httpd

httpd is the HTTP server used in OpenBSD. In this article I will guide you through setting up a website with HTTPS using httpd.

httpd configuration

Edit /etc/httpd.con to setup httpd. Below is a very simple configuration.


            # Replace all occurences of "caztanj.com" with your domain.

server "caztanj.com" {
    # Make this a non secure HTTP (without the S) server.
    listen on * port 80

    # Used when acme-client is negotiating a TLS certificate.
    location "/.well-known/acme-challenge/*" {
        root "/acme"
        request strip 2
    }

    # Redirect all requests to this non secure HTTP server to
    # our secure HTTP server defined below.
    location "*" {
        block return 301 "https://$HTTP_HOST$REQUEST_URI"
    }
}

server "caztanj.com" {
    # Make this a secure HTTPS server.
    listen on * tls port 443

    # Serve files from /var/www/htdocs/caztanj.com.
    root "/htdocs/caztanj.com"

    # If there is a .gz file for the requested file, use that instead.
    # You need to manually make a .gz file for all your files.
    gzip-static

    # Must be the same paths as configured in acme-client.
    tls {
        certificate "/etc/ssl/caztanj.com.pem"
        key "/etc/ssl/private/caztanj.com.key"
    }
}

Check that the configuration is valid with the command doas httpd -n. Then enable and start the HTTP server with the commands doas rcctl enable httpd and doas rcctl start httpd.

acme-client

acme-client is the program that negotiates a TLS certificate for you. It is configured by editing the /etc/acme-client.conf file. Below is a simple configuration that will work with the httpd configuration above.


            # Replace all occurences of "caztanj.com" with your domain.

# We will be using lets encrypt which is free but any authority
# that implements the acme protocol can be used.
authority letsencrypt {
    api url "https://acme-v02.api.letsencrypt.org/directory"
    account key "/etc/ssl/private/letsencrypt.key"
}

domain caztanj.com {
    domain key "/etc/ssl/private/caztanj.com.key"
    domain certificate "/etc/ssl/caztanj.com.crt"
    domain full chain certificate "/etc/ssl/caztanj.com.pem"
    sign with letsencrypt
}

The certificate is obtained by running the command acme-client caztanj.com. Replace caztanj.com with your domain. Then restart httpd with the command doas rcctl restart httpd. If everything went well you should now have you website working with a valid TLS certificate.

The certificate needs to be renewed periodically. This can be done by editing the root crontab with doas crontab -e and adding the line below. Remember to replace caztanj.com with your domain.


            0       0       *       *       *       acme-client caztanj.com && rcctl restart httpd