Skip to content

Instantly share code, notes, and snippets.

Last active March 11, 2024 13:32
Show Gist options
  • Save nrollr/4daba07c67adcb30693e to your computer and use it in GitHub Desktop.
Save nrollr/4daba07c67adcb30693e to your computer and use it in GitHub Desktop.
Enable SSL in Apache for 'localhost' (OSX, El Capitan)

Enable SSL in Apache (OSX)

The following will guide you through the process of enabling SSL on a Apache webserver

  • The instructions have been verified with OSX El Capitan (10.11.2) running Apache 2.4.16
  • The instructions assume you already have a basic Apache configuration enabled on OSX, if this is not the case feel free to consult Gist: "Enable Apache HTTP server (OSX)"

Apache SSL Configuration

Create a directory within /etc/apache2/ using sudo mkdir /etc/apache2/ssl
Next, generate two host keys:

sudo openssl genrsa -out /etc/apache2/server.key 2048
sudo openssl genrsa -out /etc/apache2/ssl/localhost.key 2048
sudo openssl rsa -in /etc/apache2/ssl/localhost.key -out /etc/apache2/ssl/localhost.key.rsa

Create a configuration file using sudo touch /etc/apache2/ssl/localhost.conf
Edit the newly created configuration file and add the following:

default_bits = 1024
distinguished_name = req_distinguished_name
req_extensions = v3_req


basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names

DNS.1 = localhost
DNS.2 = *.localhost

Generate the required Certificate Requests using

sudo openssl req -new -key /etc/apache2/server.key -subj "/C=/ST=/L=/O=/CN=/emailAddress=/" -out /etc/apache2/server.csr
sudo openssl req -new -key /etc/apache2/ssl/localhost.key.rsa -subj "/C=/ST=/L=/O=/CN=localhost/" -out /etc/apache2/ssl/localhost.csr -config /etc/apache2/ssl/localhost.conf

Note: Complete the values C= ST= L= O= CN= to reflect your own organizational structure, where:

  • C= eq. Country: The two-letter ISO abbreviation for your country.
  • ST= eq. State or Province: The state or province where your organization is legally located.
  • L= eq. City or Locality: The city where your organization is legally located.
  • O= eq. Organization: he exact legal name of your organization.
  • CN= eq. Common Name: The fully qualified domain name for your web server

Use the Certificate Requests to sign the SSL Certificates using

sudo openssl x509 -req -days 365 -in /etc/apache2/server.csr -signkey /etc/apache2/server.key -out /etc/apache2/server.crt
sudo openssl x509 -req -extensions v3_req -days 365 -in /etc/apache2/ssl/localhost.csr -signkey /etc/apache2/ssl/localhost.key.rsa -out /etc/apache2/ssl/localhost.crt -extfile /etc/apache2/ssl/localhost.conf

Add the SSL Certificate to Keychain Access.

sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /etc/apache2/ssl/localhost.crt

Apache Configuration

Edit the Apache main configuration file /etc/apache2/httpd.conf and enable the required modules to support SSL :

LoadModule socache_shmcb_module libexec/apache2/
LoadModule ssl_module libexec/apache2/

Enable Secure (SSL/TLS) connections

Include /private/etc/apache2/extra/httpd-ssl.conf

Apache Virtual Host Configuration

Edit the Virtual Hosts file /etc/apache2/extra/httpd-vhosts.conf and add the SSL Directive at the end of the file:

<VirtualHost *:443>
    ServerName localhost
    DocumentRoot "/Library/WebServer/Documents"

    SSLEngine on
    SSLCertificateFile /etc/apache2/ssl/localhost.crt
    SSLCertificateKeyFile /etc/apache2/ssl/localhost.key

    <Directory "/Library/WebServer/Documents">
        Options Indexes FollowSymLinks
        AllowOverride All
        Order allow,deny
        Allow from all
        Require all granted

Finally restart Apache using : sudo apachectl restart
Open Safari and visit https://localhost to verify your configuration.

Copy link

For those using Homebrew Apache, check your /extra/httpd-ssl.conf file for what port it is set to listen to (usually 8443). Update your <VirtualHost *:8443> in httpd-vhosts.conf file to match that. Then, you have to access localhost via https://localhost:8443

Copy link

For me required to add row with "Listen 443" to httpd.conf.

Copy link

Thank you for great work, really worked!

Copy link

I'm confused about the routes . how does the httpd-vhosts.conf should to be routed for MAMP?

Copy link

This guide still works (macOS 10.13, httpd -v Apache 2.4.33)

Copy link

VizualAbstract commented Jul 17, 2018

Verified it works, too. Thanks so much!

I had to do a few additional changes because I changed my directory from /Library/WebServer/Documents to somewhere else.

MacOS 10.13.15 / Apache 2.4.33

I had to update it in /etc/apache2/httpd.conf, /private/etc/apache2/extra/httpd-ssl.conf and /private/etc/apache2/extra/httpd-vhosts.conf, so they all matched.

PS I went through this shortly after configuring dnsmasq.

Copy link

Thanks a lot!

Copy link

You have any video related on this https on local host

Copy link

this worked for me. the problem is I am not sure how to make php work with it. I tried turning on php to localhost:443 and it doesn't work although it does turn on. I can turn on php to another port but I'm trying to do a facebook login with php. Now I have php working and https on localhost working but I'm not sure how to make them work together. Any suggestions?

Copy link

For those using Homebrew Apache, check your /extra/httpd-ssl.conf file for what port it is set to listen to (usually 8443). Update your <VirtualHost *:8443> in httpd-vhosts.conf file to match that. Then, you have to access localhost via https://localhost:8443

should I do the same thing if I am running php -S ? <VirtualHost *:8080> to make the php work for https?

Copy link

Using the built-in Apache on macOS Mojave, I first received the "Forbidden" error as well. After a fair amount of poking around, I resolved it simply by updating the corresponding Virtual Host entry in httpd-vhosts.conf from :80 to :443.

Chrome still threw a security warning like it would for an invalid certificate, but I just chose to "Proceed" and saw my site load normally.

Copy link

Following the process, and it worked nicely for me.

Copy link

rlaurente: If you mean enable SSL for multiple virtual hosts, just add them to the server.cnf file's extensions.

subjectAltName = @alt_names

DNS.1 = localhost
DNS.2 =
DNS.3 =
DNS.4 =

Add all the virtual hosts you have configured or any you might want to set up in the foreseeable future so you don't need to generate another certificate each time you add a new virtual host.

Be sure to use the -extfile argument with the x509 command to point to the server.cnf file. (You don't need to include the -extensions argument if req_extensions is defined in the configuration file.)

If you really meant "how can we enable multiple virtual hosts?" See the Apache Webserver documentation.

Copy link

On macOS 10.14 I had to enable vhosts generally in the httpd.conf ... just search for "vhost" and uncomment as needed.

Copy link

I followed these instructions, worked great with one exception: got an error in Chrome: Error: "Subject Alternative Name Missing" or NET::ERR_CERT_COMMON_NAME_INVALID or "Your connection is not private"

The fix was to change 2 of the steps above to include the Subject Alternative Name on these lines:
sudo openssl req -new -key /etc/apache2/server.key -subj "/C=US/ST=OK/L=TULSA/O=NONE/CN=localhost/subjectAlternativeName=localhost/" -out /etc/apache2/server.csr
sudo openssl req -new -key /etc/apache2/ssl/localhost.key.rsa -subj "/C=US/ST=OK/L=TULSA/O=NONE/CN=localhost/subjectAlternativeName=localhost/" -out /etc/apache2/ssl/localhost.csr -config /etc/apache2/ssl/localhost.conf

Copy link

What do I have to do/replace after 365 days when the certificate expires?

Copy link

to fix Google chrome, follow this:

Copy link

dyarfi commented May 18, 2020

Thank you, it works!

Copy link

For the Homebrew apache i had to first delete the ...... from /etc/apache2/extra/httpd-ssl.conf and add to above mentioned <VirtualHost *:443> ... . Now it's working cool.

Copy link

amazing :) works on first try for my MAC OS with apache2

Copy link

Thanks, worked on Mac OS Mojave.

Copy link

great help - it also works on Mac OS Catalina 10.15.7 and Apache 2.4.46 (installed with homebrew)

Copy link

Thank you very much! I did exactly what is written and it worked initially :)
I got the warning that not trusted but I accepted it and it is gone.

Mac OS 10.11.6 with Apache 2.4 and PHP 7.4

Copy link

To fix chrome blocking you
Visit: chrome://flags/#allow-insecure-localhost on chrome and enable "Allow invalid certificates for resources loaded from localhost."

Copy link

@felixkipyego Or you can use a self-assigned certificate. Then you won't get warnings in any browser. I have documented steps in a gist here:

Copy link

Congratulations - with 10.13.6 and (from amazing MacPorts) Apache 2.4.46 (Php 7.4.16) and some changes in path (/opt/local/etc/... instead /etc/...) https is working with localhost (or xxxx-i5-imac.local) for website in /Library/WebServer/Documents and in /Users/~loginname/Sites... Bravo ! (a good way to understand ssl and test locally WP web sites in dev...)

Copy link

it returns
You don't have permission to access / on this server.
I fixed it by un-commenting
Include /private/etc/apache2/extra/httpd-vhosts.conf
in /etc/apache2/httpd.conf
I think the guide missed this part.

Copy link

Copy link

Leon16 commented Aug 8, 2022

Update for installation on macOS 13 (Ventura),Apache/2.4.54 (Unix):

  • in /etc/apache2/httpd.conf file:
    uncomment line - "Include /private/etc/apache2/extra/httpd-vhosts.conf"

  • in /etc/apache2/extra/httpd-ssl.conf file:
    uncomment of remove all lines between the following:

# remove all lines here as otherwise any effective directives here will override settings in "/etc/apache2/extra/httpd-vhost.conf" file

Copy link

Listen 443

Thanks, this helps.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment