Web Security, Privacy & Commerce, 2nd Edition

Creating SSL Servers with FreeBSD

In this section, we demonstrate how to install and configure the Apache web server with mod_ssl on the FreeBSD operating system.

History

The history of the Apache web server is well documented and will only briefly be recounted here. Basically, Tim Berners-Lee wrote the original web server while on staff at CERN. Rob McCool at the National Center for Supercomputing Applications wrote a web server that implemented the same HTTP protocol; the server was called NCSA httpd. By the time that McCool left NCSA in 1994, that server had become the most popular web server on the Internet, and at that point the project stalled. A group of webmasters got together and decided to resurrect the project. They took a number of patches and improvements and created the first release of the Apache (“a patchy”) web server in April 1995.

When the first Apache web server was released, it did not implement Netscape’s Secure Sockets Layer encryption system. This technical restriction came about because of two legal restrictions—intellectual property law and export control law. From an intellectual property perspective, the SSL protocol required the use of the RSA public key algorithm, which was protected by patent, and the RC2 or RC4 algorithms, which RSA claimed were protected by trade secret, even though the two algorithms had been reverse-engineered and posted to the Internet.

And even if an implementation of SSL was created that did not infringe upon the RSA property ...