cenos7 https

                        配置HTTPS

一、安装 httpd mod_ssl

[root@localhost ~]# yum install -y httpd mod_ssl

二、验证

[root@localhost ~]# cd /etc/httpd/

三、配置CA认证中心

1、[root@localhost httpd]# vim /etc/pki/tls/openssl.cnf 

    172行 basicConstraints=CA:FALSE 改为 basicConstraints=CA:TRUE

2、[root@localhost httpd]# /etc/pki/tls/misc/CA -newca

CA certificate filename (or enter to create) #直接回车 
        
        Enter PEM pass phrase:123456 # 输入密码，保护私钥 
        Verifying - Enter PEM pass phrase:123456 #再次输入密码 
        
        Country Name (2 letter code) [XX]:CN  #国家地区
        State or Province Name (full name) []:beijing  #城市
        Locality Name (eg, city) [Default City]:haidian  #当地名称
        Organization Name (eg, company) [Default Company Ltd]: xuegod #组织名称
        Organizational Unit Name (eg, section) []:IT  #组织部门名称
        Common Name (eg, your name or your server's hostname) []:server.cn #通用名称（例如，您的姓名或您的服务器的主机名）,随便写
        Email Address []:1@163.com  #邮箱
        Please enter the following 'extra' attributes 
        to be sent with your certificate request #添加一个“额外”的属性，让客户端发送CA证书,请求文件时，要输入的密 
        A challenge password []: #直接加车 
        An optional company name []:#直接加车
        Using configuration from /etc/pki/tls/openssl.cnf #CA服务器的配置文件。上面修改的内容会添加到这个配置文件中
        Enter pass phrase for /etc/pki/CA/private/./cakey.pem: 123456 #输入刚才保护CA密钥的密码

四、查看生成的CA根证书：
        
        vim /etc/pki/CA/cacert.pem #存在CA认证下的根证书，这里面包含了根证书的公钥。

五、创建秘钥存放文件

1、[root@localhost httpd]# mkdir ssl
2、[root@localhost httpd]# pwd
     /etc/httpd

六、生成秘钥

1、[root@localhost ssl]# openssl genrsa -out httpd.key 2048
2、[root@localhost ssl]# ls
      httpd.key  

七、生成证书申请文件

1、[root@localhost httpd]# openssl req -new -key httpd.key -out httpd.csr
这里的信息尽量和CA的信息保持一致，hostname除外
2、[root@localhost ssl]# ls
      httpd.csr  httpd.key

八、通过申请，颁布证书

1、[root@localhost ssl]# openssl ca -keyfile /etc/pki/CA/private/cakey.pem -cert /etc/pki/CA/cacert.pem -in httpd.csr -out httpd.crt

Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for /etc/pki/CA/private/cakey.pem:输入CA密码
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 15642079672861533844 (0xd913d49651452694)
        Validity
            Not Before: Apr 17 15:57:33 2019 GMT
            Not After : Apr 16 15:57:33 2020 GMT
        Subject:
            countryName               = cn
            stateOrProvinceName       = sd
            organizationName          = sz
            organizationalUnitName    = jw
            commonName                = www.zr.com
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:TRUE
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
                18:66:1C:FE:02:41:B6:B5:B1:E0:5F:8C:52:C7:0E:06:09:AC:79:D5
            X509v3 Authority Key Identifier: 
                keyid:DC:49:93:B1:7E:4C:0B:52:1F:CD:0E:42:64:3D:32:46:F0:3C:B2:3A

Certificate is to be certified until Apr 16 15:57:33 2020 GMT (365 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

2、[root@localhost ssl]# cat /etc/pki/CA/index.txt：查看颁布的证书

V    220416154441Z        D913D49651452693             unknown    /C=cn/ST=sd/O=sz/OU=jw/CN=ca.zr.com
V    200416155733Z        D913D49651452694             unknown/C=cn/ST=sd/O=sz/OU=jw/CN=www.zr.com

八、创建配置文件

1、[root@localhost ssl]# cd ..  #返回上一个目录httpd
2、[root@localhost httpd]# vim conf.d/virthost.conf #创建配置文件

<VirtualHost *:80>
    DocumentRoot /data/web
    ServerName www.zr.com
    <Directory /data/web>
        Require all granted
    </Directory>
</VirtualHost>

<VirtualHost *:443>
    DocumentRoot /data/web
    ServerName www.zr.com
    <Directory /data/web>
        Require all granted
    </Directory>
SSLEngine on 
</VirtualHost>

九、修改ssl配置文件

1、[root@localhost conf.d]# vim /etc/httpd/conf.d/ssl.conf
修改，并复制到virthost.conf 
SSLCertificateFile /etc/httpd/ssl/httpd.crt
SSLCertificateKeyFile /etc/httpd/ssl/httpd.key

<VirtualHost *:80>
    DocumentRoot /data/web
    ServerName www.zr.com
    <Directory /data/web>
        Require all granted
    </Directory>
</VirtualHost>

<VirtualHost *:443>
    DocumentRoot /data/web
    ServerName www.zr.com
    <Directory /data/web>
        Require all granted
    </Directory>
SSLEngine on 
SSLCertificateFile /etc/httpd/ssl/httpd.crt
SSLCertificateKeyFile /etc/httpd/ssl/httpd.key
</VirtualHost>

十、创建网站目录

1、[root@localhost conf]# mkdir /data/web -p
2、[root@localhost conf]# vim /data/web/index.html #创建网站主页

十一、验证
1、[root@localhost conf]# systemctl restart httpd
2、[root@localhost conf]# httpd -t #检测语法错误
4、[root@localhost conf]# vim /etc/hosts 添加主机记录
    192.168.1.129（本机IP）    www.zr.com
5、curl www.zr.com 访问
6、[root@localhost conf]# cat /etc/pki/CA/cacert.pem >> /etc/pki/tls/certs/ca-bundle.crt #添加信任
7、curl https://www.zr.com