1. создадим сертефикаты:

#openssl genrsa -des3 -rand /dev/random -out server.key 2048 // результатом будет один файл - server.key

#openssl rsa -in server.key -out newserver.key
#cp newserver.key server.key

#openssl rsa -in server.key -out server.pem
#openssl req -new -key server.key -out server.csr
#openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

# cp server.* /usr/local/etc/apache22/

2. добавляем в httpd.conf строку:

      Include etc/apache22/extra/httpd-ssl.conf

3. Создаем файл /usr/local/etc/apache22/echo. Это sh-скрипт, который выводит на экран пароль от секретного ключа:

# cat /usr/local/etc/apache22/echo
     #!/bin/sh
     /bin/echo   UnAiWosk+AyRattIvRoshEtt4JenBorrEv3MawbEjifEttujEyRio

# ls -la /usr/local/etc/apache22/echo
-rwx------  1 root  wheel  27 Feb 12 09:54 /usr/local/etc/apache22/echo

Необходим для того, чтобы при перезагрузке apache не спрашивал парольную фразу.

To make apache receive the passphrase everytime it restarts, add this to the httpd.conf: SSLPassPhraseDialog exec:/path/to/passphrase-file

В результате правильной настройки должны получить подтверждающее сообщение в лог-файле. # tail /usr/site/logs/httpd-error.log

[Thu Sep 12 01:01:53 2013] [notice] Apache/2.2.25 (FreeBSD) DAV/2 mod_ssl/2.2.25 OpenSSL/1.0.1e 
PHP/5.5.3 mod_perl/2.0.8 Perl/v5.14.4 configured -- resuming normal operations

Securing Apache with SSL
Generating Self-Signed SSL Certificates.

%openssl genrsa -rand random.dat -out server.key 1024
%openssl req -new -key server.key -out server.csr
%cp server.key server.key.org
%openssl rsa -in server.key.org -out server.key
%openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
Then move these files to your Apache server's configuration directory, such as /etc/ssl/apache22/, and then add the following lines in your httpd.conf configuration file:

SSLCertificateFile "/etc/ssl/apache22/server.crt"
SSLCertificateKeyFile "/etc/ssl/apache22/server.key"
Generating the private key..

%openssl genrsa -out server.key 1024

In the first step, we generate the private key. private key residing on the server and the public key going out with each connection to the server and encrypting data sent back to the server. The first argument passed to the openssl program tells openssl that we want to generate an RSA key (genrsa), which is an encryption algorithm that all major browsers support.You may, if you wish, specify an argument telling openssl what to use as the source of randomness. The -rand flag will accept one or more filenames (for example:-rand file1:file2:file3), which will be used as a key for the random number generator. If no -rand argument is provided, OpenSSL will attempt to use /dev/urandom by default if that exists, and it will try /dev/random if /dev/urandom does not exist. It is important to have a good source of randomness in order for the encryption to be secure. An argument of"1024" is specified, which tells openssl how many bytes of randomness to use in generating the key.

Литература:

    ISBN: 0-7645-4821-2 Mohammed J.Kabir "Apache Server 2 Bible" 

Free SSL Certificate 90 days

Бесплатные SSL-сертификаты на 2 года с поддержкой до 100 доменов

SSL-сертификаты: всем, каждому, и пусть никто не уйдёт обиженным