If you have been following any recent security news, you have probably heard of the POODLE security flaw that uses a SSL 3.0 fallback vulnerability. There are lots of options that you can (and should if you are setting up a production server) configure for the SSL Engine, including the supported ciphers and the ordering of the ciphers used. ` #Server Certificate: SSLCertificateFile '/private/etc/apache2/ssl/' #Server Private Key: SSLCertificateKeyFile '/private/etc/apache2/ssl/' SSL Engine Options My nf file is located at: /etc/apache2/nf I also recommend using Textmate, and then you can just replace 'nano' with 'mate' in the following commands. To modify the nf file we will use nano text editor. OK, now that we know why we are doing this, let's dive it.įirst, simply uncomment the following line in the nf file. The risks to users and privacy are at the highest levels today, and I suspect that the risks will only increase, while our users will increasingly expect the protection of their privacy.

The real reason for using HTTPS is to secure the web. In later blog posts I will show how we will perform the migration to HTTPS. In an effort to support HTTPS Everywhere we are migrating our website to use HTTPS.

Optionally specify new testing domain in our hosts fileįirst, let's answer a simple question: 'Why?'.Modify ssl config file, adding our new virtual host bound to port 443.

Now, we are going to go through the steps necessary to set up HTTPS on our local Apache web server: If you followed along then you created the following files in the /etc/apache2/ssl folder: In a previous post I showed you how to create a self-signed certificate. In this post we'll be using HTTP with Apache on OS X Yosemite.

Set up local web server mac