1. Configure Apache for SSL. Create a server certificate and key file using the steps defined in the “generating_certificates” file in the Lesson 11 Lab Exercises.

2. Create a company web site with links to Sales and Marketing pages. Employees will be either in the sales group or the marketing group but not both. Use a local password file and group file to authenticate users in the sales and marketing groups respectively. When an employee on the Sales team clicks on the Sales link the employee will be asked for authentication and then the message “Welcome ‘username’ to the Sales Site” will be displayed. When a user on the Marketing team clicks on the Marketing link the employee will be asked for authentication and then the message “Welcome ‘username’ to the Marketing Site” will be displayed. Replace ‘username’ with the actual user login name. See the ‘index.html’ file for a sample default page for the site. You can use SSI, CGI, or PHP for your sales and marketing pages. Included at the bottom of this page is a sample CGI script that you can use with very little modification.
4. When you attempt to access the main page for your site using “https” you will get a warning saying “Your connection is not private”. This is because you are using a self-signed certificate. Click on the “Advanced” button and then proceed even though you will be warned that it is unsafe. This will take you to your main page. Just to the left of your URL will be a red triangle and the message “Not secure” in red. Click on this message and you will get a pop-up with message “Your connection to this site is not secure”. Also in the pop-up there will be a link to your certificate. Click on this link to show your certificate. This certificate should be the certificate you created in step 1 and it should be issued in your name.Take a screen shot of the certificate to include with your project files.

5. Place all your project relevant configuration directives in an “Include” file named “proj2.conf”. Do not place directives in the file that are not directly associated with this project.

6. Submit a report explaining what you have done and include your “proj2.conf” configuration file, credentials file, group file, and all html pages or cgi scripts in your site. Also include screen shots that show your SSL certificate and the HTTPS request and response headers for the authenticated request to your sales or marketing page. Sample screen shots from Firefox are included at the bottom of this page.

* Receive 10 bonus points for using Digest authentication.

Grading Rubric: