安装基于openssl的https服务配置

 

前提：

   httpd必须安装mod_ssl模块

一、CA自签证书

1.建立CA的私钥

[root@localhost CA]# cd /etc/pki/CA

[root@localhost CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048)

[root@localhost CA]# ll private/cakey.pem

2.生成自签证书

[root@localhost CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 3655

-----

Country Name (2 letter code) [GB]:CN

State or Province Name (full name) [Berkshire]:AH

Locality Name (eg, city) [Newbury]:CZ

Organization Name (eg, company) [My Company Ltd]:ca ltd

Organizational Unit Name (eg, section) []:ca eg

Common Name (eg, your name or your server's hostname) []:www.ca.com

Email Address []:admin@ca.com

-----

3.创建需要使用的文件和文件夹

[root@localhost CA]# touch index.txt serial

[root@localhost CA]# echo 00 > serial

[root@localhost CA]# mkdir certs crl newcerts

[root@localhost CA]# ls

二、httpd证书申请

1.在/etc/httpd 在新建文件夹ssl

2.新建httpd的私钥

[root@localhost ssl]# (umask 077;openssl genrsa -out httpd.key 1024)

3.生成证书签署请求文件

[root@localhost ssl]# openssl req -new -key httpd.key -out httpd.csr

-----

Country Name (2 letter code) [GB]:CN

State or Province Name (full name) [Berkshire]:AH

Locality Name (eg, city) [Newbury]:CZ

Organization Name (eg, company) [My Company Ltd]:ca ltd

Organizational Unit Name (eg, section) []:ca eg

Common Name (eg, your name or your server's hostname) []:www.example1.com

Email Address []:admin@example1.com

-----

4.请求文件发送给CA

[root@localhost ssl]# scp httpd.csr 192.168.246.100@root:/etc/pki/sign

三、CA签署证书

1.签署发送过来的证书申请

[root@localhost sign]# openssl ca -in httpd.csr -out httpd.crt -days 365 

2.将签署的证书返回给申请者

四、修改httpd的ssl配置文件

  在/etc/httpd/conf.d/ssl中,需要修该的部分如下：

  <VirtualHost 192.168.246.100:443>

    ServerName www.example1.com
    DocumentRoot /www/example1

    SSLCertificateFile /etc/httpd/ssl/httpd.crt

    SSLCertificateKeyFile /etc/httpd/ssl/httpd.key

  <VirtualHost>

五、测试

  通过浏览器就可访问https://www.example1.com/
  在浏览网页时会出现安全警告，将/etc/pki/CA/cacert.pem复制到windows中更名为cacert.crt并安装即可