httpd-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Boyle Owen" <Owen.Bo...@swx.com>
Subject RE: [users@httpd] How to setup HTTPS
Date Mon, 16 Feb 2004 08:23:19 GMT
> -----Original Message-----
> From: Arturo P [mailto:pembo13@flashmail.com]
> 
> I have a website running on Apache. I have a user system, with 
> authentication, and senstive information etc. going on. 
> Keeping in mind 
> that I can't afford to purchase a secuirty 
> certificate.....how do I go 
> about setting up Apache so I can handle secure informaton with https? 

If you have a small user group who already trust your site, then you can
get by with a self-signed certificate. This is one you make and sign
yourself. It will be enough to set up an encrypted session and so
protect the password submission and data transfer. It will not provide
authentication for your site however so clients will get "browser cannot
authenticate site" warnings.

You'll get all the details at http://www.modssl.org (if you have apache
1.3, you need to download and install it. If 2.0, mod_ssl is available
as an extension module).

> And should I just allow the entire site to run over https?

I would. Some people like to serve non-secret data via plain HTTP to
reduce server load. But that usually leads to "this page contains secure
and non-secure items" warnings and is bad for secrecy because you
highlight your important data (it's in the encrypted packets).

Rgds,
Owen Boyle
Disclaimer: Any disclaimer attached to this message may be ignored. 

> 
> Thank you.
> 
> 
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP 
> Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
>    "   from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
> 
> 
Diese E-mail ist eine private und persönliche Kommunikation. Sie hat
keinen Bezug zur Börsen- bzw. Geschäftstätigkeit der SWX Gruppe. This
e-mail is of a private and personal nature. It is not related to the
exchange or business activities of the SWX Group. Le présent e-mail est
un message privé et personnel, sans rapport avec l'activité boursière du
Groupe SWX.

This message is for the named person's use only. It may contain
confidential, proprietary or legally privileged information. No
confidentiality or privilege is waived or lost by any mistransmission.
If you receive this message in error, please notify the sender urgently
and then immediately delete the message and any copies of it from your
system. Please also immediately destroy any hardcopies of the message.
You must not, directly or indirectly, use, disclose, distribute, print,
or copy any part of this message if you are not the intended recipient.
The sender's company reserves the right to monitor all e-mail
communications through their networks. Any views expressed in this
message are those of the individual sender, except where the message
states otherwise and the sender is authorised to state them to be the
views of the sender's company. 



---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org


Mime
View raw message