Editing Archive:Webserver authentication (section)

=== TLS/SSL ===
[[:Category:Authentication|SSL and HTTPS and Secure logins]] have been covered numerous times in this wiki, but most of the material is outdated and some seems horribly cumbersome (or both). Still, there's no point in creating ''yet another'' how-to for this so we'll keep this brief. TLS/SSL was enabled in the webserver by first installing the <tt>mod_ssl</tt> package and configuring a key pair in <tt>/etc/httpd/conf.d/ssl.conf</tt>.

When running <tt>[[Getting Started with EPrints 3|epadmin create]]</tt> supply a hostname for https connections. ''Contrary'' to a statement from [[Getting Started with EPrints 3]] ("If you will use https for your user pages (including login) enter the https hostname - ''No doubt, for secure usage you need another name''", my emphasis) this can and probably should be your main EPrints hostname also used for plain HTTP.

(To change this after installation either edit <tt>archives/[repo_id]/cfg/cfg.d/10_core.pl</tt> or do as suggested in this file and run <tt>epadmin config_core [repo_id]</tt>. Note that leaving this to <tt>epadmin</tt> does ''not'' set or change any of the <tt>*root</tt> or <tt>*cgiroot</tt> statements which are mentioned [[HTTPS|in the wiki]]. Only <tt>$c->{securehost}</tt> seems to be needed.)

Since the EPrints RPM already containes <tt>/etc/httpd/conf.d/eprints.conf</tt> EPrints should already be working fine over plain HTTP. To make EPrints available over TLS/SSL as well include the auto-generated SSL-specific config ''inside'' httpd's existing SSL-vhost as defined in <tt>/etc/httpd/conf.d/ssl.conf</tt>:
 Include /usr/share/eprints/cfg/apache_ssl.conf
Check httpd's config for syntax errors (<tt>apachtectl -t</tt>) and restart httpd.
EPrints should now work over both http and https.