These instructions explain how you can have CodeIgniter (or any other php framework) load certain pages using ssl.
SSLFOLDER will always load using SSL, regardless of whether https:// was used or not when calling the controller.
Here are the instructions I used under Ubuntu 10.04
Step 1: Create Self-Signed SSL Certificate
I used the steps outlined here:
https://help.ubuntu.com/8.04/serverguide/C/certificates-and-security.html
Summary
Go to the home directory by executing the following command:
cd ~
Generate the keys for the Certificate Signing Request (CSR) by running the following command:
openssl genrsa -des3 -out server.key 2048
Enter an 8+ character passphrase when prompted.
Create the Certificate Signing Request (CSR) using the following command:
openssl req -new -key server.key -out server.csr
OPTION 1: If you are actually going to be in production, then at this point you would submit the CSR to an online certificate authority (CA) for processing. Then you would continue using the CRT file received from the CA.
OPTION 2: For non-production environments, you can create the self-signed certificate using the following command:
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
Then copy the certificate and key to their corresponding folders:
sudo cp server.crt /etc/ssl/certs
sudo cp server.key /etc/ssl/private
Step 2: Edit Apache 2 configuration files (Ubuntu)
Edit /etc/apache2/sites-enabled/000-default
Insert the following outside of the <VirtualHost *:80></VirtualHost> tags
The top of the file works.
<VirtualHost *:443>
SSLEngine on
SSLCertificateFile /etc/ssl/certs/server.crt
SSLCertificateKeyFile /etc/ssl/private/server.key
DocumentRoot /var/www
</VirtualHost>
Step 3: Enable the SSL module in Apache 2
Enable the SSL module in Apache 2 by running the following command:
a2enmod ssl
Step 4: Restart Apache 2 Web Server
Run this command from the command line:
sudo /etc/init.d/apache2 restart
Enter the passphrase you previously chose when generating the CSR
CodeIgniter Related Steps
I found a useful post on configuring CodeIgniter to always redirect protected pages to the SSL site.
I chose Option 1 and did the following:
Edit the file /system/application/config/config.php, and set the base_url to the non-ssl site as follows:
$config['base_url'] = "http://www.yoursite.com/";
Then edit /etc/apache2/sites-enabled/000-default and under the <VirtualHost *:80> tag enter the following for each folder you'd like to protect with SSL
RedirectPermanent /sslfolder https://www.yoursite.com/sslfolder
NOTE: Omit the trailing slash after sslfolder
That's it, now restart Apache using Step 4 instructions and visit
http://www.yoursite.com/sslfolder
You should see that sslfolder is now shown using SSL
If you see SSL errors stating an invalid certificate its because you're using a SELF-SIGNED certificate. This is fine for testing, but for production you'll need to get a CRT file by buying one from an online Certificate Authority.
HINT: Try GoDaddy and use one of their online coupons for a discount.
Visit one of my sponsors: