssl

For Apache 2.4

yum install mod24_ssl
0

If you are using Amazon Lightsail, be sure to go into Networking from the Lightsail dashboard and add HTTPS/443 in your Firewall:

enter image description here

0

Here's what worked for me, via shell, with a wildcard cert that had a CA bundle (on Lightsail servers, HTTPS/443 enabled). Mileage may vary. Test on https://www.digicert.com/help/ after install. For brevity, I've shortened the certs/keys here (obviously).

It's worth noting also that I did not need to set up a VirtualHost for the domain.

# Overwrite these files on Amazon Linux + mod_ssl (or mod24_ssl)
# /etc/pki/tls/certs/ca-bundle.crt
# /etc/pki/tls/certs/localhost.crt
# /etc/pki/tls/private/localhost.key

## BEGIN

# INSTALL AS ROOT
sudo -su root

sudo cat > /etc/pki/tls/certs/localhost.crt <<EOF
-----BEGIN CERTIFICATE-----
MIIF7DCCBNSgAwIBAgIMNY9yk7s651tb2YasMA0GCSqGSIb3DQEBCwUAMEwxCzAJ
KoZIhvcNAQELBQADggEBACu8MsClqLbO1NqjXw+igERhLRkISgnkIjB1p69zh3V0
/3b68mkC+8pL3HNLgL0qIM9sPKKOl/Iyky2EfwfQDoZEWNB0qWKIOovH5Oj9z5DE
-----END CERTIFICATE-----
EOF

sudo cat > /etc/pki/tls/private/localhost.key <<EOF
-----BEGIN PRIVATE KEY-----
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCL6UsW9yC0Faev
1zeEJcF6E7P6XYqT25rWMj5xzUM8gi/4nLpGr+tOBlFJYSbLlEHJKG6QLO9Ku896
MwTtWyOrTlPtpJEi9LUrLmOUXtD1WN2Ekql/ZLaO7pxUtVTRF4MyYspGgU1ZjkxY
vQLnZs85bnG2dLz7Q4xxlj4=
-----END PRIVATE KEY-----
EOF

sudo cat > /etc/pki/tls/certs/ca-bundle.crt <<EOF
-----BEGIN CERTIFICATE-----
MIIESzCCAzOgAwIBAgIOSMqBefg+ikLz9c3isT8wDQYJKoZIhvcNAQELBQAwTDEg
bFNpZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMTYxMDE0MDAwMDAwWhcNMjQw
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG
DKqC5JlR3XC321Y9YeRq4VzW9v493kHMB65jUr9TU/Qr6cf9tveCX4XSQRjbgbME
-----END CERTIFICATE-----
EOF

# RESTART
sudo service httpd restart

#DONE

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.