Skip to Content
Last modified by Aaron Rosenzweig on 2012/03/19 19:33
Show last authors
1 == Introduction ==
2
3 Sooner or later you will need to develop WebObjects applications that work with SSL requests over https protocol. If ssl is configured on your deployment server, you can probably just change http to https in the app entry URL and the app will probably just work over https protocol. However if your application requires security, you cannot just depend on your users typing in a URL that begins with https. Also since SSL encryption adds more load to the webserver, you may want decide that just some pages need to be returned securely over https and the rest returned via plain old http. In any case, you may want to or need to set up your local OS X development machine to support https protocol so that you can properly test your application. Note also that setting up ssl for testing can be a far simpler task (and not really secure) than setting up real authentic SSL certificates for use in a production server.
4
5 {{info title="Compatability"}}
6 These instructions were written and tested on the following, but should work on any 10.5.X config or later
7
8 * OS X Leopard Client 10.5.4
9 * Standard built-in apache2
10 * If you like record and verify your OS config as follows:
11 ** $ openssl version
12 *** OpenSSL 0.9.8g 19 Oct 2007
13 ** $ httpd -v
14 *** Server version: Apache/2.2.8 (Unix)
15 {{/info}}
16
17 === References ===
18
19 * [[http:~~/~~/httpd.apache.org/docs/2.0/ssl/ssl_faq.html#selfcert>>url:http://httpd.apache.org/docs/2.0/ssl/ssl_faq.html#selfcert||shape="rect"]]
20 * [[http:~~/~~/www.macosxhints.com/article.php?story=20080628074917113>>url:http://www.macosxhints.com/article.php?story=20080628074917113||shape="rect"]]
21 * [[http:~~/~~/www.macosxhints.com/article.php?story=20041129143420344>>url:http://www.macosxhints.com/article.php?story=20041129143420344||shape="rect"]]
22
23 == Development via Apache Webserver ==
24
25 By default, WebObjects development installations typically run via DirectConnect. For https development, we must run thru the apache webserver built in to every OS X machine. So before going any further, configure your WebObjects development environment so that your development application launches and [[runs thru apache>>doc:documentation.Home.How-tos.Development Tools-Running Through Apache.WebHome]] using the host name "localhost".
26
27 == Configuring Apache for [[https:~~/~~/localhost>>url:https://localhost||shape="rect"]] ==
28
29 === Make the private key and SSL certificate ===
30
31 Normally creating SSL certificates for production use is quite involved, however since we are just doing localhost development and testing, we can bypass all the mumbo-jumbo and create the minimal unpassworded private key and SSL certificate the easy way. Do not use this method for creating production server SSL certificates!
32
33 Open terminal and follow the commands shown below in my transcript which is self-explanatory if you are familiar with Terminal...
34
35 {{noformat}}
36
37 mymac$ cd /etc/apache2/
38 mymac$ sudo -s
39
40 bash-3.2# mkdir devsslcerts
41 bash-3.2# cd devsslcerts/
42
43
44 {{/noformat}}
45
46 Next run the one single openssl command that will make the two files we need in their final folder that we just created above.
47 Note you will be asked for a bunch of info for the certificate. Follow what I have done below. **In particular, enter "localhost" in the Common Name field!**
48
49 {{noformat}}
50
51 bash-3.2# openssl req -days 3650 -new -x509 -nodes -out localhost_server.crt -keyout localhost_server.key
52
53 Generating a 1024 bit RSA private key
54 .........................++++++
55 .....++++++
56 writing new private key to 'localhost_server.key'
57 -----
58 You are about to be asked to enter information that will be incorporated
59 into your certificate request.
60 What you are about to enter is what is called a Distinguished Name or a DN.
61 There are quite a few fields but you can leave some blank
62 For some fields there will be a default value,
63 If you enter '.', the field will be left blank.
64 -----
65 Country Name (2 letter code) [AU]:US
66 State or Province Name (full name) [Some-State]:Florida
67 Locality Name (eg, city) []:Tampa
68 Organization Name (eg, company) [Internet Widgits Pty Ltd]:Five WebObjects Sailors, Inc.
69 Organizational Unit Name (eg, section) []:Software Engineering Department
70 Common Name (eg, YOUR name) []:localhost
71 Email Address []:developer@webobjects.com
72
73 bash-3.2# ls -al
74 total 16
75 drwxr-xr-x 4 root wheel 136 Jul 21 16:58 .
76 drwxr-xr-x 10 root wheel 340 Jul 21 16:56 ..
77 -rw-r--r-- 1 root wheel 1497 Jul 21 16:58 localhost_server.crt
78 -rw-r--r-- 1 root wheel 887 Jul 21 16:58 localhost_server.key
79
80
81 {{/noformat}}
82
83 === Configure Apache2 to Use Your Development Certificates for localhost ===
84
85 Using your favorite command line editor, edit the apache config file at
86 **/etc/apache2/httpd.conf**
87 making the changes shown in the following 2 screenshots:
88
89 {{panel title="Setting Apache server name to localhost"}}
90 [[image:attach:step1_servernamelocalhost.jpg]]
91 {{/panel}}
92
93 {{panel title="Including SSL Configuration file into main Apache config file"}}
94 [[image:attach:step2_includesslconfig.jpg]]
95 {{/panel}}
96
97 Next edit the ssl config file itself at
98 **/etc/apache2/extra/httpd-ssl.conf**
99 making the changes shown in the following sceenshot:
100
101 {{panel title="Setting up the SSL Config file"}}
102 [[image:attach:step3_sslconfig.jpg]]
103 {{/panel}}
104
105 Restart apache
106
107 {{noformat}}
108
109 bash-3.2# apachectl graceful
110
111 {{/noformat}}
112
113 ~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-
114
115 JEFF SCHMITZ
116
117 Right at this point I got the error:
118
119 ulimit: open files: cannot modify limit: Invalid arg
120
121 After a quick google search I found this which seems to have fixed the error:
122
123 [[http:~~/~~/www.perkiset.org/forum/all_things_apple/apache_osx_and_ulimit_a_little_chunk_of_weirdness-t909.0.html>>url:http://www.perkiset.org/forum/all_things_apple/apache_osx_and_ulimit_a_little_chunk_of_weirdness-t909.0.html||shape="rect"]]
124
125 Also, for my https:~/~/... links my rewrite rules in apache weren't getting fired. To get them to work I had to add them to the httpd-ssl.conf file just below the General setup stuff shown in the figure above. I just copied them from my httpd.conf file and pasted them in. Not sure if this is the best way to handle it, but it's working for me on my development machine at least.
126
127 ~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-
128
129 Finally, verify that https is working:
130
131 {{panel title="Verify https://localhost is working"}}
132 [[image:attach:httpslocalhost2.jpg]]
133 {{/panel}}
134
135 == Detecting SSL ==
136
137 Code for detecting whether SSL is active for the current request:
138 I'm told this won't work with IIS:
139
140 {{code}}
141
142 // Is this page being accessed securely?
143 boolean secureMode = false;
144 String header = context.request().headerForKey("https");
145 if( header == null ) {
146 log.debug( "no https header, looking for server_port" );
147 header = context.request().headerForKey( "server_port" );
148 if( header == null ) {
149 log.debug( "no server_port header found, assuming insecure connection" );
150 } else {
151 log.debug( "server_port header found, using it" );
152 secureMode = header.equals( "443" );
153 }
154 } else {
155 log.debug( "https header found, using it" );
156 secureMode = header.equals( "on" );
157 }
158 log.debug( "secure mode set to " + secureMode );
159
160 {{/code}}
161
162 == Using SSL in DirectConnect ==
163
164 Mike Schrag said in early 2011 that it was possible to use SSL in DirectConnect, that is was simply hidden. A property was added to enable it, and instructions added to the Properties file of ERExtensions. This is the part from the Properties file:
165
166 {{code}}
167
168
169 ## You should probably not enable any of these settings in a normal Apache webserver deployment,
170 ## in particular the ssl port property, as this is used by ERX to generate https URLs, which must
171 ## match your Apache config.
172 ##
173 ## To enable SSL support with DirectConnect, you must do the following:
174 ##
175 ## * In your Resources folder, run "keytool -genkey -alias WebObjects -keyalg RSA -keystore adaptorssl.key". Select a
176 ## password for your keystore (i.e. "changeit"), and set the "your first name and last name" field to match the hostname
177 ## that you will be running your directconnect app off of.
178 ## * In your Resources folder, create an executable script (it MUST BE EXECUTABLE) named "adaptorsslpassphrase" with the
179 ## contents:
180 ## echo changeit
181 ## where you should replace "changeit" for whatever password you selected in the previous step.
182 ## * Set the following property to true
183 #er.extensions.ERXApplication.ssl.enabled=true
184
185 ## (optional) To specify an SSL host name other than what is returned from a call to
186 ## application.host(), you can override it below
187 #er.extensions.ERXApplication.ssl.host=localhost
188
189 ## (optional) To select an SSL port other than 443, uncomment the following. If you are already running Apache with SSL,
190 ## you probably want to set this. If the port number is 0, the SSL port will be automatically assigned (using the same
191 ## mechanism that WO uses to set the regular port)
192 #er.extensions.ERXApplication.ssl.port=0
193
194 {{/code}}