Ssl – Install SSL certificate on Apache Windows Server 2012 R2

apache-2.4sslwindows-server-2012-r2

I am a developer. Our server admins have given me 3 files. .cer, .pfx and .p7b and told me to install SSL in Apache Server. I have Wamp with Apache version 2.4.9. I have search and found something. I open httpd.conf file and search for DocumentRoot. After DocumentRoot I have added,

DocumentRoot "c:/wamp/www/"

SSLEngine on

SSLCertificateFile C:/Path/MyCer.cer

SSLCertificateKeyFile C:/Path/MyPfx.pfx

SSLCACertificateFile C:/Path/MyP7b.p7b

Now when I restart the apache. I am unable to navigate the server even on http. When I comment the above lines, my sites works on http.

Best Answer

Although this is not exactly a "question", and you do not specify what is inside your files, you're doing at least one thing wrong: a pfx file (assuming this is not a naming error) cannot be used directly as a "key" in Apache. Without knowing the contents of the cer and the p7b file, let's assume that the pfx has all the info we need and that you have the pfx password (you do, right?), and start from there.

  1. Grab and install OpenSSL for Windows (Suggestion: https://indy.fulgan.com/SSL/ has precompiled binaries if you're not willing to build from sources in http://www.openssl.org/)

  2. Extract the different files required for Apache from the pfx (you'll be prompted for the pfx password when required):

    a. Extract the SSL Certificate Private Key (Encrypted) from the pfx

    C:\Path> openssl pkcs12 -in MyPfx.pfx -nocerts -nodes -out MyEncKey.key

    b. Remove the encryption from the SSL Certificate Private Key

    C:\Path> openssl rsa -in MyEncKey.key -out MyKey.key

    c. Extract SSL Certificate from the pfx

    C:\Path> openssl pkcs12 -in MyPfx.pfx -clcerts -nokeys -out MyCert.cer

    d. Extract the (possibly empty) CA Certificate Chain from the pfx

    C:\Path> openssl pkcs12 -in MyPfx.pfx -nodes -nokeys -cacerts -out MyCAs.crt

  3. Rebuild your httpd.conf using these lines instead of yours (note: ONLY INCLUDE THE SSLCACertificateFile line if the MyCAs.crt is not empty; you can check it with any text editor)

  SSLCertificateFile C:/Path/MyCert.cer
  SSLCertificateKeyFile C:/Path/MyKey.key
  SSLCACertificateFile C:/Path/MyCAs.crt
Related Topic