How To Lighttpd Create Self Signed SSL Certificates

Posted on in Categories lighttpd, Linux, OS X, Security, UNIX last updated October 19, 2006
Lighttpd logo

If you are testing an application (web based) or just want secure login page for your application, you can create a self signed SSL Certificates. I have already explained the procedure for installing real third party signed SSL certificate.

Procedure is as follows:

Step # 1: Create self signed SSL Certificates

Create a directory to store SSL certificate:

# mkdir /etc/lighttpd/ssl/domain.com -p
# cd /etc/lighttpd/ssl/domain.com
# openssl req -new -x509 -keyout server.pem -out server.pem -days 365 -nodes
# chown lighttpd:lighttpd /etc/lighttpd/ssl -R
# chmod 0600 /etc/lighttpd/ssl/domain.com

You need to provide information such as country name, your domain name etc.

Step # 2: Configure Lighttpd

Open lighttpd configuration file:
# vi /etc/lighttpd/lighttpd.conf Add config directives as follows:
$SERVER["socket"] == "192.168.1.100:443" {
server.document-root = "/home/lighttpd/domain.com"
ssl.engine = "enable"
ssl.pemfile = "/etc/lighttpd/ssl/domain.com/server.pem"
}

Make sure you replace ip 192.168.1.100 with your actual IP address.

Step # 3: Restart Lighttpd

Test config file for errors:
# lighttpd -t -f /etc/lighttpd/lighttpd.conf
Now Restart lighttpd:
# /etc/init.d/lighttpd restart

Make sure port 443 is open
# netstat -tulpn | grep :443

Configure firewall/iptables and open port 443. Following is sample iptabables rules. You need to append code to your iptables shell script:
SERVER_IP="192.168.1.100"
iptables -A INPUT -p tcp -s 0/0 --sport 1024:65535 -d $SERVER_IP --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -s $SERVER_IP --sport 443 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT

Redirect plain text login page to secure login page

Let us assume you would like to redirect all incoming wordpress requests http://domain.com/blog/wp-login.php request to https://domain.com/blog/wp-login.php
Add following code snippet to your lighttpd.conf file’s port 80 section:
$HTTP["url"] =~ "^/blog/wp-login.php*" {
url.redirect = ( "^/(.*)" => "https://www.domain.com/$1" )
}

You may need to modify your login page to submit form over SSL.

Posted by: Vivek Gite

The author is the creator of nixCraft and a seasoned sysadmin and a trainer for the Linux operating system/Unix shell scripting. He has worked with global clients and in various industries, including IT, education, defense and space research, and the nonprofit sector. Follow him on Twitter, Facebook, Google+.

9 comment

  1. Correction:

    ssl.pemfile = “/etc/lighttpd/ssl/domain.com/domain.com”

    Otherwise lighttpd will try to open the directory as the key file and will fail with
    SSL: Private key does not match the certificate public key, reason: error:0906D06C:PEM routines:PEM_read_bio:no start line

  2. What a wounderful post! It’s been a little tough finding a good, simple, but effective site to help me get https connections working on my lighttpd setup!

    Many Thanks! This post helped ALOT!

  3. Please help

    I’m still getting the following error in FF,

    The connection was interrupted….

    and i couldn’t do the following line,

    chown lighttpd:lighttpd /etc/lighttpd/ssl -R

    it says “invalid user”

    I’m trying to implement ssl over my ruby app.

    please help and thank you for the great post

    — sameera

  4. Hi,

    Thanks for the tutorial!

    I discovered that the key generation command asked for information but gave fairly misleading guidance which led to some confusion.

    The important one was this prompt:
    -> Common Name (eg, YOUR name) []:

    This actually needs to be the exact hostname ie “www.domain.com” of the server you’re generating the key for. You’d be forgiven for thinking otherwise!

    Info from http://sial.org/howto/openssl/self-signed/

    I wonder if you could update the HOWTO to clarify this point?

    Thanks,

    Paul

  5. Thanks for the tutorial, but lighttpd with openssl produce error:
    (network.c.601) SSL: failed to initialize TLS servername callback, openssl library does not support TLS servername extension

    freebsd 7.3
    openssl-0.9.8m
    lighttpd-1.4.26

Comments are closed.