Mediawiki/Force SSL - Revision history

R00t: /* virtual host file */

2017-06-10T05:19:22Z

‎virtual host file

R00t: /* virtual host file */

2017-06-10T05:18:51Z

‎virtual host file

R00t: /* virtual host file */

2017-06-10T05:07:10Z

‎virtual host file

R00t at 05:06, 10 June 2017

2017-06-10T05:06:31Z

R00t: /* configure the https redirect */

2014-04-30T19:37:54Z

‎configure the https redirect

R00t at 18:48, 30 April 2014

2014-04-30T18:48:10Z

R00t: /* apache config */

2014-04-29T14:55:50Z

‎apache config

R00t at 14:54, 29 April 2014

2014-04-29T14:54:25Z

R00t at 14:47, 29 April 2014

2014-04-29T14:47:06Z

R00t at 13:57, 29 April 2014

2014-04-29T13:57:46Z

@@ Line 94: / Line 94: @@
          CustomLog /var/log/apache2/mediawiki-access.log combined
          SSLEngine on
-         SSLCertificateFile /etc/ssl/ssl.crt/mediawiki/server.crt
+         SSLCertificateFile /etc/ssl/cert/server.crt
-         SSLCertificateKeyFile /etc/ssl/ssl.key/mediawiki/server.key
+         SSLCertificateKeyFile /etc/ssl/private/server.key
          <FilesMatch "\.(cgi|shtml|phtml|php)$">
                          SSLOptions +StdEnvVars

@@ Line 90: / Line 90: @@
          ServerAdmin webmaster@r00tedvw.com
          ServerName https://wiki.r00tedvw.com
 </VirtualHost>
 </nowiki>

@@ Line 86: / Line 86: @@
          ServerName http://wiki.r00tedvw.com
          Redirect permanent / https://wiki.r00tedvw.com
-    </VirtualHost></nowiki>
+</VirtualHost>

← Older revision		Revision as of 05:06, 10 June 2017
Line 83:		Line 83:
	AllowOverride All		AllowOverride All
	====virtual host file====		====virtual host file====
		+	<nowiki><VirtualHost *:80>
		+	ServerName http://wiki.r00tedvw.com
		+	Redirect permanent / https://wiki.r00tedvw.com
		+	</VirtualHost></nowiki>

← Older revision		Revision as of 19:37, 30 April 2014
Line 82:		Line 82:
	#		#
	AllowOverride All		AllowOverride All
		+	====virtual host file====

← Older revision		Revision as of 18:48, 30 April 2014
Line 68:		Line 68:
	## Adding $wgCanonicalServer for locations that don't support protocol relative urls (default if it cannot understand "//servername.com"		## Adding $wgCanonicalServer for locations that don't support protocol relative urls (default if it cannot understand "//servername.com"
	$wgCanonicalServer = "https://servername.com";		$wgCanonicalServer = "https://servername.com";
		+
		+	==configure the https redirect==
		+	there are (2) ways to do this, one through the virtualhost config (recommended), or one by using mod_rewrite<br>
		+	https://wiki.apache.org/httpd/RedirectSSL<br>
		+	https://wiki.apache.org/httpd/RewriteHTTPToHTTPS<br>
		+	====mod_rewrite====
		+	This way worked best for me with multiple instances of mediawiki hosted from the same server on same ip, but as sub sites rather than sub domains.<br>
		+	open /etc/httpd/conf/httpd.conf and go to line 341 (in my version). Change AllowOverride from '''None''' to '''All'''
		+	~$ sudo vi /etc/httpd/conf/httpd.conf
		+	# AllowOverride controls what directives may be placed in .htaccess files.
		+	# It can be "All", "None", or any combination of the keywords:
		+	# Options FileInfo AuthConfig Limit
		+	#
		+	AllowOverride All

@@ Line 14: / Line 14: @@
 ==apache config==
-comment NameVirtualHost *:443 from /etc/httpd/conf/httpd.conf
+comment out the following from /etc/httpd/conf/httpd.conf
   #NameVirtualHost *:443
 Add new NameVirtualHost to /etc/httpd/conf.d/ssl.conf
   #SNI config - tells apache to use named virtual hosts on the secure port
   NameVirtualHost *:443
-Remove Listen line from /etc/httpd/conf/httpd.conf.  This is not needed because with mod_ssl installed it is not in /etc/httpd/conf.d/ssl.conf
+Verify that /etc/httpd/conf.d/ssl.conf has the following in it (uncommented)
-  #Listen 443
+  Listen 443
 ==create key,csr, and self-signed crt==

← Older revision		Revision as of 14:54, 29 April 2014
Line 57:		Line 57:
	SSLCertificateFile /usr/local/apache/conf/ssl.crt/server.crt		SSLCertificateFile /usr/local/apache/conf/ssl.crt/server.crt
	SSLCertificateKeyFile /usr/local/apache/conf/ssl.key/server.key		SSLCertificateKeyFile /usr/local/apache/conf/ssl.key/server.key
		+
		+	==edit mediawiki LocalSettings.php==
		+	http://www.mediawiki.org/wiki/Manual:$wgServer<br>
		+	Now lets go to LocalSettings.php and edit the site file:<br>
		+	~$ sudo vi /var/www/html/servername/mediawiki-1.22.6/
		+	## The protocol and server name to use in fully-qualified URLs
		+	$wgServer = "//servername.com";
		+
		+	## Adding $wgCanonicalServer for locations that don't support protocol relative urls (default if it cannot understand "//servername.com"
		+	$wgCanonicalServer = "https://servername.com";

← Older revision		Revision as of 14:47, 29 April 2014
Line 21:		Line 21:
	Remove Listen line from /etc/httpd/conf/httpd.conf. This is not needed because with mod_ssl installed it is not in /etc/httpd/conf.d/ssl.conf		Remove Listen line from /etc/httpd/conf/httpd.conf. This is not needed because with mod_ssl installed it is not in /etc/httpd/conf.d/ssl.conf
	#Listen 443		#Listen 443
		+
		+	==create key,csr, and self-signed crt==
		+	http://www.akadia.com/services/ssh_test_certificate.html<br>
		+	=====create directories=====
		+	since you have multiple sites hosted from the same box, its best to organize them into directories. The default location for certs on most linux apache installations with mod_ssl is:
		+	/etc/ssl/certs/
		+	=====create key=====
		+	~$ openssl genrsa -des3 -out server.key 2048
		+	=====generate csr=====
		+	~$ openssl req -new -key server.key -out server.csr
		+	Country Name (2 letter code) [GB]:CH
		+	State or Province Name (full name) [Berkshire]:Bern
		+	Locality Name (eg, city) [Newbury]:Oberdiessbach
		+	Organization Name (eg, company) [My Company Ltd]:Akadia AG
		+	Organizational Unit Name (eg, section) []:Information Technology
		+	Common Name (eg, your name or your server's hostname) []:public.akadia.com
		+	Email Address []:martin dot zahn at akadia dot ch
		+	Please enter the following 'extra' attributes
		+	to be sent with your certificate request
		+	A challenge password []:
		+	An optional company name []:
		+	=====backup & remove passphrase from key=====
		+	unless the passphrase is removed, apache will ask for the passphrase whenever it is started.<br>
		+	~$ cp server.key server.key.org
		+	~$ openssl rsa -in server.key.org -out server.key
		+	=====generate self-signed cert=====
		+	~$ openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
		+	Signature ok
		+	subject=/C=CH/ST=Bern/L=Oberdiessbach/O=Akadia AG/OU=Information
		+	Technology/CN=public.akadia.com/Email=martin dot zahn at akadia dot ch
		+	Getting Private key
		+	=====add ssl to virtual host=====
		+	add the following to your virtual host config
		+	SSLEngine on
		+	SSLCertificateFile /usr/local/apache/conf/ssl.crt/server.crt
		+	SSLCertificateKeyFile /usr/local/apache/conf/ssl.key/server.key

← Older revision		Revision as of 13:57, 29 April 2014
Line 19:		Line 19:
	#SNI config - tells apache to use named virtual hosts on the secure port		#SNI config - tells apache to use named virtual hosts on the secure port
	NameVirtualHost *:443		NameVirtualHost *:443
		+	Remove Listen line from /etc/httpd/conf/httpd.conf. This is not needed because with mod_ssl installed it is not in /etc/httpd/conf.d/ssl.conf
		+	#Listen 443