Following on from my previous question (which I answered myself),

Configuring OS X 10.7 Lion Server to serve Rails Apps via Apache

...I'm now looking to set up SSL.

Again, I have the config working fine under Snow Leopard, but I want to set this up on a new i7 Mac Mini, so running Snow Leopard isn't an option.

I'm using the named virtual host kludge described in the link answer above, but I've been unable to get SSL working.

The Snow Leopard config I'm basing my Lion config is included below.

Tips on configuring the equivalent under Lion would be very much appreciated. Thanks.

  ServerName bonk.example.com

  Redirect / https://bonk.example.com/


    ServerName bonk.example.com
    DocumentRoot "/Rails/deployed/bonk/current/public"
    RackEnv example_production
    RailsEnv example_production
    <Directory "/Rails/deployed/bonk/current/public">
      Order allow,deny
      Allow from all
      Options FollowSymLinks

  SSLEngine on
  SSLOptions +FakeBasicAuth +ExportCertData +StdEnvVars +StrictRequire
  SSLCertificateFile /private/etc/apache2/server.crt
  SSLCertificateKeyFile /private/etc/apache2/server.key
  SSLCertificateChainFile /private/etc/apache2/ca.crt
  SetEnvIf User-Agent &quot;.*MSIE.*&quot; nokeepalive ssl-unclean-shutdown downgrade-1.0 force-response-1.0

  RequestHeader set X-Forwarded-Proto "https"

  • Have you tried this guide from Apple? developer.apple.com/internet/serverside/modssl.html – user10355 Sep 20 '11 at 0:36
  • Thanks, but that guide is quite dated. I have SSL working under Snow Leopard, but Lion changes things quite a bit. There's workarounds for named virtual hosts, but I've not got SSL working under Lion with that set-up. – Snips Sep 20 '11 at 11:13
  • How do you do this as your own CA (certificate authority)? – Chase Holden Jan 29 '12 at 9:52
  • The process is exactly the same (once you've created your own certificate). – Snips Jan 29 '12 at 10:05
  • obviously it is not exactly the same. i created my own CA using Apple's Keychain Access app, but that doesn't mean I can use it with the above code. Please post the proper syntax if you know how. – Chase Holden Jan 29 '12 at 10:29

Generate a host key

First, make a home for the new SSL files. I use /etc/apache2/ssl. Open up a terminal window, cd to the new directory and issue the following command to create a host key file.

sudo ssh-keygen -f host.key

Generate a certificate request file

This command create a certificate request file. A certificate request file contains information about your organization that will be used in the SSL certificate.

sudo openssl req -new -key host.key -out request.csr

Create the SSL certificate

Create a self signed SSL certificate using the request file.

sudo openssl x509 -req -days 365 -in request.csr -signkey host.key -out server.crt

Configure Apache

Create a backup of /etc/apache2/httpd.conf.

Append the contents of /etc/apache2/extra/httpd-ssl.conf to /etc/apache2/httpd.conf.

In /etc/apache2/httpd.conf, make sure the loading of SSL is enabled (remove the #)

LoadModule ssl_module libexec/apache2/mod_ssl.so

Also, edit SSL section to use the new certificate.

SSLEngine on
SSLCertificateFile /etc/apache2/ssl/server.crt
SSLCertificateKeyFile /etc/apache2/ssl/host.key

Check the config and restart Apache to try the new certificate.

sudo apachectl configtest
sudo apachectl restart

Thanks to the House of Ding and Matt Langtree for providing much of this solution.

  • Thanks for your reply, but this looks like the standard instructions for Snow Leopard (and prior). Have you tried this on Lion? 'cos I don't think it works :-/ – Snips Nov 20 '11 at 22:31
  • yup. ran it on lion and it works. the sharing preferences doesn't show the server is on, but it is. – yanokwa Nov 23 '11 at 0:05

The problem with above is that a password or pass phrase is required from apache which it cannot get. Therefore apache will not run or startup!

What's needed is to create a "no password" host key with this command:

openssl rsa -in host.key -out host.nopass.key

...and direct apache's ssl key to the host.nopass.key that it generates.

When I did this, my Lion Apache runs successfully.

  • Chase's amendment worked for me! Had to "sudo": sudo openssl rsa -in host.key -out host.nopass.key – user18650 Feb 12 '12 at 20:44

You must log in to answer this question.

protected by Community Feb 12 '12 at 21:34

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged .