Editing Archive:HTTPS2 (section)

==Set up Secure Host==

Under Fedora Core 4, run:

 $ yum install mod_ssl

This sets up a test SSL server.

===Certificates===

For a production system, you would need to provide the relevant certificates and tweak the mod_ssl config accordingly - see: 

* [http://httpd.apache.org/docs/2.2/mod/mod_ssl.html Apache Module mod_ssl]
* [http://www.modssl.org/docs/2.8/ssl_faq.html mod_ssl FAQ]

Create a <tt>server.key</tt> on the EPrints server (remembering the passphrase you enter):

 $ openssl genrsa -des3 -out server.key 1024

Create a certificate request:

 $ openssl req -new -key server.key -out server.csr

The important thing when answering the questions is the CommonName: if ultimately the secure web address of your EPrints server is <tt>https://www.myeprints.com</tt>, then the CommonName value to enter is exactly <tt>www.myeprints.com</tt>.

Send the <tt>server.csr</tt> file to your Certificate Authority administrator, who should send you back a <tt>.cer</tt> file.

Copy <tt>server.key</tt> and the <tt>.cer</tt> file to the following locations:

 /etc/httpd/conf/ssl.key/server.key
 /etc/httpd/conf/ssl.crt/eprints.cer

Modify <tt>/etc/httpd/conf.d/ssl.conf</tt> accordingly:

 SSLCertificateFile /etc/httpd/conf/ssl.crt/eprints.cer
 SSLCertificateKeyFile /etc/httpd/conf/ssl.key/server.key

===Include EPrints SSL config===

Include each <tt>auto-secure.conf</tt> file generated by EPrints inside the <tt>Virtualhost</tt> directive.

On FC4, edit <tt>/etc/httpd/conf.d/ssl.conf</tt>:

 <VirtualHost _default_:443>
    ....
    Include /opt/eprints2/archives/ARCHIVEID/cfg/auto-secure.conf # 2.3.13
    Include /opt/eprints2/cfg/auto-your.secure.host.conf # 2.3.11
    Include /opt/eprints3/archives/soton/var/auto-secure.conf # 3.0.0
 </VirtualHost>

If you have set up SSL certificates, you will be asked to enter your passphrase when you restart apache. To override this, see [http://www.modssl.org/docs/2.8/ssl_faq.html#remove-passphrase How can I get rid of the pass-phrase dialog at Apache startup time?].