버전 1.6.6(변경 로그: 소스 보기)
httpraibledesigns.com/tomcat/ssl-howto.html에서 Apache 2도 다루는 이 HOWTO의 최신 버전을 더 자주 업데이트할 수 있기를 바랍니다. Windows Server 2003에서 Apache 2를 사용하는 경우 Apache 2를 다루는 이 자습서도 확인하십시오.

Sergio Artigas가 관리하는 스페인어 번역
Jean-Francois Moreau가 관리하는 프랑스어 번역
Morten Fischer-Nielsen이 관리하는 덴마크어 번역
독일 사이트
이 페이지에서는 다음을 사용하여 Win32 버전의 Apache를 설치하는 방법을 설명합니다.
mod_ssl 확장자. 최신 버전은 항상 httptud.at/programm/apache-ssl-win32-howto.php3에서 사용할 수 있어야 합니다.

이 프로세스는 Windows NT, 98, ME, 2000 및 XP에서 많은 사람들에게 적용되었습니다. 제안 및 버그 보고서를 메일로 보내주세요.

필요한 경우 Microsoft Internet Information Server 외에 SSL을 사용하여 Apache를 설치할 수도 있습니다.

참고: 때때로 미리 컴파일된 아파치 사이에 변경 사항이 있습니다.
이 HOWTO가 더 이상 정확하지 않도록 배포판을 배포합니다. 이 경우,
현재 버전이 작동하지 않으면 이전 버전을 다운로드하세요.
이 HOWTO의 수정 날짜 이전에 출판된 것

또는 모험을 좋아한다면 실행해 보고 변경해야 할 사항이 있으면 저에게 메일을 보내주세요.

Win32의 Apache 1.3.x는 Un*x 플랫폼의 Apache의 안정성과 성능에 미치지 못하므로 베타 품질로 간주됩니다. 2.x 버전이 더 나을 수도 있지만 이 HOWTO에서는 아직 2.x를 다루지 않습니다.

미러 중 하나에서 Apache 웹 서버의 Win32 버전을 가져옵니다. 그것은 다음과 같이 불립니다
apache_x_y_z_win32.exe. 자동으로 압축이 풀리는 아카이브입니다.
Apache 기본 시스템 및 샘플 구성 파일을 포함합니다.

Apache 버전 1.3과 2를 혼용하지 마십시오! 작동하지 않습니다. modssl.org에서 1.3.x를 찾으면 2.0.x에서 작동할 것으로 기대할 수 없습니다.

httpwww.apache.org/docs/windows.html에 설명된 대로 Apache를 설치합니다.

참고: 이 단계를 건너뛰고 아래 설명된 대로 modssl.org에서 전체 Apache+SSL 배포판을 얻을 수 있습니다. 멋진 설치 프로그램은 없지만 스톡 Apache 파일을 덮어쓸 필요는 없습니다. 이것은 경험이 있고 구성 파일 편집을 두려워하지 않는 경우 더 좋은 방법입니다(어쨌든 수행해야 함).

에서 최소한 다음 매개변수를 변경하십시오.
아파치 디렉토리/conf/httpd.conf:
www.my-server.dom의 모든 항목을 실제
도메인 이름
포트 80to
(댓글로 달아주세요;
#포트 80
포르티스는 필요하지 않고,
Listen은 나중에 재정의합니다.)
80 듣기
Listen 443(서버가 표준 SSL 포트에서 수신)
서버 이름

DocumentRoot 및 해당
to your
Inetpub\wwwroot
Install the Apache service (NT/2000 only) and start the server. Verify that everything works before proceeding to the SSL installation because this limits the possible errors

Try
 It won't be encrypted yet but if
this works then the port configuration (port 443) is right. httpwww.my-server.dom:443
Go to httpwww.modssl.org/contrib/
or httphunter.campbus.com/
and find a file called like
Apache_X-mod_ssl_Y-openssl_Z-WIN32[-i386].zip

Download and unzip it to a new directory

If you need the newest version, you will have to compile it yourself if it is not there. Don't ask me about it; I don't have it, I don't compile the versions on modssl.org, and I don't have access to development tools on Win32

Copy the files
ssleay32.dll and
libeay32.dll
from the Apache/modssl distribution directory to
WINNT\System32

This is important! About 70 % of the e-mails I receive is because people
forget to do this. If you don't find those files or openssl.exe in the
apache zip, get a file called like
openssl- from one of the download sites

*version*-win32.zip
You'll need a config file for
OpenSSL.exe

Here is one (right-click on it and "Save
as (There is an openssl.cnf in the distribution with different
wording of some questions, but it should do it, too.)
Copy it to the directory
openssl.exe is in

(This is a normal text file. It is really called so; however, some Windows versions insist on hiding the extension from you. You can edit it with Windows notepad or a good editor, but it shouldn't be necessary.)
The following instructions are from httpwww.apache-ssl.org/#FAQ

openssl req -config openssl.cnf -new -out my-server.csr
This creates a certificate signing request and a private key. When asked for
"Common Name (eg, your websites domain name give
the exact domain name of your web server (e.g

**www.my-server.dom The
certificate belongs to this server name and browsers complain if the name
doesn't match

openssl rsa -in privkey.pem -out my-server.key
This removes the passphrase from the private key. You MUST understand what this means;
my-server.key should be only readable by the apache
server and the administrator

You should delete the
.rnd file because it contains the entropy
information for creating the key and could be used for cryptographic
attacks against your private key

openssl x509 -in my-server.csr -out my-server.cert -req -signkey my-server.key -days 365

This creates a self-signed certificate that you can use until you get a "real" one from a certificate authority. (Which is optional; if you know your users, you can tell them to install the certificate into their browsers.) Note that this certificate expires after one year, you can increase
-days 365 if you don't want this

If you have users with MS Internet Explorer 4.x and want them to be able
to install the certificate into their certificate storage (by downloading and
opening it), you need to create a DER-encoded version of the certificate:
openssl x509 -in my-server.cert -out my-server.der.crt -outform DER
Create an
Apache/conf/ssl directory and move
my-server.key and
my-server.cert into it

Copy the executable files exe, *.dll, *.so) from the downloaded apache-mod_ssl distribution over your original Apache installation directory (remember to stop Apache first and DO NOT overwrite your edited config files etc

Find the LoadModule directives in your
httpd.conf file and
add this after the existing ones, according to the file you have found in the
distribution:
LoadModule ssl_module modules/ApacheModuleSSL.dll
or
LoadModule ssl_module modules/ApacheModuleSSL.so
or
LoadModule ssl_module modules/mod_ssl.so
in newer versions

In newer versions of the distribution, it could also be necessary to add
AddModule mod_ssl.c
after the AddModule lines that are already in the config file

Add the following to the end of
httpd.conf:
# see httpwww.modssl.org/docs/2.8/ssl_reference.html for more infoSSLMutex sem SSLRandomSeed startup builtin SSLSessionCache none SSLLog logs/SSL.log SSLLogLevel info # You can later change "info" to "warn" if everything is OK SSLEngine On SSLCertificateFile conf/ssl/my-server.cert SSLCertificateKeyFile conf/ssl/my-server.key 
Don't forget to call apache with
-D SSL if the
IfDefine directive
is active in the config file!
You might need to use
regedit to change the key
HKEY_LOCAL_MACHINE\SOFTWARE\Apache Group\Apache\X.Y.Z to the
correct number if the
apache.exe from
modssl.org/contrib is not the same version as the previously installed
one. (This seems not to be necessary with recent versions.)
Also, if you use IfDefine directives and start apache as a service, you need
to edit the apache command line in the registry
(
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Apache2)
(I haven't tried this)

Start the server, this time from the command prompt (not as a service) in
order to see the error messages that prevent Apache from starting. If
everything is OK, (optionally) press CTRL+C to stop the server and start it
as a service if you prefer

If it doesn't work, Apache should write meaningful messages to the screen and/or into the error.log and SSL.log files in the Apache/logs directory

If something doesn't work, set all

LogLevels to the maximum
and
*look into the logfiles*. They are very helpful

DON'T e-mail me or the other contributors without having plain Apache
installed (Step 1). We will ignore your request; we are not the Free Apache
Helpdesk and there is enough good documentation on configuring Apache; if that
is not enough for you, you shouldn't run a secure server anyway. Also, DON'T
e-mail without having looked into the error.log and SSL.log with
LogLevel set to Debug

Problems connecting to the server with a browser can have many reasons, many of them on the client (proxy, DNS, general IE dumbness)

So, if you encounter problems connecting with SSL, try another browser and/or look into the settings. If even this doesn't work, you can use OpenSSL to debug the problem

bb@www$
openssl s_client -connect no-such-machine:443gethostbyname failure # Error resolving this DNS name. Connect with the IP address.connect:errno=2 bb@www$ openssl s_client -connect www1.tud.at:443connect: Connection refused connect:errno=111 # No SSL server on this port. Double-check thebb@www$ Listenand Portdirectives. openssl s_client -connectapcenter.apcinteractive.net :443 # everything OK. OpenSSL shows the information it obtained from the server.CONNECTED(00000003) depth=0 /C=at/ST=Wien/L=Wien/O=APC interactive/OU=Lifecycle Management/CN=apcenter.apcinteractive.net/[email protected] verify error:num=18:self signed certificate verify return:1 depth=0 /C=at/ST=Wien/L=Wien/O=APC interactive/OU=Lifecycle Management/CN=apcenter.apcinteractive.net/[email protected] verify return:1Certificate chain 0 s:/C=at/ST=Wien/L=Wien/O=APC interactive/OU=Lifecycle Management/CN=apcenter.apcinteractive.net/[email protected] i:/C=at/ST=Wien/L=Wien/O=APC interactive/OU=Lifecycle Management/CN=apcenter.apcinteractive.net/[email protected] certificate BEGIN CERTIFICATE MIIC0TCCAjoCAQAwDQYJKoZIhvcNAQEEBQAwgbAxCzAJBgNVBAYTAmF0MQ0wCwYDV9ucXUnk= END CERTIFICATE subject=/C=at/ST=Wien/L=Wien/O=APC interactive/OU=Lifecycle Management/CN=apcenter.apcinteractive.net/[email protected] issuer=/C=at/ST=Wien/L=Wien/O=APC interactive/OU=Lifecycle Management/CN=apcenter.apcinteractive.net/[email protected] client certificate CA names sentSSL handshake has read 1281 bytes and written 320 bytesNew, TLSv1/SSLv3, Cipher is EDH-RSA-DES-CBC3-SHA Server public key is 1024 bit SSL-Session: Protocol : TLSv1 Cipher : EDH-RSA-DES-CBC3-SHA Session-ID: 49ACE1CF484A67D2C476B923D52110A6FCA1A7CE53D76DF7F233DEBF2333D4FB Session-ID-ctx: Master-Key: 00E9FA964253752294ECD69C18ADBA527B7170C112E2B3BCB25EA8F4FD847EC46E1FF0194EF8E16985B5E38BF6F12131 Key-Arg : None Start Time: 980696025 Timeout : 300 (sec) Verify return code: 0 (ok)[Enter: GET / HTTP/1.0 and press RETURN twice]HTTP/1.1 200 OK Date: Sun, 28 Jan 2001 15:34:58 GMT Server: Apache/1.3.9 (Win32) mod_ssl/2.4.9 OpenSSL/0.9.4 Cache-Control: no-cache, no-store, must-revalidate, private Expires: 0 Pragma: no-cache X-Powered-By: PHP/4.0.4 Last-Modified: Sun, 28 Jan 2001 15:35:00 GMT Connection: close Content-Type: text/html   # the server shows its main document
Q: I see the following when starting Apache:
Syntax error on line [some number] of httpd.conf Cannot load apache/modules/mod_ssl.so into server (126) The module could not be found:
openssl.exeinto a directory of its own and executing it. If it complains about not being able to find some DLLs, then you haven't copied them into the correct directory

Q: I see the following when starting Apache:
Syntax error on line [some number] of apache/conf/httpd.conf: Cannot load apache/modules/apachemodulessl.dll into server: (127) The specified procedure could not be found:or:
Syntax error on line [some number] of apache/conf/httpd.conf: Invalid command 'SSLMutex', perhaps mis-spelled or defined by a module not included in the server configuration
Q: SSL doesn't work in the browser and I see the following in some logfile:
[Fri Nov 16 15:46:30 2001] [error] OpenSSL: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request [Hint: speaking HTTP to HTTPS portA: How much clearer can an error message get? Your VirtualHost or Listen configuration is wrong

Don't ask us about installing servlet extensions, recompiling mod_ssl or
Apache with EAPI, recompiled versions etc. We have no idea and won't be able
help you. We are just users and not programmers

If your needs are so special, you are better off with a Debian GNU/Linux or OpenBSD server. It will save you lots of trouble. Really

Apache Web Server: httpwww.apache.org
mod_ssl: httpwww.modssl.org
mod_ssl configuration: httpwww.modssl.org/docs/2.8/ssl_reference.html
OpenSSL: httpwww.openssl.org
PHP Hypertext preprocessor: httpwww.php.net
Author of this document: Balázs
Bárány (httptud.at)
(mail me your questions, but only after having looked into the error logs with
LogLevel debug. You can mail me in English, German and Hungarian

If I am constantly ignoring your e-mail, read all the hints in the HOWTO about how to e-mail me.)
Contributor: Horst
Bräuner (OpenSSL configuration on NT)
Contributor: Christoph Zich (Windows 98)
Contributor: Torsten Stanienda (Test with 1.3.12, IfDefine directive)
Contributor: Peter Holm (Listen and Port directives)
Last change: 2009-12-24
This document can be redistributed under the GNU Free Documentation License. © Balázs Bárány 1999-2009