Civetweb supports HTTPS connections using the OpenSSL transport layer security (TLS) library. OpenSSL is a free, open source library (see http://www.openssl.org/).
The configuration file must contain an https port, identified by a letter ‘s’ attached to the port number. To serve http and https from their standard ports use the following line in the configuration file ‘civetweb.conf’:
To serve only https use:
Furthermore the SSL certificate file must be set:
OpenSSL provides a command line interface, that can be used to create the certificate file required by civetweb (server.pem).
One can use the following steps in Windows (in Linux replace “copy” by “cp” and “type” by “cat”):
The server.pem file created must contain a ‘CERTIFICATE’ section as well as a ‘RSA PRIVATE KEY’ section. It should look like this (x represents BASE64 encoded data):
CivetWeb requires one certificate file in PEM format. If you got multiple files from your certificate authority, you need to copy their content together into one file. Make sure the file has one section BEGIN RSA PRIVATE KEY / END RSA PRIVATE KEY, and at least one section BEGIN CERTIFICATE / END CERTIFICATE. In case you received a file with a section BEGIN PRIVATE KEY / END PRIVATE KEY, you may get a suitable file by adding the letters RSA manually.
Set the “ssl_certificate” configuration parameter to the file name (including path) of the resulting *.pem file.
The file must look like the file in the section “Creating a self signed certificate”, but it will have several BEGIN CERTIFICATE / END CERTIFICATE sections.
In case the OpenSSL configuration is not set up correctly, the server will not start. Configure an error log file in ‘civetweb.conf’ to get more information:
Check the content of ‘error.log’:
This error message means, the SSL library has not been installed (correctly). For Windows you might use the pre-built binaries. A link is available at the OpenSSL project home page (http://www.openssl.org/related/binaries.html). Choose the windows system folder as installation directory - this is the default location.
These error messages indicate, that the format of the ssl_certificate file does not match the expectations of the SSL library. The PEM file must contain both, a ‘CERTIFICATE’ and a ‘RSA PRIVATE KEY’ section. It should be a strict ASCII file without byte-order marks. The instructions above may be used to create a valid ssl_certificate file.