cenos7 https

最新推荐文章于 2024-03-08 15:30:27 发布

原创最新推荐文章于 2024-03-08 15:30:27 发布 · 325 阅读

0 ·

CC 4.0 BY-SA版权

配置HTTPS

一、安装 httpd mod_ssl

[root@localhost ~]# yum install -y httpd mod_ssl

二、验证

[root@localhost ~]# cd /etc/httpd/

三、配置CA认证中心

1、[root@localhost httpd]# vim /etc/pki/tls/openssl.cnf

172行 basicConstraints=CA:FALSE 改为 basicConstraints=CA:TRUE

2、[root@localhost httpd]# /etc/pki/tls/misc/CA -newca

CA certificate filename (or enter to create) #直接回车

       Enter PEM pass phrase:123456 # 输入密码，保护私钥
       Verifying - Enter PEM pass phrase:123456 #再次输入密码

       Country Name (2 letter code) [XX]:CN #国家地区
       State or Province Name (full name) []:beijing #城市
       Locality Name (eg, city) [Default City]:haidian #当地名称
       Organization Name (eg, company) [Default Company Ltd]: xuegod #组织名称
       Organizational Unit Name (eg, section) []:IT #组织部门名称
       Common Name (eg, your name or your server's hostname) []:server.cn #通用名称（例如，您的姓名或您的服务器的主机名）,随便写
       Email Address []:1@163.com #邮箱
       Please enter the following 'extra' attributes
       to be sent with your certificate request #添加一个“额外”的属性，让客户端发送CA证书,请求文件时，要输入的密
       A challenge password []: #直接加车
       An optional company name []:#直接加车
       Using configuration from /etc/pki/tls/openssl.cnf #CA服务器的配置文件。上面修改的内容会添加到这个配置文件中
       Enter pass phrase for /etc/pki/CA/private/./cakey.pem: 123456 #输入刚才保护CA密钥的密码

四、查看生成的CA根证书：

vim /etc/pki/CA/cacert.pem #存在CA认证下的根证书，这里面包含了根证书的公钥。

五、创建秘钥存放文件

1、[root@localhost httpd]# mkdir ssl
2、[root@localhost httpd]# pwd
/etc/httpd

六、生成秘钥

1、[root@localhost ssl]# openssl genrsa -out httpd.key 2048
2、[root@localhost ssl]# ls
httpd.key

七、生成证书申请文件

1、[root@localhost httpd]# openssl req -new -key httpd.key -out httpd.csr
这里的信息尽量和CA的信息保持一致，hostname除外
2、[root@localhost ssl]# ls
httpd.csr httpd.key

八、通过申请，颁布证书

1、[root@localhost ssl]# openssl ca -keyfile /etc/pki/CA/private/cakey.pem -cert /etc/pki/CA/cacert.pem -in httpd.csr -out httpd.crt

Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for /etc/pki/CA/private/cakey.pem:输入CA密码
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 15642079672861533844 (0xd913d49651452694)
Validity
Not Before: Apr 17 15:57:33 2019 GMT
Not After : Apr 16 15:57:33 2020 GMT
Subject:
countryName = cn
stateOrProvinceName = sd
organizationName = sz
organizationalUnitName = jw
commonName = www.zr.com
X509v3 extensions:
X509v3 Basic Constraints:
CA:TRUE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
18:66:1C:FE:02:41:B6:B5:B1:E0:5F:8C:52:C7:0E:06:09:AC:79:D5
X509v3 Authority Key Identifier:
keyid:DC:49:93:B1:7E:4C:0B:52:1F:CD:0E:42:64:3D:32:46:F0:3C:B2:3A

Certificate is to be certified until Apr 16 15:57:33 2020 GMT (365 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

2、[root@localhost ssl]# cat /etc/pki/CA/index.txt：查看颁布的证书

V 220416154441Z D913D49651452693 unknown /C=cn/ST=sd/O=sz/OU=jw/CN=ca.zr.com
V 200416155733Z D913D49651452694 unknown/C=cn/ST=sd/O=sz/OU=jw/CN=www.zr.com

八、创建配置文件

1、[root@localhost ssl]# cd .. #返回上一个目录httpd
2、[root@localhost httpd]# vim conf.d/virthost.conf #创建配置文件

<VirtualHost *:80>
   DocumentRoot /data/web
   ServerName www.zr.com
   <Directory /data/web>
       Require all granted
   </Directory>
</VirtualHost>

<VirtualHost *:443>
   DocumentRoot /data/web
   ServerName www.zr.com
   <Directory /data/web>
       Require all granted
   </Directory>
SSLEngine on
</VirtualHost>

九、修改ssl配置文件

1、[root@localhost conf.d]# vim /etc/httpd/conf.d/ssl.conf
修改，并复制到virthost.conf
SSLCertificateFile /etc/httpd/ssl/httpd.crt
SSLCertificateKeyFile /etc/httpd/ssl/httpd.key

<VirtualHost *:80>
   DocumentRoot /data/web
   ServerName www.zr.com
   <Directory /data/web>
       Require all granted
   </Directory>
</VirtualHost>

<VirtualHost *:443>
   DocumentRoot /data/web
   ServerName www.zr.com
   <Directory /data/web>
       Require all granted
   </Directory>
SSLEngine on
SSLCertificateFile /etc/httpd/ssl/httpd.crt
SSLCertificateKeyFile /etc/httpd/ssl/httpd.key
</VirtualHost>

十、创建网站目录

1、[root@localhost conf]# mkdir /data/web -p
2、[root@localhost conf]# vim /data/web/index.html #创建网站主页

十一、验证
1、[root@localhost conf]# systemctl restart httpd
2、[root@localhost conf]# httpd -t #检测语法错误
4、[root@localhost conf]# vim /etc/hosts 添加主机记录
192.168.1.129（本机IP） www.zr.com
5、curl www.zr.com 访问
6、[root@localhost conf]# cat /etc/pki/CA/cacert.pem >> /etc/pki/tls/certs/ca-bundle.crt #添加信任
7、curl https://www.zr.com