码迷,mamicode.com
首页 > Web开发 > 详细

一步一步实现linux系统apache实现https详解

时间:2016-01-02 16:36:41      阅读:323      评论:0      收藏:0      [点我收藏+]

标签:linux实现https   https配置   https实现   https配置步骤   

https提供安全的web通讯
原理部分:http://stlong.blog.51cto.com/5144113/1730771

1)配置域名支持ca:
[root@ns ~]# vim /var/named/chroot/var/named/sggfu.com.zone  ##添加ca主机记录
ca    IN    A    192.18.100.151
:wq
[root@ns ~]# /etc/init.d/named restart  ##重启服务
[root@ns ~]# nslookup
> server 192.168.100.100
Default server: 192.168.100.100
Address: 192.168.100.100#53
> ca.sggfu.com
Server:        192.168.100.100
Address:    192.168.100.100#53

Name:    ca.sggfu.com
Address: 192.18.100.151
> exit

2)配置CA服务器:(192.168.100.151)
a.使用母盘克隆虚拟机,命名为ca服务器,修改如下:
[root@localhost ~]# vim /etc/sysconfig/network-scripts/ifcfg-eth0
DEVICE=eth0
HWADDR=00:0C:29:75:e6:eb
TYPE=Ethernet
ONBOOT=yes
NM_CONTROLLED=no
BOOTPROTO=static
IPADDR=192.168.100.151
NETMASK=255.255.255.0
DNS1=192.168.100.100
GATEWAY=192.168.100.100
:wq

[root@localhost ~]# vim /etc/sysconfig/network
HOSTNAME=ca.sggfu.com
:wq

[root@localhost ~]#  vim /etc/udev/rules.d/70-persistent-net.rules   ##删除eth0,修改eth1为eth0
[root@localhost ~]#  reboot
b.配置CA:
[root@ca ~]# hostname
ca.sggfu.com
[root@ca ~]# yum -y install openssl openssl-devel   ##安装openssl
[root@ca ~]# rpm -ql openssl
/etc/pki/CA
/etc/pki/CA/certs   ##证书存放目录
/etc/pki/CA/crl     ##吊销的证书存放的目录
/etc/pki/CA/newcerts##新证书目录
/etc/pki/CA/private ##私钥存放目录
/etc/pki/tls/openssl.cnf   ##主配置文件
/usr/bin/openssl     ##主程序命令
[root@ca ~]# vim /etc/pki/tls/openssl.cnf   ##修改主配置文件使用“:set nu”打印行号
 40 [ CA_default ]
 41
 42 dir             = /etc/pki/CA           # Where everything is kept
 43 certs           = $dir/certs            # Where the issued certs are kept
 44 crl_dir         = $dir/crl              # Where the issued crl are kept
 45 database        = $dir/index.txt        # database index file.
 46 #unique_subject = no                    # Set to ‘no‘ to allow creation of
 47                                         # several ctificates with same subject.
 48 new_certs_dir   = $dir/newcerts         # default place for new certs.
 49
 50 certificate     = $dir/cacert.pem       # The CA certificate
 51 serial          = $dir/serial           # The current serial number
 52 crlnumber       = $dir/crlnumber        # the current crl number
 53                                         # must be commented out to leave a V1 CRL
 54 crl             = $dir/crl.pem          # The current CRL
 55 private_key     = $dir/private/cakey.pem# The private key
128 [ req_distinguished_name ]
129 countryName                     = Country Name (2 letter code)
130 countryName_default             = CN    ##修国家
131 countryName_min                 = 2
132 countryName_max                 = 2
133
134 stateOrProvinceName             = State or Province Name (full name)
135 stateOrProvinceName_default     = beijing   ##设置省
136
137 localityName                    = Locality Name (eg, city)
138 localityName_default            = beijing   ##设置城市
139
140 0.organizationName              = Organization Name (eg, company)
141 0.organizationName_default      = sggfu.com Ltd   ##设置组织名称
142
143 # we can do this but it is not needed normally :-)
144 #1.organizationName             = Second Organization Name (eg, company)
145 #1.organizationName_default     = World Wide Web Pty Ltd
146
147 organizationalUnitName          = Organizational Unit Name (eg, section)
148 organizationalUnitName_default  = tech  ##设置部门
:wq
[root@ca ~]# cd /etc/pki/CA/
[root@ca CA]# ls private/
[root@ca CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048)  ##生成私钥同时将权限设置为600
Generating RSA private key, 2048 bit long modulus
....................+++
...........................................................................................+++
e is 65537 (0x10001)
[root@ca CA]# ls -l private/  ##验证私钥
总用量 4
-rw-------. 1 root root 1679 1月   2 20:09 cakey.pem
[root@ca CA]#
[root@ca CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 3650  ##生成自签证书(根证书)
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.‘, the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [BeiJing]:
Locality Name (eg, city) [BeiJing]:
Organization Name (eg, company) [sggfu.com]:
Organizational Unit Name (eg, section) [tech]:
Common Name (eg, your name or your server‘s hostname) []:ca.sggfu.com   ##主机名填写CA服务器的主机名
Email Address []:admin@sggfu.com
[root@ca CA]# ls -l cacert.pem
-rw-r--r--. 1 root root 1419 1月   2 20:13 cacert.pem
[root@ca CA]#

[root@ca CA]# mkdir -p certs crl newcerts
[root@ca CA]# touch index.txt  ##证书索引
[root@ca CA]# echo 00 >serial  ##证书序列号
[root@ca CA]# ls
cacert.pem  certs  crl  index.txt  newcerts  private  serial
[root@ca CA]#

3)配置web服务器支持https:
a.为web服务器生成密钥和证书请求:
[root@www ~]# mkdir /usr/local/httpd/conf/ssl
[root@www ~]# cd /usr/local/httpd/conf/ssl/
[root@www ssl]# (umask 077;openssl genrsa 2048 >httpd.key)
[root@www ssl]# scp root@192.168.100.151:/etc/pki/tls/openssl.cnf /etc/pki/tls/openssl.cnf  ##复制openssl配置文件
[root@www ssl]# openssl req -new -key httpd.key -out httpd.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.‘, the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [BeiJing]:
Locality Name (eg, city) [BeiJing]:
Organization Name (eg, company) [sggfu.com]:
Organizational Unit Name (eg, section) [tech]:
Common Name (eg, your name or your server‘s hostname) []:www.sggfu.com  ##必须填写web服务器的主机名,注意web虚拟主
机只能有唯一一个站点可以设置为https
Email Address []:admin@sggfu.com

Please enter the following ‘extra‘ attributes
to be sent with your certificate request
A challenge password []:   ##证书保护的密码短语,直接回车
An optional company name []:
[root@www ssl]#
[root@www ssl]# scp httpd.csr root@192.168.100.151:/tmp  ##将证书认证请求复制给CA服务器

b.登录到192.168.100.151,为web服务器签发证书:
[root@ca CA]# openssl ca -in /tmp/httpd.csr -out /tmp/httpd.crt -days 3650  ##签发证书httpd.crt,执行中y回车即可
[root@ca CA]# ls /tmp/httpd.c*  ##验证
/tmp/httpd.crt  /tmp/httpd.csr
[root@ca CA]# scp /tmp/httpd.crt root@192.168.100.150:/usr/local/httpd/conf/ssl   ##复制证书给web服务器
[root@ca CA]# rm -rf /tmp/httpd.*  ##删除证书,避免非法用户获取证书

c.修改web服务器配置文件:登录192.168.100.150
[root@www ~]# cd /usr/local/httpd/conf/extra/
[root@www extra]# cp httpd-ssl.conf httpd-ssl.conf.bak  ##备份证书
[root@www extra]# vim httpd-ssl.conf  ##修改如下
74 <VirtualHost 192.168.100.150:443>
77 DocumentRoot "/usr/local/httpd/htdocs/sggfu/"   ##注意和http的网页根目录一致
78 ServerName www.sggfu.com:443
79 ServerAdmin admin@sggfu.com
80 ErrorLog "/usr/local/httpd/logs/error_log"
81 TransferLog "/usr/local/httpd/logs/access_log"
85 SSLEngine on   ##确认为on,表示开启https
99 SSLCertificateFile "/usr/local/httpd/conf/ssl/httpd.crt"  ##指定证书路径
107 SSLCertificateKeyFile "/usr/local/httpd/conf/ssl/httpd.key"  ##指定私钥路径,注意私钥必须小心保管
:wq
[root@www extra]# vim /usr/local/httpd/conf/httpd.conf  ##修改主配置文件,调用httpd-ssl.conf
399 Include conf/extra/httpd-ssl.conf
:wq
[root@www extra]# /etc/init.d/httpd restart  ##重启服务器

4)共享根证书:
[root@www ~]# cd /usr/local/httpd/htdocs/sggfu/
[root@www sggfu]# scp root@192.168.100.151:/etc/pki/CA/cacert.pem cacert.crt  ##复制CA服务器的证书(根证书)
[root@www sggfu]# vim index.html   ##通过首页共享根证书
<html>
<head>
  <meta http-equiv="content-type" content="text/html; charset=utf-8" />
  <title>www.sggfu.com</title>
</head>
<body>
  <h1>www.sggfu.com</h1>
  为了你更好的访问网站,请下载安装<a href="cacert.crt" target="_blank">根证书</a>
</body>
</html>
:wq

5)测试:
http://www.sggfu.com  ##下载证书并导入证书
https://www.sggfu.com  ##访问测试

本文出自 “沈工鬼斧” 博客,请务必保留此出处http://stlong.blog.51cto.com/5144113/1730844

一步一步实现linux系统apache实现https详解

标签:linux实现https   https配置   https实现   https配置步骤   

原文地址:http://stlong.blog.51cto.com/5144113/1730844

(0)
(0)
   
举报
评论 一句话评论(0
登录后才能评论!
© 2014 mamicode.com 版权所有  联系我们:gaon5@hotmail.com
迷上了代码!