Configuring Apache and SSL Encryption

Applies to: Predict! Risk Controller 6 and Higher

 

Overview

By default, Predict! Risk Controller runs on port 8080.

Installing Apache HTTPD as a proxy front-end removes the need for users to include a port number in the URL.

SSL can then be configured to encrypt all traffic between the server and users' browsers.

 

Installing Apache HTTPD

1. Locate the Apache24 folder in the installation media scripts folder and copy it to the Predict! installation directory
   1. (e.g. C:\prc6\Apache24).
2. Open the configuration file at \prc6\Apache24\conf\httpd.conf in a text editor.
3. Update the following values to match the installation:
   1. ServerRoot
   2. DocumentRoot
   3. Directory
   4. ServerAdmin
4. If Predict! was not installed to C:\prc6, update the paths accordingly.
5. Confirm these directives reference the correct port (default 8080)
   1. ProxyPass
   2. ProxyPassReverse
6. Open an administrative Command Prompt, navigate to \prc6\Apache24\bin, and run these commands:

httpd -k install

• • If no errors are reported, start Apache by running:

httpd -k start

• • Test that Apache is running by accessing Predict! from a client machine without specifying a port number in the URL.

Note: Apache starts automatically whenever Windows restarts once installed.

 

Configure SSL Encryption

Step 1 — Set the OpenSSL configuration path

• In an Admin Command Prompt, navigate to:
  • \prc6\Apache24\bin
• Run this command:

set OPENSSL_CONF=c:\prc6\Apache24\conf\openssl.cnf

Note: This is a temporary environment variable and will be cleared when the Command Prompt is closed.

 

Step 2 — Configure Subject Alternative Names (SANs)

• Open the file: 
  • notepad c:\prc6\Apache24\conf\openssl.cnf
• In the [ v3_req ] section:
  • add: subjectAltName = @alt_names
• Add an [ alt_names ] section, listing the DNS names for the certificate.
• Save and close the file.

 

Step 3 — Generate a Certificate Signing Request (CSR)

• Run the command:
  • openssl req -new -out certificates/server.csr -config c:\prc6\Apache24\conf\openssl.cnf

• When prompted
  • enter a PEM passphrase
  • the server's Fully Qualified Domain Name as the Common Name.

 

Step 4 — Remove the passphrase from the private key

• Run the command:
  • openssl rsa -in certificates/privkey.pem -out certificates/server.key

• Delete the .rnd file created during this process to prevent security risks.

 

Step 5 — Sign the certificate (2 Options)

Option A — Self-signed (for internal/testing use):

openssl x509 -in certificates/server.csr -out certificates/server.cert -req -signkey certificates/server.key -days 365

Option B — Certificate Authority signed (recommended for production):

• • Open certificates/server.csr in a text editor.
  • Copy the content from -----BEGIN CERTIFICATE REQUEST----- to -----END CERTIFICATE REQUEST-----.
  • Submit to a Certificate Authority (e.g. Verisign) following their instructions.
  • Place the signed certificate file received into C:\prc6\Apache24\bin\certificates.

 

Step 6 — Configure Apache for SSL

• Open the file:
  • notepad c:\prc6\Apache24\conf\extra\httpd-ssl.conf
• Update the certificate paths to reference the files generated above.
• Save the file.

 

Step 7 — Enable SSL modules in Apache

• Open the file:
  •  \prc6\Apache24\conf\httpd.conf
• Remove the # from the beginning of these lines:
  • LoadModule ssl_module
  • LoadModule socache_shmcb_module
  • LoadModule headers_module
  • Include conf/extra/httpd-ssl.conf
• Save the file.

 

Step 8 — Restart Apache

• Run the command:
  • httpd -k restart

• Access Predict! via HTTPS to confirm SSL is working.

 

Install the Certificate on Client Machines (Self-Signed Only)

• On the application server, open a web browser and go to Tools > Internet Options (or equivalent).
• Navigate to the certificate management area and open the Certificate Import Wizard.
• Browse to the certificate file and click Open.
• Select Trusted Root Certification Authorities and click OK.
• Click Next, then Finish to complete the import.

 

Redirect HTTP to HTTPS

• Open the file:
  •  \prc6\Apache24\conf\httpd.conf
• Remove the # from:
  • LoadModule rewrite_module modules/mod_rewrite.so
• Add the rewrite rules above the <IfModule proxy_module> section
  • (see article text for exact syntax).
• Restart Apache: httpd -k restart
• Attempt to access Predict! via HTTP
  • the browser should redirect to HTTPS automatically.

 

Troubleshooting

• If Apache fails to start after SSL configuration
  • check log files at \prc6\Apache24\logs for details on the error.
• If a client browser shows a certificate warning for a self-signed certificate
  • install the certificate on that client machine using the steps above.
• If you have questions about certificate formats (.pem, .pfx, chains), fill out a Support form from the Lumivero Community Support Page.