...............................................................................................

SSLCertificateKeyFile /usr/local/etc/apache/ssl.key/server.key

...............................................................................................

The default httpd.conf in the apache13−ssl port includes some "glue" to tell the system to listen for SSL connections on port 443, the standard TCP port for secure connections. By telling Apache where the certificate and key files live, Apache knows to accept SSL connections.

That's it! Your default Web site is now up and offers secure Net connections through SSL. (To set up additional secure sites with virtual hosts, see the "Virtual Hosting" section later in the chapter.)

Note It's best to avoid the term "secure Web server" when you mean SSL. While the encryption on traffic between the server and the client prevents packet sniffing, attackers could still break into either the server or the client. A secure Web server requires good Web page design, server maintenance, and educated users and administrators.

Controlling Apache

Apache is a complicated program that can be managed in several different ways. As with every other program, FreeBSD includes startup and shutdown scripts in /usr/local/etc/rc.d (see Chapter 11). Apache includes its own custom program to manage the Web server.

You can also manipulate the Web server program directly. For example, you can use the system startup/shutdown script manually to start or stop the Web server, as discussed in Chapter 11.

...............................................................................................

#/usr/local/etc/rc.d/apache.sh start

#/usr/local/etc/rc.d/apache.sh stop

...............................................................................................

This works, but is very limited. For more careful control of Apache, use the apachectl(8) command.

Controlling Apache with Apachectl

You can start, stop, and check Apache with Apache's special−handling command, apachectl(8). While most of apachectl's options are related to starting and stopping the Web server daemon, you can also use it to check your configuration or see how well your Apache server is running. These options are configtest, status, fullstatus, start, startssl, graceful, and stop.

This starts Apache:

...............................................................................................

# apachectl start

...............................................................................................

The following command starts Apache with SSL support:

...............................................................................................

# apachectl startssl

352

...............................................................................................

You must have SSL support in your Apache setup for this to work.

This next command stops Apache, terminating all open connections immediately:

...............................................................................................

# apachectl stop

...............................................................................................

To do a "graceful restart," allowing existing HTTP connections to complete and then restart Apache, use this command:

...............................................................................................

# apachectl graceful

...............................................................................................

It can take a long time to complete, however.

This next command gives you a status screen, full of detailed information about your server's current condition:

...............................................................................................

# apachectl fullstatus

...............................................................................................

It requires lynx(1) (available in /usr/ports/www/lynx).

The next command gives you a quick−and−dirty status report, also in lynx:

...............................................................................................

# apachectl status

...............................................................................................

This next command runs apachectl configtest.

...............................................................................................

# apachectl restart

...............................................................................................

If the configuration is acceptable, it kills all httpd processes immediately and then restarts Apache.

The next command checks your Apache configuration and will tell you if there's something wrong with httpd.conf or one of its related files:

353

...............................................................................................

# apachectl configtest

...............................................................................................

Many other apachectl subcommands call configtest before acting, just to be sure that Apache will successfully restart.

Other Ways to Control Httpd

The apachectl program doesn't work well when you are running a heavily customized Apache instance. For example, if you combine FrontPage with SSL, Apache expects to be started with arguments for both. While you could use apachectl configtest, stop, restart, and graceful, you would have to specify all the various flags for these add−on modules in a way that apachectl accepts, which can be a pain. Using the httpd command directly is much simpler in these cases.

While httpd has many command−line options, the one that concerns us most is −D, which defines behavior for the server. For example, to tell Apache to start with SSL support, you would use the following command:

...............................................................................................

# httpd −DSSL

...............................................................................................

To start Apache with FrontPage support, use −Dfp:

...............................................................................................

# httpd −Dfp

...............................................................................................

As you might guess, you can combine these:

...............................................................................................

# httpd −DSSL −Dfp

...............................................................................................

The exact define you need will be described in the Apache module's documentation.

Note I've seen some heavily moduled servers that require nine or ten −D statements to start properly. If your server starts picking up modules, edit /usr/local/etc/rc.d/apache.sh to manage Apache properly, and use that to control the server, rather than using apachectl.

Apache Modules

Apache is a modular server, which means that you can add and remove pieces of server code. Apache can handle such diverse things as Microsoft FrontPage Extensions, scripting languages such as PHP, and embedded Perl. There are also such things as Apache modules to compress each page before you send it, vastly decreasing bandwidth. Each module is a port under /usr/ports/www. Module port names begin with "mod_", such as mod_gzip.

354