建站
咨詢
售后
建站咨詢
新聞中心
本次壞境：CA和apache為同一臺(tái)主機(jī)
先使本機(jī)作為CA服務(wù)端：
[root@localhost~]#yum -y install openssl openssl-devel
[root@localhost~]#vi /etc/pki/tls/openssl.cnf
[ CA_default ]
dir = ../../CA
改為：
[ CA_default ]
dir= /etc/pki/CA
為了減少不必要的重復(fù)操作，可以預(yù)先定義[ req_distinguished_name ]下面的一些內(nèi)容，自定義即可，具體的就不多說(shuō)了
:wq
[root@localhost~]#cd /etc/pki/CA
[root@localhost CA]# mkdir certs newcerts crl
[root@localhost CA]# touch index.txt
[root@localhost CA]# echo 00 > serial
[root@localhost CA]# (umask 077; openssl genrsa -out private/cakey.pem 2048) ##生成自簽密鑰
[root@localhost CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 3657 ##生成自簽證書(shū)
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [BJ]:
Locality Name (eg, city) [HaiDian]:
Organization Name (eg, company) [TEXT]:
Organizational Unit Name (eg, section) [DEV]:
Common Name (eg, your name or your server's hostname) []:ca.text.com
Email Address []:[email protected]
由于openssl.cnf里面定義了部分內(nèi)容，上面一直敲回車(chē)，直到Common Name (eg, your name or your server's hostname) []: （此為CA服務(wù)名稱(chēng)，可自定義）
最后一個(gè)郵箱也可自定義
都敲完后，我們的CA服務(wù)端就完成了，繼續(xù)往下做
Apache動(dòng)態(tài)編譯安裝：
[root@localhost CA]# tar -xf httpd-2.2.9.tar -C /usr/local/src/
[root@localhost CA]#cd /usr/local/src/httpd-2.2.9/
[root@localhost httpd-2.2.9]# ./configure --prefix=/usr/local/apache2 --sysconfdir=/etc/httpd --with-z=/usr/local/zlib/ --with-included-apr --enable-so --enable-mods-shared=most
[root@localhost httpd-2.2.9]#make;make install
Apache配置ssl：
[root@localhost CA]# rpm -qa |grep mod_ssl
[root@localhost CA]# yum -y install mod_ssl ##如沒(méi)有mod_ssl直接使用yum安裝即可
[root@localhost CA]# rpm -ql mod_ssl ##查看mod_ssl生成的配置文件位置
[root@localhost CA]# cd /etc/httpd
[root@localhost httpd]# mkdir ssl
[root@localhost httpd]# cd ssl
[root@localhost ssl]# (umask 077; openssl genrsa -out httpd.key 2048) ##生成密鑰
[root@localhost ssl]#openssl req -new -key httpd.key -out httpd.csr ##生成證書(shū)簽署請(qǐng)求
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [BJ]:
Locality Name (eg, city) [HaiDian]:
Organization Name (eg, company) [TEXT]:
Organizational Unit Name (eg, section) [DEV]:
## 上面五條一定要和CA服務(wù)器設(shè)置一致，本次實(shí)驗(yàn)都是在一臺(tái)主機(jī)上，所以直接敲回車(chē)即可
Common Name (eg, your name or your server's hostname) []:text.bj.com ##一定要是客戶端訪問(wèn)的地址，而不是上面CA設(shè)置的地址
Email Address []:[email protected] ##自定義
[root@localhost ssl]#openssl ca -in httpd.csr -out httpd.crt -days 3657 ## ca簽署命令，敲兩次y和回車(chē)即可（由于都在一臺(tái)機(jī)器上，直接簽署就可以了，如果在不同機(jī)器上，把http的證書(shū)簽署請(qǐng)求文件拷貝到CA服務(wù)端簽署后拷貝回來(lái)就可以了）
[root@localhost ssl]#vi /etc/httpd/conf.d/ssl.conf
默認(rèn)443端口不變
查看下面兩句是否存在，不存在加上
AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl .crl
改為：
添加下面兩句
ServerName text.bj.com ##上面定義的地址
DocumentRoot "/var/www/html" ##網(wǎng)站目錄位置，如設(shè)置的虛擬主機(jī)，此位置需和apache配置文件里虛擬主機(jī)定義的位置一致
SSLEngine on ##確保開(kāi)啟
SSLCertificateFile /etc/httpd/ssl/httpd.crt ## 證書(shū)存放位置
SSLCertificateKeyFile /etc/httpd/ssl/httpd.key ##密鑰存放位置
:wq
[root@localhost ssl]#echo text.bj.com > /var/www/html/index.html
[root@localhost ssl]#/etc/init.d/httpd start
[root@localhost ssl]#netstat –tnlp ##查看443端口是否開(kāi)啟
訪問(wèn)https://text.bj.com
提示“該網(wǎng)站的安全證書(shū)不受信任”
解決：
拷貝/etc/pki/CA/cacert.pem到客戶端上安裝即可（winPC后綴改為.crt后雙擊安裝）
文章題目：Apache配置SSL實(shí)現(xiàn)https訪問(wèn)-創(chuàng)新互聯(lián)
轉(zhuǎn)載來(lái)于：http://fisionsoft.com.cn/article/psjes.html
