WampServer

Hey thank you so much!I have made all the changes and my wamp server n even the ssl stuff is working great.
thanks again.

Nirupama

great work toivo, I've it working fine. Just one question:

I've put as default virtual server "mysecuresite", which is in "wamp/www" folder.

So:
- if I type "[locahost"]; it goes to localhost main page.-->OK

- if I type "[localhost"]; it goes directly to the index.html page in "mysecuritysite" folder after asking me to

install the server certificate.-->OK

- But, if I type "[locahost]; it goes to index.html in "mysecuritysite" without asking me to

install the certificate -->KO

How do I force to use https when accesing to mysecuresite?

Nirupama Wrote:
-------------------------------------------------------
> Hi!
> I followed all the steps mentioned above by
> Toivo,i'm having a problem with the wamp server
> when i modify my HTTPD.CONF file.The icon becomes
> yellow n nothing works.But if i undo the changes
> the wamp server is ok.
> I'm not sure how to check if my site is part of
> virtual hosts in Apache.I have just placed my
> folder in the www folder.Is there anything else
> that i should do to make sure my site is part of
> virtual hosts in Apache?
>
>
> MODIFY HTTPD.CONF.
>
> Last, but not least, make sure your secure site is
> part of the virtual hosts in Apache:-->i'm not
> sure abt this as mentioned above.
>
> # Secure (SSL/TLS) connections
> #Include conf/extra/httpd-ssl.conf
> Include conf/extra/httpd-ssl.conf------>this is
> the line with which my server goes off
>
>
>
> And when i try to test HTTPS by running the
> command httpd -t i get a syntax error in the file
> httpd-ssl.conf
> it says
>
> Invalid command 'SSLPassPhraseDialog',perhaps
> mispelled or defined by a module not included in
> the server configuration.
>
>
> Can anyone please help figure this out.I know it's
> some thing trivial,but i'm not able to get it.i
> need to get my work going at the earlliest.
>
> Thank you,
> Nirupama

im having the same problem too :-(

bloody velvet Wrote:
-------------------------------------------------------
> For those having the issue with the
> "SSLPassPhraseDialog builtin" line being invalid,
> here's how I fixed it. I followed the directions
> above, and also go this error at first.
>
> In the file httpd.conf, you're adding the line:
>
> Include ./conf/extra/httpd-ssl.conf
>
> I assumed at the end, after the last line in my
> file (wamp2) which is:
>
> Include "D:/webserve_local/wamp/alias/*"
>
> just above that though, it says:
>
>
> SSLRandomSeed startup builtin
> SSLRandomSeed connect builtin
>
>
> I haven't used SSL yet, so that module wasn't
> enabled. So it's failing because it's not loaded.
> So I changed:
>
>
> SSLRandomSeed startup builtin
> SSLRandomSeed connect builtin
>
>
> to:
>
>
> SSLRandomSeed startup builtin
> SSLRandomSeed connect builtin
> Include conf/extra/httpd-ssl.conf
>
>
> So it would only use ssl if it was enabled. Then
> using the wamp systray icon, enabled the ssl
> module:
>
> Apache > Apache modules > ssl_module
>
> It'll probably be at the end in that menu, it
> should be checked if it's on.
>
> After that, wamp started fine and everything works
> like it should.

i've done this too... and my apache service in my wampserver could not run.

btw im using wampserver2.0

Hi,
Thanks a lot for the help you provided to enable SSL on Wamp5.
Do you have any experience with wampserver 2 ?
I have tried to modify your procedure (paths, filenames etc.) in order to use SSl with wampserver 2, but it doesn't work.
Regards,

Maltec

oscarml:
I haven't tried with virtual servers, so I'm not sure the details of that. Shouldn't that be:
"[locahost]; ? I would think that if /mysecure site exists it wold goto that normally. Maybe you need to change the configuration to disallow any access to that and only allow https?


willietck :
What happens? It won't startup? Is there anything in the error.log?

maltec:
Do you mean WampServer Version 2.0? Or do you mean a wamp ver < 2? It's confusing because the about screen says 5. but the homepage says not to install 2 over wamp5. My changes are against the newest version.

It's possible I had something else installed already that is needed, and just didn't know it. If people having issues could post more specific errors, I can help troubleshoot.

oscarml Wrote:
-------------------------------------------------------
> great work toivo, I've it working fine. Just one
> question:
>
> I've put as default virtual server "mysecuresite",
> which is in "wamp/www" folder.
>
> So:
> - if I type "[locahost"]; it goes to localhost
> main page.-->OK
>
> - if I type "[localhost"]; it goes directly
> to the index.html page in "mysecuritysite" folder
> after asking me to
>
> install the server certificate.-->OK
>
> - But, if I type "[locahost]; it
> goes to index.html in "mysecuritysite" without
> asking me to
>
> install the certificate -->KO
>
> How do I force to use https when accesing to
> mysecuresite?


yeah, how to force to use https when accessing? lets say if i type the address as [localhost] it will auto go to [localhost]

because now when i type [localhost], the https went missing...

I think what most people are asking is:
"How do I make a sub directory turn to ssl?"

In this case it's not about virtual servers, it's about a .htaccess file. Assuming you have mod_rewrite on (the line in httpd.conf is:
LoadModule rewrite_module modules/mod_rewrite.so
and sould be uncommented so it's enabled.) Then you can place an .htaccess file in the subdirectory you want to redirect to sll that says:

Options +FollowSymlinks
RewriteEngine On
RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^.* []%{SERVER_NAME}%{REQUEST_URI} [L,R]

When you goto that subdir (let's say [localhost]) it will redirect to [localhost]

Keep in mind with this setup, if you goto something like:
[localhost]
it redirects to:
[localhost]

Does this solve your problems?

Also, if you're having problems starting up apache, and there's no error in te logs, goto the directory holding the apache exe (httpd.exe) via the command line. Then type:
httpd -t
This will check the syntax of the config files, and should return "Syntax OK" if you're ok. Use -S (capital S) to check vhosts if you're looking for a virtual host specific setup problem.

Yeah, i surf around and i read about this solution in [wiki.apache.org]

However, the guide did not use .htaccess ; they are putting the rewrite code in httpd.conf

Besides, they also mention about "Using mod_rewrite to do this isn't the recommended behavior." , and they recommend to use the redirect method [wiki.apache.org] which claim to be more safer and simpler.

Just want to ask you guys for opinion, and btw is the redirect method (<virtualhost>solution) need to setup virtual host in order to do that? i follow the instruction there and change the httpd-vhosts.conf but it seems before doing so, i'll hav to setup the virtualhost first.

This is true, I was offering a seperate solution. I've also read that page, but if you're using the instructions from before about setting up SSL, you can just add the following:


<IfModule ssl_module>
SSLRandomSeed startup builtin
SSLRandomSeed connect builtin
Include conf/extra/httpd-ssl.conf
</IfModule>

add the redirect:

<IfModule ssl_module>
SSLRandomSeed startup builtin
SSLRandomSeed connect builtin
Include conf/extra/httpd-ssl.conf
Redirect permanent /test [localhost]
</IfModule>

which makes:
[localhost]
change to
[localhost]

The SSL virtual host is setup when you're doing the SSL setup so you could just use that if you don't need a seperate one setup with specific new settings.(The default settings are the ones in httpd-ssl.conf)

Of course, this is only running if the SSL_module is running, but then you'd want it that way.

Thank you for your answer,
I mean WampServer Version 2.0 (i.e. the last one). Toivo procedure is for wamp5 and is not applicable for wampserver 2.0 because the paths are different (/wamp/bin/apache/apache2.2.6 instead of /apache2) and probably also for other reasons.
Regards

What if i want it to be lets say some page is protected by SSL and some don't.

For example:

"[localhost];

"[localhost];

both login.php and index.html is in the same folder, how to select which page will force using https and which will not force to use it?

can it be done?

Thanks for your reply, :-) really appreciate it.

This can be done with a simple redirect using mod_rewrite. Any request for a secure area that does not start with https gets redirected to https.

Read httpd_ssl.conf file. It gives you advice and guidance.

maltec:
My test setup is with the latest version, so I followed the original directions, and then made the changes I posted to make it work. You have to adjust the paths as you're reading. The paths may be different, but the files you're working with are the same. Just because an instruction says "browse to apache2\" and your install uses apache2.2.6\, it doesn't matter. Just pretend the instructions refer to the version you have installed.

willietck:
stevenmartin99 is right, this is easiest with a rewrite, which is also why I posted using an htaccess orginally. It's also easier for testing because you can make changes to the htaccess file and check to see if it works without restarting apache each time like when you're editing httpd.conf.

I would imagine though you could do a conditional match right in the conf file just like in a seperate htaccess file, then instead of rewriting just redirect like for the directory.

Hi,

hambuler has posted a https SSL guide for wamp2 at [forum.wampserver.com]

Regards,

toivo
Sydney, Australia



Edited 1 time(s). Last edit at 03/08/2008 11:46PM by toivo.

I wrote a quick and dirty HTA app to help manage SSL setup. It doesn't edit the conf files for you, I figured that was better left to the end user. There's too much I could mess up if I scripted that. This is basically a GUI to generate the KEY and CERT file, and give you a central access to the files, directories, and options involved in setting it up.

Download from my site: [brokenparts.zapto.org]

Things it does:
If you fill out the Apache ROOT path, it tries to auto set the other paths for you.
Every dir and file box has a browse and open button. (files open in notepad, dirs in explorer)
Even if you don't set OPENSSL_CONF=, it can still generate the certificate. It sets it for you. (You don't have to reboot for this, contrary to the original directions) If it's already set, it detects it.
Sets up a certificate using no passphrase (this is a different command than in the original directions and is based off these instructions: [www.madboa.com])
You can setup all the certificate fields right in the app.

It's an HTA, so you can edit it freely, just open it in notepad. If you want something else added, let me know and I'll see what I can do.

Don't know what an HTA is?
Check out: [msdn2.microsoft.com]

i think i know how, its my mistake...LOL

thanks alot!



Edited 1 time(s). Last edit at 03/11/2008 12:43PM by willietck.

Hmmm, how about the other way round? lets say from https to http ?

it seems like after i activate SSL, my entire documentroot folder (www) is SSL enabled, how can i control it to specify folder not to use SSL?

i've tried the reverse method of

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^abc(.*) []%{SERVER_NAME}/abc$1 [R,L]

to become

RewriteEngine On
RewriteCond %{HTTPS} ==on
RewriteRule ^abc(.*) []%{SERVER_NAME}/abc$1 [R,L]

in order to change the https to become http. but seems like its not working. the URL still unable to force redirect from https to http.

im using .htaccess method to do these.

thanks

You want something like:

Options +FollowSymlinks
RewriteEngine On
RewriteCond %{SERVER_PORT} !^80$
RewriteRule ^.* []%{SERVER_NAME}%{REQUEST_URI} [L,R]

Anything that isn't port 80 (i.e. https, port 443) to rewrite to http