Setup HTTPS in XAMPP for Localhost
Uploaded by
Njazi RamadaniSetup HTTPS in XAMPP for Localhost
Uploaded by
Njazi RamadaniOpen in app Get started
Mubasheer Shaik · Follow
May 24, 2019 · 3 min read
Setup ‘https’ in XAMPP for localhost
Steps involved:
1. Create certificate
2. Config Apache to access https instead of http
3. Config mod rewrite to generate SSL url
4. Config Virtual host to test site
Step 1 : Create certificate
Go to your XAMPP installation directory (in my case it’s E:\xampp), figure out apache
folder. In this, find & run batch file named [Link]
A CMD window will appear like that, this is where you setup your certificate to verify
Open in app Get started
your website. All you need is only typing all information that ‘s very easy, except one
information “Common Name”, at this you must be typed exactly your URL website.
For example in localhost, I will use a Virtual host URL (I will configure it later)
FYI — The generated .crt & .key will be stored in C:\xampp\apache\conf\[Link] and
C:\xampp\apache\conf\[Link] folders respectively. No need to move them, but you will
need to tell your [Link] file where they are (Step 4).
Step 2: My [Link] results:
<Directory "C:/xampp/htdocs/xampp">
<IfModule php7_module>
<Files "[Link]">
php_admin_flag safe_mode off
</Files>
</IfModule>
AllowOverride AuthConfig
SSLRequireSSL
</Directory>
Alias /phpmyadmin "C:/xampp/phpMyAdmin/"
<Directory "C:/xampp/phpMyAdmin">
Open in app Get started
AllowOverride AuthConfig
Require local
ErrorDocument 403 /error/XAMPP_FORBIDDEN.[Link]
SSLRequireSSL
</Directory>
Alias /webalizer "C:/xampp/webalizer/"
<Directory "C:/xampp/webalizer">
<IfModule php7_module>
<Files "[Link]">
php_admin_flag safe_mode off
</Files>
</IfModule>
AllowOverride AuthConfig
Require local
ErrorDocument 403 /error/XAMPP_FORBIDDEN.[Link]
SSLRequireSSL
</Directory>
Step 3: Config mod_rewrite to generate SSL url
I didn’t do as I didn’t need/want the force redirects. However below is the process.
This next optional step is to redirect “http” requests to “https” requests for the pages
we want to secure. This is more user friendly and allows you to still use http when you
type in the address (and automatically switch to https:// and encryption). If you don’t
do this, and you used SSLRequireSSL, you will only be able to access these pages by
typing [Link] This is fine and probably a little bit more secure, but is not so user
friendly. To accomplish the redirection, we will use mod_rewrite so that we don’t have
to use the server name in this part of the config file. This helps keep small the number
of places in the config files where the server name is written (making your config files
more maintainable).
First, we need to make sure that mod_rewrite is enabled. To do this, edit
E:\xampp\apache\conf\[Link] and get rid of the comment (# character) in this
line : #LoadModule rewrite_module modules/mod_rewrite.so Make it look like this
: LoadModule rewrite_module modules/mod_rewrite.so
Open in app Get started
Now paste all this text to the config file at address E:\xampp\apache\conf\extra\httpd-
[Link] (That is rewrite URL, if not, you can't access your site via SSL):
<IfModule mod_rewrite.c>
RewriteEngine On
# Redirect /xampp folder to https
RewriteCond %{HTTPS} !=on
RewriteCond %{REQUEST_URI} xampp
RewriteRule ^(.*) [Link] [R,L]
# Redirect /phpMyAdmin folder to https
RewriteCond %{HTTPS} !=on
RewriteCond %{REQUEST_URI} phpmyadmin
RewriteRule ^(.*) [Link] [R,L]
# Redirect /security folder to https
RewriteCond %{HTTPS} !=on
RewriteCond %{REQUEST_URI} security
RewriteRule ^(.*) [Link] [R,L]
# Redirect /webalizer folder to https
RewriteCond %{HTTPS} !=on
RewriteCond %{REQUEST_URI} webalizer
RewriteRule ^(.*) [Link] [R,L]
# Redirect /folder_name folder to https
RewriteCond %{HTTPS} !=on
RewriteCond %{REQUEST_URI} folder_name
Open in app Get started
RewriteRule ^(.*) [Link] [R,L]
</IfModule>
Step 4: My [Link] results:
<virtualhost *:443>
ServerAdmin webmaster@[Link]
DocumentRoot "C:/xampp/htdocs/awesomesite/"
ServerName [Link]
ServerAlias [Link]
ErrorLog "logs/[Link]"
CustomLog "logs/[Link]" common
SSLEngine on
SSLCertificateFile "conf/[Link]/[Link]"
SSLCertificateKeyFile "conf/[Link]/[Link]"
</virtualhost>
Note that chrome will indicate that the URL is Note Secure. This is normal for a non-
verified cert. No worries, you are good to go now.
Common questions
Powered by AIOmitting mod_rewrite in SSL configuration could negatively impact user experience by requiring users to manually enter the HTTPS version of the URL, as HTTP requests would not automatically redirect. This adds complexity for users who may inadvertently access less secure versions of the site, potentially missing the encryption that SSL provides. Ensuring an automated redirection to HTTPS improves user experience, as it simplifies access to secure pages without requiring additional actions from the user .
Using self-signed rather than verified SSL certificates in a local XAMPP setup offers the benefit of simplicity and cost-effectiveness, as it bypasses the need for a Certificate Authority verification. However, potential drawbacks include browser warnings that might confuse users about site security, and such certificates are not suitable for production environments, risking user distrust and potential security vulnerabilities if inadvertently used beyond local testing .
When Chrome marks a URL as 'Not Secure' even when HTTPS is configured, it typically indicates the use of a self-signed certificate, which is not trusted by browsers by default. This is common in local development environments like XAMPP, where developers generate certificates for testing purposes without verification from a recognized Certificate Authority. Although not an issue for local testing, it does remind developers that the certificate is non-verified and should not be used in production .
In local development environments, forcing redirects from HTTP to HTTPS might be unnecessary because developers often need to test HTTP-based functionalities alongside HTTPS ones without automatic redirection interference. Moreover, data privacy and protection are less of a concern in isolated local environments, reducing the need for mandatory encryption. Developers might prefer keeping HTTP access for convenience or specific testing scenarios where redirection poses challenges .
Improperly configured virtual host settings in a local XAMPP setup for HTTPS could lead to various issues such as misdirected traffic, failure to load resources, or unsecured connections. If the settings are not correctly pointing to the correct document root or domain names, the server might not serve the appropriate content or apply SSL certificates as intended, resulting in potential security vulnerabilities and configuration errors during local testing .
The SSLCertificateFile and SSLCertificateKeyFile directives in Apache configuration specify the paths to the SSL certificate and the corresponding private key files, respectively. These files are essential for establishing a secure connection between the client and the server by enabling the HTTPS protocol. They should point to the generated .crt and .key files within the 'conf/ssl.crt' and 'conf/ssl.key' directories of the XAMPP installation respectively, ensuring that the server has access to necessary components for SSL operations .
Enabling mod_rewrite enhances SSL configuration by automatically redirecting HTTP requests to HTTPS, ensuring the use of secure connections for specified directories. By adding specific rewrite rules to the configuration file, you streamline user experience by automatically securing their connection without requiring manual input of the HTTPS protocol. This ensures all data transmissions are encrypted, enhancing security in your local development environment .
Setting up HTTPS in XAMPP involves several steps: creating a certificate, configuring Apache to use HTTPS, optionally setting up mod_rewrite to ensure URLs are redirected from HTTP to HTTPS, and configuring a virtual host for your test site. The virtual host configuration allows you to simulate a real-world server environment locally by specifying domain-specific settings like SSL certificates. This setup is crucial for developing and testing web applications securely before deploying them to a production server .
Configuring the httpd-xampp.conf file is important when setting up HTTPS because it manages directives associated with server aliasing and SSL requirements. Proper configuration ensures that the server can handle requests securely while still maintaining functional access to services like phpMyAdmin and Webalizer. Failing to configure this file correctly can lead to unauthorized access issues or failure to enforce secure connections for specified app directories .
Alias directives in Apache configuration affect security settings by specifying alternative resource paths, allowing directory access configuration under different contexts. When configuring SSL for local test sites, these directives enable controlled access to services such as phpMyAdmin or Webalizer via HTTPS. However, improper use might expose sensitive resources if not secured with SSL, thus it is essential to enforce access permissions and SSL requirements for aliased paths to maintain server security .