How to easily create a SSL certificate and configure it in Apache2 in Mac OS X?

Question

I'd like to use my Mac OS X with https for local development tests. How can I easily make Apache2 respond to ssl, just for test proposes - I don't want a real certificate, just a fake to make local https work

Solution

For local development testing a self-signed certificate is adequate. You can generate one with the OpenSSL kit like so:

Generating the private key:

openssl genrsa -des3 -out server.key 1024

output:

Generating RSA private key, 1024 bit long modulus
.........................................................++++++
........++++++
e is 65537 (0x10001)
Enter PEM pass phrase:
Verifying password - Enter PEM pass phrase:

enter a passphrase for your private key.

Generating the CSR (certificate signing request):

openssl req -new -key server.key -out server.csr

it will request details like this:

Country Name (2 letter code) [GB]:
State or Province Name (full name) [Berkshire]:
Locality Name (eg, city) [Newbury]:
Organization Name (eg, company) [My Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

it's fairly straightforward, the common name is your server's hostname as it says in brackets.

Generating the self signed certificate:

openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

Configuring SSL in httpd.conf for Apache:

SSLEngine on
SSLCertificateFile /path/to/generated/server.crt
SSLCertificateKeyFile /path/to/generated/server.key

(replace path appropriately with the path to your certificate and key)

Restart Apache:

apachectl restart

Apache will ask you for the passphrase to your key. If you think you will be shutting the server down a lot, you may want to remove the passphrase from the key so you can avoid entering it each time. If not, don't worry about it. If so, complete this step after step 2 (Generating the CSR):

cp server.key server.key.copy
openssl rsa -in server.key.copy -out server.key

Comments

[Daniel Cukier]

it's almost woring for me. When I try to access some page in my Rails, using http the page exists, but when I use https, it returns page not found. Do you know what could be?

[John T]

Did you change your virtualhost to use https on port 443? It should look like this: <VirtualHost 192.168.1.100:443> SSLEngine On, etc.... </VirtualHost>

[GordonM]

Thanks for this, I got an SSL cert working fine on Lion with this. Just thought I'd add a couple of points though that should make your life easier. Apple's Apache has a httpd-ssl.conf which is already set up to look in /private/etc/apache2 so if you put your server.* files there it's one less file to edit. Also, you need to edit httpd.conf because the line that includes httpd-ssl.conf is commented out by default. Finally, 365 days is a bit short, you might want to set a longer expiry date or you'll be doing it again next year (I used 3650)

[mammadkoma]

If anyone has been having problems like I have, you'll be glad to find this link, which explains how to set up the virtualhost with virtualhostx correctly to work with ssl yellowrobot.heroku.com/blog/2012/01/22/…

[Aldekein]

If it's your dev machine you probably would like to have private key without password: openssl rsa -in server.key -out server.nopass.key

[i_a]

If using MAMP make sure /Applications/MAMP/conf/apache/extra/httpd-ssl.conf is properly configured. And check /Applications/MAMP/conf/apache/httpd.conf as well under <IfModule ssl_module>