Enable SSL in Apache for 'localhost' (OSX, El Capitan)

ApacheHTTPSConfig.md

Enable SSL in Apache (OSX)

The following will guide you through the process of enabling SSL on a Apache webserver

• The instructions have been verified with OSX El Capitan (10.11.2) running Apache 2.4.16
• The instructions assume you already have a basic Apache configuration enabled on OSX, if this is not the case feel free to consult Gist: "Enable Apache HTTP server (OSX)"

Apache SSL Configuration

Create a directory within /etc/apache2/ using Terminal.app: sudo mkdir /etc/apache2/ssl
Next, generate two host keys:

sudo openssl genrsa -out /etc/apache2/server.key 2048
sudo openssl genrsa -out /etc/apache2/ssl/localhost.key 2048
sudo openssl rsa -in /etc/apache2/ssl/localhost.key -out /etc/apache2/ssl/localhost.key.rsa

Create a configuration file using Terminal.app: sudo touch /etc/apache2/ssl/localhost.conf
Edit the newly created configuration file and add the following:

[req]
default_bits = 1024
distinguished_name = req_distinguished_name
req_extensions = v3_req

[req_distinguished_name]

[v3_req]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names

[alt_names]
DNS.1 = localhost
DNS.2 = *.localhost

Generate the required Certificate Requests using Terminal.app:

sudo openssl req -new -key /etc/apache2/server.key -subj "/C=/ST=/L=/O=/CN=/emailAddress=/" -out /etc/apache2/server.csr
sudo openssl req -new -key /etc/apache2/ssl/localhost.key.rsa -subj "/C=/ST=/L=/O=/CN=localhost/" -out /etc/apache2/ssl/localhost.csr -config /etc/apache2/ssl/localhost.conf

Note: Complete the values C= ST= L= O= CN= to reflect your own organizational structure, where:

• C= eq. Country: The two-letter ISO abbreviation for your country.
• ST= eq. State or Province: The state or province where your organization is legally located.
• L= eq. City or Locality: The city where your organization is legally located.
• O= eq. Organization: he exact legal name of your organization.
• CN= eq. Common Name: The fully qualified domain name for your web server

Use the Certificate Requests to sign the SSL Certificates using Terminal.app:

sudo openssl x509 -req -days 365 -in /etc/apache2/server.csr -signkey /etc/apache2/server.key -out /etc/apache2/server.crt
sudo openssl x509 -req -extensions v3_req -days 365 -in /etc/apache2/ssl/localhost.csr -signkey /etc/apache2/ssl/localhost.key.rsa -out /etc/apache2/ssl/localhost.crt -extfile /etc/apache2/ssl/localhost.conf

Add the SSL Certificate to Keychain Access.

sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /etc/apache2/ssl/localhost.crt

Apache Configuration

Edit the Apache main configuration file /etc/apache2/httpd.conf and enable the required modules to support SSL :

LoadModule socache_shmcb_module libexec/apache2/mod_socache_shmcb.so
LoadModule ssl_module libexec/apache2/mod_ssl.so

Enable Secure (SSL/TLS) connections

Include /private/etc/apache2/extra/httpd-ssl.conf

Apache Virtual Host Configuration

Edit the Virtual Hosts file /etc/apache2/extra/httpd-vhosts.conf and add the SSL Directive at the end of the file:

<VirtualHost *:443>
    ServerName localhost
    DocumentRoot "/Library/WebServer/Documents"

    SSLEngine on
    SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
    SSLCertificateFile /etc/apache2/ssl/localhost.crt
    SSLCertificateKeyFile /etc/apache2/ssl/localhost.key

    <Directory "/Library/WebServer/Documents">
        Options Indexes FollowSymLinks
        AllowOverride All
        Order allow,deny
        Allow from all
        Require all granted
    </Directory>
</VirtualHost>

Finally restart Apache using Terminal.app : sudo apachectl restart
Open Safari and visit https://localhost to verify your configuration.

For those using Homebrew Apache, check your /extra/httpd-ssl.conf file for what port it is set to listen to (usually 8443). Update your <VirtualHost *:8443> in httpd-vhosts.conf file to match that. Then, you have to access localhost via https://localhost:8443

should I do the same thing if I am running php -S 127.0.0.1:8080 ? <VirtualHost *:8080> to make the php work for https?

Using the built-in Apache on macOS Mojave, I first received the "Forbidden" error as well. After a fair amount of poking around, I resolved it simply by updating the corresponding Virtual Host entry in httpd-vhosts.conf from :80 to :443.

Chrome still threw a security warning like it would for an invalid certificate, but I just chose to "Proceed" and saw my site load normally.

Following the process, and it worked nicely for me.

rlaurente: If you mean enable SSL for multiple virtual hosts, just add them to the server.cnf file's extensions.

subjectAltName = @alt_names

[alt_names]
DNS.1 = localhost
DNS.2 = my.local.host
DNS.3 = my.other.local.host
DNS.4 = local.version.of.production.com

Add all the virtual hosts you have configured or any you might want to set up in the foreseeable future so you don't need to generate another certificate each time you add a new virtual host.

Be sure to use the -extfile argument with the x509 command to point to the server.cnf file. (You don't need to include the -extensions argument if req_extensions is defined in the configuration file.)

If you really meant "how can we enable multiple virtual hosts?" See the Apache Webserver documentation.

On macOS 10.14 I had to enable vhosts generally in the httpd.conf ... just search for "vhost" and uncomment as needed.

I followed these instructions, worked great with one exception: got an error in Chrome: Error: "Subject Alternative Name Missing" or NET::ERR_CERT_COMMON_NAME_INVALID or "Your connection is not private"

The fix was to change 2 of the steps above to include the Subject Alternative Name on these lines:
sudo openssl req -new -key /etc/apache2/server.key -subj "/C=US/ST=OK/L=TULSA/O=NONE/CN=localhost/subjectAlternativeName=localhost/emailAddress=[email protected]/" -out /etc/apache2/server.csr
sudo openssl req -new -key /etc/apache2/ssl/localhost.key.rsa -subj "/C=US/ST=OK/L=TULSA/O=NONE/CN=localhost/subjectAlternativeName=localhost/emailAddress=[email protected]/" -out /etc/apache2/ssl/localhost.csr -config /etc/apache2/ssl/localhost.conf

What do I have to do/replace after 365 days when the certificate expires?

to fix Google chrome, follow this:

https://www.robpeck.com/2010/10/google-chrome-mac-os-x-and-self-signed-ssl-certificates/

Thank you, it works!

For the Homebrew apache i had to first delete the ...... from /etc/apache2/extra/httpd-ssl.conf and add to above mentioned <VirtualHost *:443> ... . Now it's working cool.

amazing :) works on first try for my MAC OS with apache2

Thanks, worked on Mac OS Mojave.

great help - it also works on Mac OS Catalina 10.15.7 and Apache 2.4.46 (installed with homebrew)

Thank you very much! I did exactly what is written and it worked initially :)
I got the warning that not trusted but I accepted it and it is gone.

frank
Mac OS 10.11.6 with Apache 2.4 and PHP 7.4

To fix chrome blocking you
Visit: chrome://flags/#allow-insecure-localhost on chrome and enable "Allow invalid certificates for resources loaded from localhost."

@felixkipyego Or you can use a self-assigned certificate. Then you won't get warnings in any browser. I have documented steps in a gist here: https://gist.github.com/smohadjer/cacacd14eed0881bc576d501cdf98e7d

Congratulations - with 10.13.6 and (from amazing MacPorts) Apache 2.4.46 (Php 7.4.16) and some changes in path (/opt/local/etc/... instead /etc/...) https is working with localhost (or xxxx-i5-imac.local) for website in /Library/WebServer/Documents and in /Users/~loginname/Sites... Bravo ! (a good way to understand ssl and test locally WP web sites in dev...)

it returns
Forbidden
You don't have permission to access / on this server.
I fixed it by un-commenting
Include /private/etc/apache2/extra/httpd-vhosts.conf
in /etc/apache2/httpd.conf
I think the guide missed this part.

https://flaviocopes.com/macos-install-ssl-local/

Update for installation on macOS 13 (Ventura),Apache/2.4.54 (Unix):

• in /etc/apache2/httpd.conf file:
  uncomment line - "Include /private/etc/apache2/extra/httpd-vhosts.conf"

• in /etc/apache2/extra/httpd-ssl.conf file:
  uncomment of remove all lines between the following:

# remove all lines here as otherwise any effective directives here will override settings in "/etc/apache2/extra/httpd-vhost.conf" file

Listen 443

Thanks, this helps.