Wamp apache 配置 Https 双向认证全过程

最新推荐文章于 2022-02-28 00:00:16 发布

蓝冰大侠

最新推荐文章于 2022-02-28 00:00:16 发布

阅读量1.6k

点赞数

CC 4.0 BY-SA版权

分类专栏：编程语言

本文链接：https://blog.youkuaiyun.com/bluehire/article/details/17499315

编程语言专栏收录该内容

179 篇文章

订阅专栏

1.我安装的是Wampserver 2.2.11, d:\wamp目录
2.本机操作系统Win7 32位

3.D:\wamp\bin\apache\Apache2.2.11\bin 下有 openssl.exe
4.D:\wamp\bin\apache\Apache2.2.11\conf 下有 openssl.cnf
5.D:\wamp\bin\apache\Apache2.2.11\conf\extra 下有 httpd-ssl.conf

6.本机地址 192.168.111.1

7.wamp apache 开启 mod_ssl

8.httpd-ssl.conf内容(去除注释后)
Listen 443

AddType application/x-x509-ca-cert .crt

AddType application/x-pkcs7-crl .crl

SSLPassPhraseDialog builtin

SSLSessionCache "shmcb:D:/wamp/bin/apache/Apache2.2.11/logs/ssl_scache(512000)"

SSLSessionCacheTimeout 300

SSLMutex default

DocumentRoot "D:\wamp\www"

ServerName 192.168.111.1:443

ServerAdmin me@localhost

ErrorLog "D:/wamp/bin/apache/Apache2.2.11/logs/error.log"

TransferLog "D:/wamp/bin/apache/Apache2.2.11/logs/access.log"

SSLEngine on

SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL

SSLCertificateFile "D:/wamp/bin/apache/Apache2.2.11/bin/server.crt"

SSLCertificateKeyFile "D:/wamp/bin/apache/Apache2.2.11/bin/server.key"

SSLCertificateChainFile "D:/wamp/bin/apache/Apache2.2.11/bin/root.key"

SSLCACertificateFile "D:/wamp/bin/apache/Apache2.2.11/bin/root.crt"

SSLVerifyClient require

SSLVerifyDepth 10

SSLOptions +StdEnvVars

</FilesMatch>

SSLOptions +StdEnvVars

</Directory>

BrowserMatch ".*MSIE.*" \

nokeepalive ssl-unclean-shutdown \

downgrade-1.0 force-response-1.0

CustomLog "D:/wamp/bin/apache/Apache2.2.11/logs/ssl_request.log" \

"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

</VirtualHost>
以上主要注意
a.路径问题
b.ServerName 这个要注意,一定是本机地址或域名,另外在命令行时,也要多次用到
c.如果是单向认证,34行的值修改成 none 同时把所有 client 字样的行注释掉即可(用#)

8.根证书用 root 表示 , 服务端证书 server , 客户端证书 client

9.openssl.cnf 内容(去除注释后)(只贴出有可能修改过的地方)
dir        = ./ca        # Where everything is kept
certs        = $dir/certs        # Where the issued certs are kept
crl_dir        = $dir/crl        # Where the issued crl are kept
database    = $dir/index.txt    # database index file.
                    # several ctificates with same subject.
new_certs_dir    = $dir/newcerts        # default place for new certs.

certificate    = $dir/cacert.pem     # The CA certificate
serial        = $dir/serial         # The current serial number
crlnumber    = $dir/crlnumber    # the current crl number
                    # must be commented out to leave a V1 CRL
crl        = $dir/crl.pem         # The current CRL
private_key    = $dir/private/cakey.pem# The private key
RANDFILE    = $dir/private/.rand    # private random number file

以上要建立几个目录,bin/ca/, bin/ca/newcerts/,bin/ca/private/     也不知道是否都用上了,反正有这些足够了.
还要建立几个文件
a. bin/ca/index.txt 一个0字节的空文件
b.bin/ca/serial (注意无后缀),内容写 2个(0-9,A-F)的字符即可,随意.

10.下面说操作了,
   进入命令行,进入 D:\wamp\bin\apache\Apache2.2.11\bin    这个目录,反正我是在这里操作的.
   set OPENSSL_CONF=../conf/openssl.cnf              这是指明配置文件的
   openssl genrsa >root.key                 生成根密钥(未加保护密码)(openssl genrsa -des3 -out root.key 1024 这个是加保护密码的命令) 我以下都没加保护密码
   openssl genrsa >server.key       生成服务端密钥
   openssl genrsa >client.key    生成客户端密钥

openssl req -x509 -new -key root.key >root.crt 生成自签名的根证书 (CRT即PEM格式)

openssl req -new -key server.key -out server.csr 生成服务端签名请求文件CSR

openssl req -new -key client.key -out client.csr 生成客户端签名请求文件

以上如果要求输入一些信息,注意 domain 处,必须是本机域名或IP地址 ,我是写的 192.168.111.1 (我本机IP)

使用根证书为服务端及客户端签名

openssl ca -in server.csr -cert root.crt -keyfile root.key -out server.crt

openssl ca -in client.csr -cert root.crt -keyfile root.key -out client.crt

客户端证书转换成PFX格式

openssl pkcs12 -export -clcerts -in client.crt -inkey client.key -out client.pfx

把root.crt client.pfx 复制到客户机(随便哪台电脑了)
双击导入 ( root 导入到可信任的根证书签发机构,client导入到个人/您的证书)

重启服务器Apache OVER

以上可能有所遗漏,可参考我的前几篇博客,那些是我参考过的文章.

如果实在不行,QQ我:31008088

Normal 0 7.8 磅 0 2 false false false EN-US ZH-CN X-NONE /* Style Definitions */ table.MsoNormalTable {mso-style-name:普通表格; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-priority:99; mso-style-parent:""; mso-padding-alt:0cm 5.4pt 0cm 5.4pt; mso-para-margin:0cm; mso-para-margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:10.5pt; mso-bidi-font-size:11.0pt; font-family:"Calibri","sans-serif"; mso-ascii-font-family:Calibri; mso-ascii-theme-font:minor-latin; mso-hansi-font-family:Calibri; mso-hansi-theme-font:minor-latin; mso-bidi-font-family:"Times New Roman"; mso-bidi-theme-font:minor-bidi; mso-font-kerning:1.0pt;}

阅读(451) | 评论(0) | 转发(0) |

上一篇：[转]Linux Apache Https 配置

下一篇：JS 文件上传前端验证后缀及大小