rootninja

Setup a place to call home for your certificate

# mkdir -p /etc/lighttpd/ssl
# cd /etc/lighttpd/ssl

Here’s where the magic happens… If you want a trusted CA on the internet, you’ll just want to create a certificate signing request, but a self-signed cert will do just fine. I made it good for ~10 years, but standard is probably just 365 days.

# openssl req -new -x509 -keyout server.pem -out server.pem -days 3650 -nodes

Protect your ssl cert and directory.

# chown -R lighttpd:lighttpd /etc/lighttpd/ssl
# chmod 0600 /etc/lighttpd/ssl

Now edit the lighttpd.conf configuration file to enable ssl. Use the public facing interface’s IP address instead of mine, unless yours happens to be 192.168.1.2 too!

$SERVER["socket"] == “192.168.1.2:443″ {
server.document-root = “/var/www/lighttpd”
ssl.engine = “enable”
ssl.pemfile = “/etc/lighttpd/ssl/server.pem”

Restart the server and you should be able to connect via http:// or https://

# /etc/init.d/lighttpd restart

And nmap or netstat will let you know it’s listening on port 443

# nmap -sS -T5 192.168.1.2 | grep 443
# netstat -lpn | grep 443