title: How enabling SSL with localhost in ubuntu
body: <p>I want to run Https in my localhost 'lamp' in Ubuntu lunix 14.04. 
  I'm a certificate and copied the certificate in: </p>
  
  <pre><code>/opt/lamp/ect/ssl.key/sslnewkey.key
  </code></pre>
  
  <p>and I've copied the key private in:</p>
  
  <pre><code>/opt/lamp/ect/ssl.crt/sslnewcet.crt
  </code></pre>
  
  <p>And I've added in /opp/lamp/etc/httpd.conf:</p>
  
  <pre><code>LoadModule ssl_module modules/mod_ssl.so
  </code></pre>
  
  <p>What is the next step? </p>
  
  <p>My httpd-ssl-config is: </p>
  
  <pre><code>#
  # This is the Apache server configuration file providing SSL support.
  # It contains the configuration directives to instruct the server how to
  # serve pages over an https connection. For detailed information about these 
  # directives see &lt;URL:http://httpd.apache.org/docs/trunk/mod/mod_ssl.html&gt;
  # 
  # Do NOT simply read the instructions in here without understanding
  # what they do.  They're here only as hints or reminders.  If you are unsure
  # consult the online docs. You have been warned.  
  #
  # Required modules: mod_log_config, mod_setenvif, mod_ssl,
  #          socache_shmcb_module (for default value of SSLSessionCache)
  
  #
  
  
  Listen 443
  
  SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
  
  SSLPassPhraseDialog  builtin
  
  SSLSessionCache        "shmcb:/opt/lampp/logs/ssl_scache(512000)"
  SSLSessionCacheTimeout  300
  
  &lt;VirtualHost _default_:443&gt;
  
  DocumentRoot "/opt/lampp/htdocs"
  ServerName www.example.com:443
  ServerAdmin you@example.com
  ErrorLog "/opt/lampp/logs/error_log"
  TransferLog "/opt/lampp/logs/access_log"
  
  #   SSL Engine Switch:
  #   Enable/Disable SSL for this virtual host.
  SSLEngine on
  
  #   Server Certificate:
  #   Point SSLCertificateFile at a PEM encoded certificate.  If
  #   the certificate is encrypted, then you will be prompted for a
  #   pass phrase.  Note that a kill -HUP will prompt again.  Keep
  #   in mind that if you have both an RSA and a DSA certificate you
  #   can configure both in parallel (to also allow the use of DSA
  #   ciphers, etc.)
  #   Some ECC cipher suites (http://www.ietf.org/rfc/rfc4492.txt)
  #   require an ECC certificate which can also be configured in
  #   parallel.
  SSLCertificateFile "/opt/lampp/etc/ssl.crt/serfver.crt"
  #SSLCertificateFile "/opt/lampp/etc/server-dsa.crt"
  #SSLCertificateFile "/opt/lampp/etc/server-ecc.crt"
  
  #   Server Private Key:
  #   If the key is not combined with the certificate, use this
  #   directive to point at the key file.  Keep in mind that if
  #   you've both a RSA and a DSA private key you can configure
  #   both in parallel (to also allow the use of DSA ciphers, etc.)
  #   ECC keys, when in use, can also be configured in parallel
  SSLCertificateKeyFile "/opt/lampp/etc/ssl.key/server.key"
  #SSLCertificateKeyFile "/opt/lampp/etc/ssl.key/server.key"
  #SSLCertificateKeyFile "/opt/lampp/etc/ssl.crt/server.crt"
  
  #   Server Certificate Chain:
  #   Point SSLCertificateChainFile at a file containing the
  #   concatenation of PEM encoded CA certificates which form the
  #   certificate chain for the server certificate. Alternatively
  #   the referenced file can be the same as SSLCertificateFile
  #   when the CA certificates are directly appended to the server
  #   certificate for convenience.
  #SSLCertificateChainFile "/opt/lampp/etc/server-ca.crt"
  
  #   Certificate Authority (CA):
  #   Set the CA certificate verification path where to find CA
  #   certificates for client authentication or alternatively one
  #   huge file containing all of them (file must be PEM encoded)
  #   Note: Inside SSLCACertificatePath you need hash symlinks
  #         to point to the certificate files. Use the provided
  #         Makefile to update the hash symlinks after changes.
  #SSLCACertificatePath "/opt/lampp/etc/ssl.crt"
  #SSLCACertificateFile "/opt/lampp/etc/ssl.crt/ca-bundle.crt"
  
  #   Certificate Revocation Lists (CRL):
  #   Set the CA revocation path where to find CA CRLs for client
  #   authentication or alternatively one huge file containing all
  #   of them (file must be PEM encoded).
  #   The CRL checking mode needs to be configured explicitly
  #   through SSLCARevocationCheck (defaults to "none" otherwise).
  #   Note: Inside SSLCARevocationPath you need hash symlinks
  #         to point to the certificate files. Use the provided
  #         Makefile to update the hash symlinks after changes.
  #SSLCARevocationPath "/opt/lampp/etc/ssl.crl"
  #SSLCARevocationFile "/opt/lampp/etc/ssl.crl/ca-bundle.crl"
  #SSLCARevocationCheck chain
  
  #   Client Authentication (Type):
  #   Client certificate verification type and depth.  Types are
  #   none, optional, require and optional_no_ca.  Depth is a
  #   number which specifies how deeply to verify the certificate
  #   issuer chain before deciding the certificate is not valid.
  #SSLVerifyClient require
  #SSLVerifyDepth  10
  
  #   Access Control:
  #   With SSLRequire you can do per-directory access control based
  #   on arbitrary complex boolean expressions containing server
  #   variable checks and other lookup directives.  The syntax is a
  #   mixture between C and Perl.  See the mod_ssl documentation
  #   for more details.
  #&lt;Location /&gt;
  #SSLRequire (    %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \
  #            and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
  #            and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
  #            and %{TIME_WDAY} &gt;= 1 and %{TIME_WDAY} &lt;= 5 \
  #            and %{TIME_HOUR} &gt;= 8 and %{TIME_HOUR} &lt;= 20       ) \
  #           or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
  #&lt;/Location&gt;
  
  #   SSL Engine Options:
  #   Set various options for the SSL engine.
  #   o FakeBasicAuth:
  #     Translate the client X.509 into a Basic Authorisation.  This means that
  #     the standard Auth/DBMAuth methods can be used for access control.  The
  #     user name is the `one line' version of the client's X.509 certificate.
  #     Note that no password is obtained from the user. Every entry in the user
  #     file needs this password: `xxj31ZMTZzkVA'.
  #   o ExportCertData:
  #     This exports two additional environment variables: SSL_CLIENT_CERT and
  #     SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
  #     server (always existing) and the client (only existing when client
  #     authentication is used). This can be used to import the certificates
  #     into CGI scripts.
  #   o StdEnvVars:
  #     This exports the standard SSL/TLS related `SSL_*' environment variables.
  #     Per default this exportation is switched off for performance reasons,
  #     because the extraction step is an expensive operation and is usually
  #     useless for serving static content. So one usually enables the
  #     exportation for CGI and SSI requests only.
  #   o StrictRequire:
  #     This denies access when "SSLRequireSSL" or "SSLRequire" applied even
  #     under a "Satisfy any" situation, i.e. when it applies access is denied
  #     and no other module can change it.
  #   o OptRenegotiate:
  #     This enables optimized SSL connection renegotiation handling when SSL
  #     directives are used in per-directory context. 
  #SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
  &lt;FilesMatch "\.(cgi|shtml|phtml|php)$"&gt;
      SSLOptions +StdEnvVars
  &lt;/FilesMatch&gt;
  &lt;Directory "/opt/lampp/cgi-bin"&gt;
      SSLOptions +StdEnvVars
  &lt;/Directory&gt;
  
  #   SSL Protocol Adjustments:
  #   The safe and default but still SSL/TLS standard compliant shutdown
  #   approach is that mod_ssl sends the close notify alert but doesn't wait for
  #   the close notify alert from client. When you need a different shutdown
  #   approach you can use one of the following variables:
  #   o ssl-unclean-shutdown:
  #     This forces an unclean shutdown when the connection is closed, i.e. no
  #     SSL close notify alert is sent or allowed to be received.  This violates
  #     the SSL/TLS standard but is needed for some brain-dead browsers. Use
  #     this when you receive I/O errors because of the standard approach where
  #     mod_ssl sends the close notify alert.
  #   o ssl-accurate-shutdown:
  #     This forces an accurate shutdown when the connection is closed, i.e. a
  #     SSL close notify alert is send and mod_ssl waits for the close notify
  #     alert of the client. This is 100% SSL/TLS standard compliant, but in
  #     practice often causes hanging connections with brain-dead browsers. Use
  #     this only for browsers where you know that their SSL implementation
  #     works correctly. 
  #   Notice: Most problems of broken clients are also related to the HTTP
  #   keep-alive facility, so you usually additionally want to disable
  #   keep-alive for those clients, too. Use variable "nokeepalive" for this.
  #   Similarly, one has to force some clients to use HTTP/1.0 to workaround
  #   their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
  #   "force-response-1.0" for this.
  BrowserMatch "MSIE [2-5]" \
           nokeepalive ssl-unclean-shutdown \
           downgrade-1.0 force-response-1.0
  
  CustomLog "/opt/lampp/logs/ssl_request_log" \
            "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
  
  &lt;/VirtualHost&gt;
  </code></pre>
  
  <p>and my httpd-confg is  : </p>
  
  <pre><code>    #
  # This is the main Apache HTTP server configuration file.  It contains the
  # configuration directives that give the server its instructions.
  # See &lt;URL:http://httpd.apache.org/docs/trunk/&gt; for detailed information.
  # In particular, see 
  # &lt;URL:http://httpd.apache.org/docs/trunk/mod/directives.html&gt;
  # for a discussion of each configuration directive.
  #
  # Do NOT simply read the instructions in here without understanding
  # what they do.  They're here only as hints or reminders.  If you are unsure
  # consult the online docs. You have been warned.  
  #
  # Configuration and logfile names: If the filenames you specify for many
  # of the server's control files begin with "/" (or "drive:/" for Win32), the
  # server will use that explicit path.  If the filenames do *not* begin
  # with "/", the value of ServerRoot is prepended -- so 'log/access_log'
  # with ServerRoot set to '/www' will be interpreted by the
  # server as '/www/log/access_log', where as '/log/access_log' will be
  # interpreted as '/log/access_log'.
  
  #
  # ServerRoot: The top of the directory tree under which the server's
  # configuration, error, and log files are kept.
  #
  # Do not add a slash at the end of the directory path.  If you point
  # ServerRoot at a non-local disk, be sure to specify a local disk on the
  # Mutex directive, if file-based mutexes are used.  If you wish to share the
  # same ServerRoot for multiple httpd daemons, you will need to change at
  # least PidFile.
  #
  ServerRoot "/opt/lampp"
  
  # 
  # Mutex: Allows you to set the mutex mechanism and mutex file directory
  # for individual mutexes, or change the global defaults
  # 
  # Uncomment and change the directory if mutexes are file-based and the default
  # mutex file directory is not on a local disk or is not appropriate for some
  #Listen 127.0.0.1:80
  listen 80
  
  #
  # Dynamic Shared Object (DSO) Support
  #
  # To be able to use the functionality of a module which was built as a DSO you
  # have to place corresponding `LoadModule' lines at this location so the
  # directives contained in it are actually available _before_ they are used.
  # Statically compiled modules (those listed by `httpd -l') do not need
  # to be loaded here.
  #
  # Example:
  # LoadModule foo_module modules/mod_foo.so
  #
  LoadModule authn_file_module modules/mod_authn_file.so
  LoadModule authn_dbm_module modules/mod_authn_dbm.so
  LoadModule authn_anon_module modules/mod_authn_anon.so
  LoadModule authn_dbd_module modules/mod_authn_dbd.so
  LoadModule authn_socache_module modules/mod_authn_socache.so
  LoadModule authn_core_module modules/mod_authn_core.so
  LoadModule authz_host_module modules/mod_authz_host.so
  LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
  LoadModule authz_user_module modules/mod_authz_user.so
  LoadModule authz_dbm_module modules/mod_authz_dbm.so
  LoadModule authz_owner_module modules/mod_authz_owner.so
  LoadModule authz_dbd_module modules/mod_authz_dbd.so
  LoadModule authz_core_module modules/mod_authz_core.so
  LoadModule authnz_ldap_module modules/mod_authnz_ldap.so
  LoadModule access_compat_module modules/mod_access_compat.so
  LoadModule auth_basic_module modules/mod_auth_basic.so
  LoadModule auth_form_module modules/mod_auth_form.so
  LoadModule auth_digest_module modules/mod_auth_digest.so
  LoadModule allowmethods_module modules/mod_allowmethods.so
  LoadModule file_cache_module modules/mod_file_cache.so
  LoadModule cache_module modules/mod_cache.so
  LoadModule cache_disk_module modules/mod_cache_disk.so
  LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
  LoadModule socache_dbm_module modules/mod_socache_dbm.so
  LoadModule socache_memcache_module modules/mod_socache_memcache.so
  LoadModule dbd_module modules/mod_dbd.so
  LoadModule bucketeer_module modules/mod_bucketeer.so
  LoadModule dumpio_module modules/mod_dumpio.so
  LoadModule echo_module modules/mod_echo.so
  LoadModule case_filter_module modules/mod_case_filter.so
  LoadModule case_filter_in_module modules/mod_case_filter_in.so
  LoadModule buffer_module modules/mod_buffer.so
  LoadModule ratelimit_module modules/mod_ratelimit.so
  LoadModule reqtimeout_module modules/mod_reqtimeout.so
  LoadModule ext_filter_module modules/mod_ext_filter.so
  LoadModule request_module modules/mod_request.so
  LoadModule include_module modules/mod_include.so
  LoadModule filter_module modules/mod_filter.so
  LoadModule substitute_module modules/mod_substitute.so
  LoadModule sed_module modules/mod_sed.so
  LoadModule charset_lite_module modules/mod_charset_lite.so
  LoadModule deflate_module modules/mod_deflate.so
  LoadModule mime_module modules/mod_mime.so
  LoadModule ldap_module modules/mod_ldap.so
  LoadModule log_config_module modules/mod_log_config.so
  LoadModule log_debug_module modules/mod_log_debug.so
  LoadModule logio_module modules/mod_logio.so
  LoadModule env_module modules/mod_env.so
  LoadModule mime_magic_module modules/mod_mime_magic.so
  LoadModule cern_meta_module modules/mod_cern_meta.so
  LoadModule expires_module modules/mod_expires.so
  LoadModule headers_module modules/mod_headers.so
  LoadModule usertrack_module modules/mod_usertrack.so
  LoadModule unique_id_module modules/mod_unique_id.so
  LoadModule setenvif_module modules/mod_setenvif.so
  LoadModule version_module modules/mod_version.so
  LoadModule remoteip_module modules/mod_remoteip.so
  LoadModule proxy_module modules/mod_proxy.so
  LoadModule proxy_connect_module modules/mod_proxy_connect.so
  LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
  LoadModule proxy_http_module modules/mod_proxy_http.so
  LoadModule proxy_fcgi_module modules/mod_proxy_fcgi.so
  LoadModule proxy_scgi_module modules/mod_proxy_scgi.so
  LoadModule proxy_ajp_module modules/mod_proxy_ajp.so
  LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
  LoadModule proxy_express_module modules/mod_proxy_express.so
  LoadModule session_module modules/mod_session.so
  LoadModule session_cookie_module modules/mod_session_cookie.so
  LoadModule session_dbd_module modules/mod_session_dbd.so
  LoadModule slotmem_shm_module modules/mod_slotmem_shm.so
  LoadModule ssl_module modules/mod_ssl.so
  LoadModule lbmethod_byrequests_module modules/mod_lbmethod_byrequests.so
  LoadModule lbmethod_bytraffic_module modules/mod_lbmethod_bytraffic.so
  LoadModule lbmethod_bybusyness_module modules/mod_lbmethod_bybusyness.so
  LoadModule lbmethod_heartbeat_module modules/mod_lbmethod_heartbeat.so
  LoadModule unixd_module modules/mod_unixd.so
  LoadModule dav_module modules/mod_dav.so
  LoadModule status_module modules/mod_status.so
  LoadModule autoindex_module modules/mod_autoindex.so
  LoadModule info_module modules/mod_info.so
  LoadModule suexec_module modules/mod_suexec.so
  LoadModule cgi_module modules/mod_cgi.so
  LoadModule cgid_module modules/mod_cgid.so
  LoadModule dav_fs_module modules/mod_dav_fs.so
  LoadModule vhost_alias_module modules/mod_vhost_alias.so
  LoadModule negotiation_module modules/mod_negotiation.so
  LoadModule dir_module modules/mod_dir.so
  LoadModule actions_module modules/mod_actions.so
  LoadModule speling_module modules/mod_speling.so
  LoadModule userdir_module modules/mod_userdir.so
  LoadModule alias_module modules/mod_alias.so
  LoadModule rewrite_module modules/mod_rewrite.so
  
  &lt;IfDefine JUSTTOMAKEAPXSHAPPY&gt;
  LoadModule php4_module        modules/libphp4.so
  LoadModule php5_module        modules/libphp5.so
  &lt;/IfDefine&gt;
  
  &lt;IfModule unixd_module&gt;
  #
  # If you wish httpd to run as a different user or group, you must run
  # httpd as root initially and it will switch.  
  #
  # User/Group: The name (or #number) of the user/group to run httpd as.
  # It is usually good practice to create a dedicated user and group for
  # running httpd, as with most system services.
  #
  User daemon
  Group daemon
  &lt;/IfModule&gt;
  
  # 'Main' server configuration
  #
  # The directives in this section set up the values used by the 'main'
  # server, which responds to any requests that aren't handled by a
  # &lt;VirtualHost&gt; definition.  These values also provide defaults for
  # any &lt;VirtualHost&gt; containers you may define later in the file.
  #
  # All of these directives may appear inside &lt;VirtualHost&gt; containers,
  # in which case these default settings will be overridden for the
  # virtual host being defined.
  #
  ServerAdmin you@example.com
  
  #
  #ServerName www.example.com:@@Port@@
  # XAMPP
  ServerName localhost
  &lt;Directory /&gt;
      AllowOverride none
      Require all denied
  &lt;/Directory&gt;
  
  DocumentRoot "/opt/lampp/htdocs"
  &lt;Directory "/opt/lampp/htdocs"&gt;
      Options Indexes FollowSymLinks ExecCGI Includes
      AllowOverride All
  
      Require all granted
  &lt;/Directory&gt;
  &lt;IfModule dir_module&gt;
      #DirectoryIndex index.html
      # XAMPP
      DirectoryIndex index.html index.html.var index.php index.php3 index.php4
  &lt;/IfModule&gt;
  
  &lt;Files ".ht*"&gt;
      Require all denied
  &lt;/Files&gt;
  ErrorLog "logs/error_log"
  
  LogLevel warn
  
  &lt;IfModule log_config_module&gt;
      #
      # The following directives define some format nicknames for use with
      # a CustomLog directive (see below).
      #
      LogFormat "%h %l %u %t \"%r\" %&gt;s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
      LogFormat "%h %l %u %t \"%r\" %&gt;s %b" common
  
      &lt;IfModule logio_module&gt;
        # You need to enable mod_logio.c to use %I and %O
        LogFormat "%h %l %u %t \"%r\" %&gt;s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
      &lt;/IfModule&gt;
  
      CustomLog "logs/access_log" common
  
      #
      # If you prefer a logfile with access, agent, and referer information
      # (Combined Logfile Format) you can use the following directive.
      #
      #CustomLog "logs/access_log" combined
  &lt;/IfModule&gt;
  
  &lt;IfModule alias_module&gt;
      #
      # Redirect: Allows you to tell clients about documents that used to 
      ScriptAlias /cgi-bin/ "/opt/lampp/cgi-bin/"
  
  &lt;/IfModule&gt;
  
  &lt;IfModule cgid_module&gt;
  &lt;/IfModule&gt;
  
  &lt;Directory "/opt/lampp/cgi-bin"&gt;
      AllowOverride None
      Options None
      Require all granted
  &lt;/Directory&gt;
  
  &lt;IfModule mime_module&gt;
      #
      # TypesConfig points to the file containing the list of mappings from
      # filename extension to MIME-type.
      #
      TypesConfig etc/mime.types
  
      #
      # AddType allows you to add to or override the MIME configuration
      # file specified in TypesConfig for specific file types.
      #
      AddType application/x-compress .Z
      AddType application/x-gzip .gz .tgz
      AddType text/html .shtml
      AddOutputFilter INCLUDES .shtml
  &lt;/IfModule&gt;
  
  
  EnableMMAP off
  EnableSendfile off
  
  # Supplemental configuration
  #
  # The configuration files in the etc/extra/ directory can be 
  # included to add extra features or to modify the default configuration of 
  # the server, or you may simply copy their contents here and change as 
  # necessary.
  
  # Server-pool management (MPM specific)
  #Include etc/extra/httpd-mpm.conf
  
  # Multi-language error messages
  Include etc/extra/httpd-multilang-errordoc.conf
  
  # Fancy directory listings
  Include etc/extra/httpd-autoindex.conf
  
  # Language settings
  #Include etc/extra/httpd-languages.conf
  
  # User home directories
  #Include etc/extra/httpd-userdir.conf
  
  # Real-time info on requests and configuration
  #Include etc/extra/httpd-info.conf
  
  # Virtual hosts
  #Include etc/extra/httpd-vhosts.conf
  
  # Local access to the Apache HTTP Server Manual
  #Include etc/extra/httpd-manual.conf
  
  # Distributed authoring and versioning (WebDAV)
  #Include etc/extra/httpd-dav.conf
  
  # Various default settings
  Include etc/extra/httpd-default.conf
  
  # Configure mod_proxy_html to understand HTML4/XHTML1
  &lt;IfModule proxy_html_module&gt;
  Include etc/extra/proxy-html.conf
  &lt;/IfModule&gt;
  
  # Secure (SSL/TLS) connections
  &lt;IfModule ssl_module&gt;
  # XAMPP
  &lt;IfDefine SSL&gt;
  Include etc/extra/httpd-ssl.conf
  &lt;/IfDefine&gt;
  &lt;/IfModule&gt;
  #
  # Note: The following must must be present to support
  #       starting without SSL on platforms with no /dev/random equivalent
  #       but a statically compiled-in mod_ssl.
  #
  &lt;IfModule ssl_module&gt;
  SSLRandomSeed startup builtin
  SSLRandomSeed connect builtin
  &lt;/IfModule&gt;
  
  # XAMPP
  Include etc/extra/httpd-xampp.conf
  Include "/opt/lampp/apache2/conf/httpd.conf"
  LoadModule ssl_module modules/mod_ssl.so
  Listen 90
  </code></pre>
  
  <p>When run, the following error is returned:</p>
  
  <blockquote>
    <p>An error occurred during a connection to 127.0.0.1. SSL received a
    record that exceeded the maximum permissible length. (Error code:
    ssl_error_rx_record_too_long)</p>
  </blockquote>