How to get rid of the pass-phrase dialog at Apache startup

Here's the problem:
You got SSL certificate from any issuer, you are happy that you can now use https!
You've installed your site, tuned your apache server to listen 443 port and include the certificate for your virtual host.... and you stuck with entering pass phrase each time when you restart apache! Even worse, you have not too much visitors on your site and your apache server shuts down to free resources. And it just can't start without entering that damn pass phrase!

Here's the solution (found here):
The reason why this dialog pops up at startup and every re-start is that the RSA private key inside your server.key file is stored in encrypted format for security reasons. The pass-phrase is needed to be able to read and parse this file. When you can be sure that your server is secure enough you perform two steps:

  1. Remove the encryption from the RSA private key (while preserving the original file):
          $ cp server.key server.key.org
          $ openssl rsa -in server.key.org -out server.key
  2. Make sure the server.key file is now only readable by root:
          $ chmod 400 server.key

Now server.key will contain an unencrypted copy of the key. If you point your server at this file it will not prompt you for a pass-phrase. HOWEVER, if anyone gets this key they will be able to impersonate you on the net. PLEASE make sure that the permissions on that file are really such that only root or the web server user can read it (preferably get your web server to start as root but run as another server, and have the key readable only by root).

As an alternative approach you can use the "SSLPassPhraseDialog exec:/path/to/program'' facility (more here). But keep in mind that this is neither more nor less secure, of course.

Comments

Post new comment

The content of this field is kept private and will not be shown publicly.
  • Allowed HTML tags: <em> <strong> <cite> <ul> <ol> <li> <dl> <dt> <dd>
  • Lines and paragraphs break automatically.
  • You may post code using <code>...</code> (generic) or <?php ... ?> (highlighted PHP) tags.

More information about formatting options

CAPTCHA
This question is for testing whether you are a human visitor and to prevent automated spam submissions.
Image CAPTCHA
Copy the characters (respecting upper/lower case) from the image.
© 2008-2009. Konstantin Artemov