apache配置SSL

http://blog.chinaunix.net/uid-16979052-id-3549100.html

一&＃xff1a;制作根CA

　　要制作最高层认证中心&＃xff0c;可以以一般使用者权限来做&＃xff0c;不一定要是 root 。但如果做出来的最高层认证中心&＃xff0c;是整个组织签发凭证要用的&＃xff0c;建议以 root 的权限来做&＃xff0c;比较安全。同理&＃xff0c;制作凭证&＃xff0c;也可以以一般使用者权限来做。但如果做出来的凭证&＃xff0c;是这个伺服器要用的&＃xff0c;为安全起见&＃xff0c;建议以 root 的权限来做&＃xff0e;

　　1&＃xff1a;设定相关目录

[root&＃64;redhat ~]# mkdir -pv /etc/ssl 

mkdir: created directory &＃96;/etc/ssl&＃39; 

[root&＃64;redhat ~]# mkdir -pv /etc/ssl/private 

mkdir: created directory &＃96;/etc/ssl/private&＃39; 

[root&＃64;redhat ~]# chmod og-rwx /etc/ssl/private/ 

[root&＃64;redhat ~]# mkdir -pv /etc/ssl/certs 

mkdir: created directory &＃96;/etc/ssl/certs&＃39; 

[root&＃64;redhat ~]# mkdir -pv /etc/ssl/crl 

mkdir: created directory &＃96;/etc/ssl/crl&＃39; 

[root&＃64;redhat ~]#mkdir -pv /etc/ssl/newcerts 

mkdir: created directory &＃96;/etc/ssl/newcerts&＃39;

　　2&＃xff1a;设定openssl配置文件

[root&＃64;redhat ~]# mv /usr/share/ssl/openssl.cnf /etc/ssl/ 

[root&＃64;redhat ~]# ln -sv /etc/ssl/openssl.cnf /usr/share/ssl/openssl.cnf 

create symbolic link &＃96;/usr/share/ssl/openssl.cnf&＃39; to &＃96;/etc/ssl/openssl.cnf&＃39; 

[root&＃64;redhat ~]# export OPENSSL_CONF&＃61;"/etc/ssl/openssl.cnf" 

[root&＃64;redhat ~]# echo "# OpenSSL Setting Locate" >> ~/.bashrc 

[root&＃64;redhat ~]# echo "export OPENSSL_CONF&＃61;\"/etc/ssl/openssl.cnf\"" >> ~/.bashrc 

[root&＃64;redhat ~]# openssl rand -out /etc/ssl/private/.rand 1024 ##制作随机数 

[root&＃64;redhat ~]# chmod og-rwx /etc/ssl/private/.rand 

[root&＃64;redhat ~]# vi /etc/ssl/openssl.cnf ##编辑配置文件 

dir &＃61; /etc/ssl

　　3&＃xff1a;制作根CA的私钥

　　命令中genrsa是表示生成rsa格式的私钥&＃xff0c;-des3是指使用的加密算法&＃xff1b;-out是指私钥的输出路径&＃xff1b;2048是指加密的位数&＃xff0e;

[root&＃64;redhat ~]# openssl genrsa -des3 -out /etc/ssl/private/redhatroot.key 2048 

Generating RSA private key, 2048 bit long modulus 

..........&＃43;&＃43;&＃43; 

.....................................&＃43;&＃43;&＃43; 

e is 65537 (0x10001) 

Enter pass phrase for /etc/ssl/private/redhatroot.key: ##这里提示输入密码 

Verifying - Enter pass phrase for /etc/ssl/private/redhatroot.key: 

[root&＃64;redhat ~]# chmod og-rwx /etc/ssl/private/redhatroot.key

　　4&＃xff1a;填写凭证申请书

　　凭证申请书&＃xff0c;是把你的资料&＃xff0c;和这个 Public Key 夹在一起&＃xff0c;以便认证中心审核&＃xff0c;签上签名用的。所以这个步骤&＃xff0c;会问你这个 Key 的相关资料&＃xff0c;包括国家、城市、单位名称、部门名称、凭证名称、联络人的信箱&＃xff0c;以及申请的效期等等。请一一填写。

[root&＃64;redhat ~]# openssl req -new -key /etc/ssl/private/redhatroot.key -out /tmp/redhatroot.req 

Enter pass phrase for /etc/ssl/private/redhatroot.key: ##输入上面生成redhatroot.key时设置密码

You are about to be asked to enter information that will be incorporated 

into your certificate request. 

What you are about to enter is what is called a Distinguished Name or a DN. 

There are quite a few fields but you can leave some blank 

For some fields there will be a default value, 

If you enter &＃39;.&＃39;, the field will be left blank. 

----- 

Country Name (2 letter code) [GB]:CN 

State or Province Name (full name) [Berkshire]:GD 

Locality Name (eg, city) [Newbury]:Dong Guan 

Organization Name (eg, company) [My Company Ltd]:none 

Organizational Unit Name (eg, section) []:redhat 

Common Name (eg, your name or your server&＃39;s hostname) []:redhat 

Email Address []:root&＃64;test.com 

Please enter the following &＃39;extra&＃39; attributes 

to be sent with your certificate request 

A challenge password []: 

An optional company name []:

　　5&＃xff1a;签发凭证&＃xff0c;创建根CA

　　根CA因为没有上级了&＃xff0c;没有人能给它签名&＃xff0c;只能自己给自己签名&＃xff0e;根CA最好永远不要过期。要是过期重签&＃xff0c;所有原来它签发的凭证也都要重签&＃xff0c;所有 SSL 程式也都要重新设定。所以我们效期签 7305 天&＃xff08;大约 20年&＃xff09;。若不设效期的话&＃xff0c;预设是 30 天&＃xff08;一个月&＃xff09;。redhatroot.crt 是公钥凭证&＃xff0c;要尽量散出去&＃xff0c;让大家用。最好放到内部网路上&＃xff0c;或放到网站上&＃xff0c;让大家自己下载&＃xff0c;自己加进去。

如&＃xff1a;windows添加CA信任

下载ca证书到本地

可以 certmgr.msc打开证书管理控制台查看删除等。

[root&＃64;redhat ~]# openssl x509 -req -days 7305 -sha256 -extfile /etc/ssl/openssl.cnf \ 

-extensions v3_ca -signkey /etc/ssl/private/redhatroot.key -in /tmp/redhatroot.req \ 

-out /etc/ssl/certs/redhatroot.crt 

Signature ok 

subject&＃61;/C&＃61;CN/ST&＃61;GD/L&＃61;Dong Guan/O&＃61;none/OU&＃61;redhat/CN&＃61;redhat/emailAddress&＃61;test&＃64;test.com 

Getting Private key 

Enter pass phrase for /etc/ssl/private/redhatroot.key: ##输入上面生成redhatroot.key时设置密码

[root&＃64;redhat ~]# rm -f /tmp/redhatroot.req ##签完凭证&＃xff0c;凭证申请书就不用了&＃xff0c;可以删掉。

二&＃xff1a;创建web证书

　　1&＃xff1a;生成证书私钥

[root&＃64;redhat ~]# openssl genrsa -out /etc/ssl/private/myhost.key 2048 

Generating RSA private key, 2048 bit long modulus 

..................&＃43;&＃43;&＃43; 

.............................................................................................................&＃43;&＃43;&＃43; 

e is 65537 (0x10001) 

[root&＃64;redhat ~]# chmod og-rwx /etc/ssl/private/myhost.key

　　2&＃xff1a;填写凭证申请书

　　被问及Common Name的时候&＃xff0c;请输入你的web服务器的完全限定域名&＃xff08;FQDN&＃xff09;例如&＃xff1a;redhat.test.com&＃xff0e;当被问及A challenge password的时候&＃xff0c;直接按回车继续。如果你没有在第二步从key中把passphrase删除&＃xff0c;那么每次你运行/usr/local/httpd/apachectl　start启动服务器的时候你都要输入密码。这也就意味着如果你的服务器因为某些原因重新启动了&＃xff0c;除非你在服务器旁手动敲入了密码&＃xff0c;否则你的web服务器就不会启动。

[root&＃64;redhat ~]# openssl req -new -key /etc/ssl/private/myhost.key -out /tmp/myhost.req 

You are about to be asked to enter information that will be incorporated 

into your certificate request. 

What you are about to enter is what is called a Distinguished Name or a DN. 

There are quite a few fields but you can leave some blank 

For some fields there will be a default value, 

If you enter &＃39;.&＃39;, the field will be left blank. 

----- 

Country Name (2 letter code) [GB]:CN 

State or Province Name (full name) [Berkshire]:GD 

Locality Name (eg, city) [Newbury]:Dong Guan 

Organization Name (eg, company) [My Company Ltd]:none 

Organizational Unit Name (eg, section) []:www 

Common Name (eg, your name or your server&＃39;s hostname) []:redhat.test.com  ##也可以使用*.test.com  这里很重要

Email Address []:root&＃64;test.com 

Please enter the following &＃39;extra&＃39; attributes 

to be sent with your certificate request 

A challenge password []: ##这里不要输入密码 

An optional company name []:

　　3&＃xff1a;生成web证书

[root&＃64;redhat ~]# openssl x509 -req -days 3650 -sha256 -extfile \ 

/etc/ssl/openssl.cnf -extensions v3_req -CA /etc/ssl/certs/redhatroot.crt \ 

-CAkey /etc/ssl/private/redhatroot.key -CAserial /etc/ssl/redhatroot.srl -CAcreateserial \ 

-in /tmp/myhost.req -out /etc/ssl/certs/myhost.crt 

Signature ok 

subject&＃61;/C&＃61;CN/ST&＃61;GD/L&＃61;Dong Guan/O&＃61;none/OU&＃61;www/CN&＃61;redhat.test.com/emailAddress&＃61;root&＃64;test.com 

Getting CA Private Key 

Enter pass phrase for /etc/ssl/private/redhatroot.key: 

[root&＃64;redhat ~]# rm -f /tmp/myhost.req

三&＃xff1a;配置Apache

　　1&＃xff1a;编辑httpd.conf

　　编辑httpd.conf的内容以启用ssl支持&＃xff0c;如果在安装apache时没有加载ssl模块&＃xff0c;那么需要重新安装或编译&＃xff0e;需启用LoadModule ssl_module modules/mod_ssl.so&＃xff08;第80行&＃xff09;及 Include /etc/httpd/extra/httpd-ssl.conf&＃xff08;第456行&＃xff09;

[root&＃64;redhat ~]# vi /etc/httpd/httpd.conf 

LoadModule ssl_module modules/mod_ssl.so ##启用这两行 

Include /etc/httpd/extra/httpd-ssl.conf 

# 

#ServerName redhat.test.com　　##注释这几行&＃xff0c;如果有的话 

#DocumentRoot /var/www/extsuite/extmail/html/ 

#ScriptAlias /extmail/cgi /var/www/extsuite/extmail/cgi 

#Alias /extmail /var/www/extsuite/extmail/html 

#ScriptAlias /extman/cgi /var/www/extsuite/extman/cgi 

#Alias /extman /var/www/extsuite/extman/html 

#SuexecUserGroup vmail vmail 

#Alias /phpadmin /var/www/phpadmin 

#

　　2&＃xff1a;添加相关证书文件

[root&＃64;redhat ~]# cp /etc/ssl/certs/myhost.crt /etc/httpd/server.crt 

[root&＃64;redhat ~]# cp /etc/ssl/private/myhost.key /etc/httpd/server.key

　　3&＃xff1a;设置httpd-ssl.conf文件

　　对照修改以下的地方就可以了&＃xff0c;重启后Apache就可以支持SSL了&＃xff0e;

[root&＃64;redhat ~]# vi /etc/httpd/extra/httpd-ssl.conf 

# General setup for the virtual host 

#DocumentRoot "/usr/local/httpd/htdocs" 

#ServerName [url]www.example.com:443[/url] 

#ServerAdmin you&＃64;example.com 

ServerName redhat.test.com:443 

DocumentRoot /var/www/extsuite/extmail/html/ 

ScriptAlias /extmail/cgi /var/www/extsuite/extmail/cgi 

Alias /extmail /var/www/extsuite/extmail/html 

ScriptAlias /extman/cgi /var/www/extsuite/extman/cgi 

Alias /extman /var/www/extsuite/extman/html 

SuexecUserGroup vmail vmail 

Alias /phpadmin /var/www/phpadmin 

ErrorLog /usr/local/httpd/logs/error_log 

TransferLog /usr/local/httpd/logs/access_log

# SSL Engine Switch:

　　4&＃xff1a;重启服务

[root&＃64;redhat ~]# /usr/local/httpd/bin/apachectl stop 

[root&＃64;redhat ~]# /usr/local/httpd/bin/apachectl start