apache ssl 配置自签名证书实现

最新推荐文章于 2023-01-08 21:11:45 发布

原创最新推荐文章于 2023-01-08 21:11:45 发布 · 2.6k 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#apache #ssl #ca #签名

Certification 专栏收录该内容

1 篇文章

订阅专栏

本文详细介绍了如何在Apache服务器上配置SSL，包括安装httpd-2.2.25-win32-x86-openssl-0.9.8y.msi，创建自签名的服务器证书和CSR，以及模拟CA进行签名。在过程中需要注意组织名称的一致性以及不同RSA密钥长度的兼容性。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

1 安装httpd-2.2.25-win32-x86-openssl-0.9.8y.msi

域名xcviie.com www.xcviie.com admin@xcviie.com 可随机选取但生成server.csr时需要对应一致

2 打开C:\Program Files\Apache Software Foundation\Apache2.2\bin\openssl.exe

3 自签名

server私钥和待签名的申请csr

1)genrsa -out server.key 2048

2)req -new -out server.csr -key server.key -config ../conf/openssl.cnf

-----

Country Name (2 letter code) [AU]:CN

State or Province Name (full name) [Some-State]:BJ

Locality Name (eg, city) []:BJ

Organization Name (eg, company) [Internet Widgits Pty Ltd]:XCVIIE

Organizational Unit Name (eg, section) []:XCVIIE

Common Name (e.g. server FQDN or YOUR name) []:XCVIIE.COM

Email Address []:ADMIN@XCVIIE.COM

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

自签名

3)req -x509 -days 365 -key server.key -in server.csr -out server.crt

4)将server.crt server.key 放入conf目录

5)去掉 LoadModule ssl_module modules/mod_ssl.so 行的注释# ；去掉 Include conf/extra/httpd-ssl.conf 行的注释#

6)重启服务器，访问https://127.0.0.1 或配置hosts文件可访问https://www.xcviie.com

4 模拟ca给server签名

server私钥和待签名的申请csr

1) genrsa -out server.key 2048

2) req -new -out server.csr -key server.key -config ../conf/openssl.cnf

-----

Country Name (2 letter code) [AU]:CN

State or Province Name (full name) [Some-State]:BJ

Locality Name (eg, city) []:BJ

Organization Name (eg, company) [Internet Widgits Pty Ltd]:HRCA //这里要和CA一致

Organizational Unit Name (eg, section) []:XCVIIE

Common Name (e.g. server FQDN or YOUR name) []:XCVIIE.COM

Email Address []:

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

CA中心证书

3) genrsa -out ca.key 1024

4) req -new -x509 -days 365 -key ca.key -out ca.crt -config ../conf/openssl.cnf

-----

Country Name (2 letter code) [AU]:CN

State or Province Name (full name) [Some-State]:BJ

Locality Name (eg, city) []:HR

Organization Name (eg, company) [Internet Widgits Pty Ltd]:HRCA

Organizational Unit Name (eg, section) []:HRCA

Common Name (e.g. server FQDN or YOUR name) []:HRCA.COM

Email Address []:

为服务器签名

5) ca -in server.csr -out server.crt -cert ca.crt -keyfile ca.key -config ../conf/openssl.cnf

CA签名注意问题：

1、demoCA 问题

答：新建如下目录结构即可

demoCA文件夹

- newcerts文件夹

- index.txt 内容空

- serial 内容为 01

2、The organizationName field needed to be the same in the CA certificate (HRCA) and the request (XCVIIE)

答：重新生成server.csr 名字改为和CA一致即可

3、另外一些问题见网上doc 已下载

4、CA可以用1024的rsa私钥给server 2048的rsa签名（通过测试）