标签：httpd ssl证书 mysql认证 linux.web服务
实验环境：
| 主机IP | 描述 |
|---|---|
| 192.168.5.181 | 操作系统为CentOS7，安装httpd2.4版本 |
| 192.168.5.121 | 操作系统为CentOS6，安装httpd2.2版本，安装MySQL数据库 |
| 192.168.5.180 | 测试用Linux系统，安装有curl工具 |
| 192.168.5.190 | 测试用Linux系统，安装有curl工具 |
| 192.168.5.182 | CA证书颁发机构 |
在两台主机上面先清空防火墙规则，关闭Selinux，然后用yum安装httpd，在CentOS6上面，默认的Base源里面是httpd2.2版本；在CentOS7上面，默认的Base源里面是httpd2.4版本。
$ iptables -t filter -F $ setenforce 0 $ yum install httpd 在CentOS7上面查看httpd版本： $ yum info httpd | grep -i version Version : 2.4.6 在CentOS6上面查看httpd版本： $ yum info httpd | grep -i version Version : 2.2.15
CentOS6, httpd2.2环境
在/etc/httpd/conf.d/目录下面添加一个新的配置项virtualhost.conf，编辑里面的内容如下所示，添加NameVirtualHost指令，指明用192.168.5.121:80作为基于FQDN的虚拟主机，添加两个VirtualHost配置段，分别使用www1.stuX.com和www2.stuX.com作为主机名
分别给两台虚拟主机自定义日志功能：
www1.stuX.com的访问日志是/web/vhosts/www1/access_log
www1.stuX.com的错误日志是/web/vhosts/www1/error_log
www2.stuX.com的访问日志是/web/vhosts/www2/access_log
www2.stuX.com的错误日志是/web/vhosts/www2/error_log
之后重启httpd服务：
$ cat /etc/httpd/conf.d/virtualhost.conf
NameVirtualHost 192.168.5.121:80
<VirtualHost 192.168.5.121:80>
ServerName www1.stuX.com
DocumentRoot "/web/vhosts/www1"
LogFormat "%h %u %t \"%r\" %>s \"%{Referer}i\" \"%{User-Agent}i\"" custom1
CustomLog /web/vhosts/www1/access_log custom1
ErrorLog /web/vhosts/www1/error_log
<Directory "/web/vhosts/www1">
Order allow,deny
Allow from all
</Directory>
</VirtualHost>
<VirtualHost 192.168.5.121:80>
ServerName www2.stuX.com
DocumentRoot "/web/vhosts/www2"
LogFormat "%h %u %t \"%r\" %>s \"%{Referer}i\" \"%{User-Agent}i\"" custom2
CustomLog /web/vhosts/www2/access_log custom2
ErrorLog /web/vhosts/www2/error_log
<Directory "/web/vhosts/www2">
Order allow,deny
Allow from all
</Directory>
</VirtualHost>
$ service httpd start创建/web/vhosts/www1和/web/vhosts/www2目录，分别在目录里面添加一个简单的测试页面：
$ mkdir -p /web/vhosts/www{1,2}
$ echo "This is www1.stuX.com" > /web/vhosts/www1/index.html
$ echo "This is www2.stuX.com" > /web/vhosts/www2/index.htmlCentOS7, httpd2.4环境
同样在/etc/httpd/conf.d目录下面添加一个新的配置项virtualhost.conf。与CentOS6不同的是，省略掉了NameVirtualHost指令，并且ACL权限的配置也发生了变化。使用www3.stuX.com和www4.stuX.com作为主机名。
定义日志功能：
www3.stuX.com的访问日志是/web/vhosts/www3/access_log
www3.stuX.com的错误日志是/web/vhosts/www3/error_log
www4.stuX.com的访问日志是/web/vhosts/www4/access_log
www4.stuX.com的错误日志是/web/vhosts/www4/error_log
之后重启httpd.service
<VirtualHost 192.168.5.181:80>
ServerName www3.stuX.com
DocumentRoot "/web/vhosts/www3"
LogFormat "%h %u %t \"%r\" %>s \"%{Referer}i\" \"%{User-Agent}i\"" custom3
CustomLog /web/vhosts/www3/access_log custom3
ErrorLog /web/vhosts/www3/error_log
<Directory "/web/vhosts/www3">
Options None
AllowOverride None
<RequireAll>
Require all granted
Require not ip 192.168.5.190
</RequireAll>
</Directory>
</VirtualHost>
<VirtualHost 192.168.5.181:80>
ServerName www4.stuX.com
DocumentRoot "/web/vhosts/www4"
LogFormat "%h %u %t \"%r\" %>s \"%{Referer}i\" \"%{User-Agent}i\"" custom4
CustomLog /web/vhosts/www4/access_log custom3
ErrorLog /web/vhosts/www4/error_log
<Directory "/web/vhosts/www4">
Options None
AllowOverride None
Require all granted
</Directory>
</VirtualHost>创建/web/vhosts/www3和/web/vhosts/www4目录，分别在目录里面添加一个简单的测试页面：
$ mkdir -p /web/vhosts/www{3,4}
$ echo "This is www3.stuX.com" > /web/vhosts/www3/index.html
$ echo "This is www4.stuX.com" > /web/vhosts/www4/index.html客户端测试
在客户端配置/etc/hosts文件，用来解析主机名
root@alternative:~# cat /etc/hosts | grep -i www 192.168.5.121 www1.stuX.com www2.stuX.com 192.168.5.181 www3.stuX.com www4.stuX.com
通过客户端的测试，可以看到结果如下所示，完成了基于主机名的虚拟主机配置：
root@alternative:~# curl http://www1.stuX.com This is www1.stuX.com root@alternative:~# curl http://www2.stuX.com This is www2.stuX.com root@alternative:~# curl http://www3.stuX.com This is www3.stuX.com root@alternative:~# curl http://www4.stuX.com This is www4.stuX.com 伪装客户端和跳转地址 root@alternative:~# curl -A "curl test" -e "http://www.baidu.com" http://www1.stuX.com This is www1.stuX.com root@alternative:~# curl -A "curl test2" -e "http://www.sina.com" http://www2.stuX.com This is www2.stuX.com root@alternative:~# curl -A "curl test3" -e "http://www.sohu.com" http://www3.stuX.com This is www3.stuX.com root@alternative:~# curl -A "curl test4" -e "http://www.163.com" http://www4.stuX.com This is www4.stuX.com 发起一些错误的请求，用来检测error_log是否生效 root@alternative:~# curl http://www1.stuX.com/123 <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /123 was not found on this server.</p> <hr> <address>Apache/2.2.15 (CentOS) Server at www1.stux.com Port 80</address> </body></html> root@alternative:~# curl http://www2.stuX.com/456 <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /456 was not found on this server.</p> <hr> <address>Apache/2.2.15 (CentOS) Server at www2.stux.com Port 80</address> </body></html> root@alternative:~# curl http://www3.stuX.com/789 <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /789 was not found on this server.</p> </body></html> root@alternative:~# curl http://www4.stuX.com/000 <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /000 was not found on this server.</p> </body></html>
查看一下访问日志以及错误日志：
$ tail -f /web/vhosts/www{1,2}/{access,error}_log
==> /web/vhosts/www1/access_log <==
192.168.5.180 - [02/Jun/2017:14:46:24 +0800] "GET / HTTP/1.1" 200 "-" "curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3"
192.168.5.180 - [02/Jun/2017:14:46:40 +0800] "GET /123 HTTP/1.1" 404 "-" "curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3"
192.168.5.180 - [02/Jun/2017:14:49:01 +0800] "GET / HTTP/1.1" 200 "http://www.baidu.com" "curl test"
==> /web/vhosts/www1/error_log <==
[Fri Jun 02 14:46:40 2017] [error] [client 192.168.5.180] File does not exist: /web/vhosts/www1/123
==> /web/vhosts/www2/access_log <==
192.168.5.180 - [02/Jun/2017:14:46:28 +0800] "GET / HTTP/1.1" 200 "-" "curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3"
192.168.5.180 - [02/Jun/2017:14:46:52 +0800] "GET /456 HTTP/1.1" 404 "-" "curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3"
192.168.5.180 - [02/Jun/2017:14:49:16 +0800] "GET / HTTP/1.1" 200 "http://www.sina.com" "curl test2"
==> /web/vhosts/www2/error_log <==
[Fri Jun 02 14:46:52 2017] [error] [client 192.168.5.180] File does not exist: /web/vhosts/www2/456对于httpd2.2版本的www1.stuX.com虚拟主机，以及httpd2.4版本的www3.stuX.com虚拟主机，分别添加状态监控页面，并且利用第三方模块mod_auth_mysql.so对用户账户进行认证与授权。用户账户存放在192.168.5.121这个节点的mysql服务器上面。认证采用aes加密认证。详细配置方案，请参照其他博文。
在mysql里面建立一个名为http_auth的数据库，在该数据库下建立一个名为mysql_auth的数据表，在表中添加两个用户，分别为admin和root，采用aes_encrypt函数对密码进行加密，加密用的salt分别为’hello’和’root’。如下所示：
mysql> use http_auth; Database changed mysql> show tables; +---------------------+ | Tables_in_http_auth | +---------------------+ | mysql_auth | +---------------------+ 1 row in set (0.00 sec) mysql> desc mysql_auth; +-------------+----------+------+-----+---------+-------+ | Field | Type | Null | Key | Default | Extra | +-------------+----------+------+-----+---------+-------+ | user_name | char(30) | NO | PRI | NULL | | | user_passwd | tinyblob | YES | | NULL | | | user_group | char(25) | YES | | NULL | | | salt | tinyblob | YES | | NULL | | +-------------+----------+------+-----+---------+-------+ 4 rows in set (0.01 sec) mysql> select * from mysql_auth; +-----------+------------------+------------+-------+ | user_name | user_passwd | user_group | salt | +-----------+------------------+------------+-------+ | admin | ?G°??P-S | admin | hello | | root |???￥V′l?Gχ | admin | root | +-----------+------------------+------------+-------+ 2 rows in set (0.00 sec)
注：确保mysql开启了用户远程访问的权限，在这里使用mysql的root@’%’用户，开启访问数据库的权限：grant all pribileges on *.* to root@‘%‘ identified by ‘root‘ with grant option
CentOS6, httpd2.2环境
将mod_auth_mysql.so模块加载进来，确保mod_auth_mysql.so模块在操作系统中存在，并且在/etc/httpd/modules里面有副本，这样便可以使用相对于ServerRoot的相对路径来引用，在主配置文件/etc/httpd/conf/httpd.conf里面添加一行：
LoadModule mysql_auth_module modules/mod_auth_mysql.so
以实验一的virtualhost.conf文件为基础，添加<Location>指令段开启状态页面，并针对状态页面做基于用户的协议认证，添加权限控制的选项，如下所示：
注： 针对mod_auth_mysql.so的配置指令，详细请参照该模块的文档。
注：这里的AuthBasicAuthoritative指令尤为重要，因为使用的是第三方认证模块，如果不设定为Off的话，httpd将认为该模块为非法模块从而无法使用。
...... ...... <Location /status> SetHandler server-status Order deny,allow Allow from all AuthType Basic AuthBasicAuthoritative Off AuthName "auth login" AuthMySQLHost 192.168.5.121 AuthMySQLPort 3306 AuthMySQLUser root AuthMySQLPassword shroot AuthMySQLDB http_auth AuthMySQLUserTable mysql_auth AuthMySQLNameField user_name AuthMySQLPasswordField user_passwd AuthMySQLEnable on AuthMySQLPwEncryption aes AuthMySQLSaltField salt require valid-user </Location> ...... ......
配置完毕之后，用service httpd restart命令重启httpd服务。
CentOS7, httpd2.4环境
同样需要将mod_auth_mysql.so添加进来，确保mod_auth_mysql.so模块在操作系统中存在，并且在/etc/httpd/modules里面有副本，这样便可以使用相对于ServerRoot的相对路径来引用。
httpd2.4的模块加载配置文件和上面的httpd2.2的模块配置加载文件不同，需要在/etc/httpd/conf.modules.d目录下面创建一个单独的模块加载配置文件，这里创建一个名字为10-mysql.conf的配置文件，在里面添加一行：
LoadModule mysql_auth_module modules/mod_auth_mysql.so
以实验一的virtualhost.conf文件为基础，添加<Location>指令段开启状态页面，并针对状态页面做基于用户的协议认证，添加权限控制的选项，如下所示：
注： 针对mod_auth_mysql.so的配置指令，详细请参照该模块的文档。
注：这里的AuthBasicAuthoritative指令尤为重要，因为使用的是第三方认证模块，如果不设定为Off的话，httpd将认为该模块为非法模块从而无法使用。
注：在httpd2.4里面，如果不显式定义AuthUserFile，有可能会遇到认证失败的情况。因为使用mysql里面的数据进行认证，因此这里只需要指定文件系统的认证文件为/dev/null即可。
<Location /status> SetHandler server-status AuthType Basic AuthBasicAuthoritative Off AuthName "auth login" AuthUserFile /dev/null AuthMySQLHost 192.168.5.121 AuthMySQLPort 3306 AuthMySQLUser root AuthMySQLPassword root AuthMySQLDB http_auth AuthMySQLUserTable mysql_auth AuthMySQLNameField user_name AuthMySQLPasswordField user_passwd AuthMySQLEnable on AuthMySQLPwEncryption aes AuthMySQLSaltField salt Require valid-user </Location>
客户端测试
由于被测试页面为status状态监控页面，因此这里采用Firefox的GUI界面进行验证：
在浏览器界面上面键入http://www1.stuX.com/status，弹出认证对话框，输入admin用户名以及密码，如下图所示：
可以发现登录成功，观察到的状态页面如下所示：
测试http://www3.stuX.com/status，亦登录成功，效果如下所示：
下面用curl命令行工具测试一下数据库关闭以及认证错误的情况。
模拟一些认证错误，故意输入错误的用户名和密码，测试效果如下：
root@alternative:~# curl -u admin:123 http://www1.stuX.com/status <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>401 Authorization Required</title> </head><body> <h1>Authorization Required</h1> <p>This server could not verify that you are authorized to access the document requested. Either you supplied the wrong credentials (e.g., bad password), or your browser doesn‘t understand how to supply the credentials required.</p> <hr> <address>Apache/2.2.15 (CentOS) Server at www1.stux.com Port 80</address> </body></html> root@alternative:~# curl -u 123:123 http://www3.stuX.com/status <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>401 Unauthorized</title> </head><body> <h1>Unauthorized</h1> <p>This server could not verify that you are authorized to access the document requested. Either you supplied the wrong credentials (e.g., bad password), or your browser doesn‘t understand how to supply the credentials required.</p> </body></html>
在192.168.5.121上面关闭mysql数据库，再测试认证，发现认证失败：
$ service mysqld stop root@alternative:~# curl -u admin:admin http://www3.stuX.com/status <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>401 Unauthorized</title> </head><body> <h1>Unauthorized</h1> <p>This server could not verify that you are authorized to access the document requested. Either you supplied the wrong credentials (e.g., bad password), or your browser doesn‘t understand how to supply the credentials required.</p> </body></html>
相关的错误日志文件输出：
[Sun Jun 04 19:23:22 2017] [error] [pid 16685] mod_auth_mysql.c(521): [client 192.168.5.180:55679] MySQL ERROR: Can‘t connect to MySQL server on ‘192.168.5.121‘ (111)
配置基于IP的简单认证规则，使得：
192.168.5.180这台客户端无法访问www1.stuX.com
192.168.5.190这台客户端无法访问www3.stuX.com
CentOS6, httpd2.2环境下
在实验二的virtualhost.conf配置文件基础上，在<Directory “/web/vhosts/www1”>里面添加Deny from，如下所示：
<Directory "/web/vhosts/www1"> Order allow,deny Allow from all Deny from 192.168.5.180/32 </Directory>
重启httpd服务service httpd restart
CentOS7 httpd2.4环境下
在实验二的virtualhost.conf配置文件的基础上，在<Directory “/web/vhosts/www3”>里面添加<RequireAll>标签，并配置IP访问权限，如下所示：
<Directory "/web/vhosts/www3"> Options None AllowOverride None <RequireAll> Require all granted Require not ip 192.168.5.190 </RequireAll> </Directory>
客户端测试
在192.168.5.180这台机器上面用curl命令访问，发现www1.stuX.com访问失败，提示403 Forbidden错误，证明访问控制生效。www3.stuX.com可以正常访问。
root@alternative:~# curl http://www1.stuX.com/index.html <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don‘t have permission to access /index.html on this server.</p> <hr> <address>Apache/2.2.15 (CentOS) Server at www1.stux.com Port 80</address> </body></html> root@alternative:~# root@alternative:~# curl http://www3.stuX.com/index.html This is www3.stuX.com
在192.168.5.190这台机器上面用curl命令访问，发现www3.stuX.com访问失败，提示403 Forbidden错误，证明访问控制生效。www1.stuX.com可以正常访问。
root@ubuntu-node1:~# curl http://www3.stuX.com/index.html <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don‘t have permission to access /index.html on this server.</p> </body></html> root@ubuntu-node1:~# curl http://www1.stuX.com/index.html This is www1.stuX.com
分别为www2.stuX.com和www4.stuX.com建立https服务，选用192.168.5.182这台机器作为CA。
首先需要将httpd2.2服务器、httpd2.4服务器、CA服务器、客户端进行时间同步，如果不同步的话，有可能会出现httpd服务器或者客户端的时间要早于CA根证书的有效起始时间，从而导致错误。使用ntpdate命令或者ntpd服务进行时间同步，详细步骤请参照linux的ntp服务及配置。
CA生成根证书
首先生成私钥:
$ cd /etc/pki/CA $ (umask 077; openssl genrsa -out private/cakey.pem 2048) $ ls -al private/ total 4 drwx------. 2 root root 22 Jun 4 20:16 . drwxr-xr-x. 6 root root 57 Mar 20 06:43 .. -rw------- 1 root root 1675 Jun 4 20:16 cakey.pem
然后通过私钥生成自签名证书：
$ openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365 You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter ‘.‘, the field will be left blank. ----- Country Name (2 letter code) [XX]:CN State or Province Name (full name) []:BJ Locality Name (eg, city) [Default City]:BJ Organization Name (eg, company) [Default Company Ltd]:CA Organizational Unit Name (eg, section) []:caexec Common Name (eg, your name or your server‘s hostname) []:ca.caexec.com Email Address []: $ touch index.txt serial $ echo 01 > serial $ ls /etc/pki/CA cacert.pem certs crl index.txt newcerts private serial
httpd2.2服务器生成证书请求并到CA签名
首先生成私钥
$ mkdir /web/vhosts/www2/ssl $ cd /web/vhosts/www2/ssl/ $ (umask 077; openssl genrsa -out www2.key 2048)
根据私钥生成证书申请请求
$ openssl req -new -key www2.key -out www2.csr You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter ‘.‘, the field will be left blank. ----- Country Name (2 letter code) [XX]:CN State or Province Name (full name) []:BJ Locality Name (eg, city) [Default City]:BJ Organization Name (eg, company) [Default Company Ltd]:CA Organizational Unit Name (eg, section) []:ops Common Name (eg, your name or your server‘s hostname) []:www2.stuX.com Email Address []: Please enter the following ‘extra‘ attributes to be sent with your certificate request A challenge password []: An optional company name []:
将证书申请请求发送到CA服务器上面，CA进行签名，签完之后再返回给httpd2.2服务器
$ openssl ca -in www2.csr -out www2.crt -days 365 Using configuration from /etc/pki/tls/openssl.cnf Check that the request matches the signature Signature ok Certificate Details: Serial Number: 1 (0x1) Validity Not Before: Jun 4 14:23:12 2017 GMT Not After : Jun 4 14:23:12 2018 GMT Subject: countryName = CN stateOrProvinceName = BJ organizationName = CA organizationalUnitName = ops commonName = www2.stuX.com X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: 99:13:92:93:B4:64:FF:15:70:6A:FF:6A:E0:C1:AA:E9:C1:28:13:47 X509v3 Authority Key Identifier: keyid:D0:3B:30:3D:AF:76:F3:47:7D:83:FA:F1:19:F9:1D:29:11:9C:42:E1 Certificate is to be certified until Jun 4 14:23:12 2018 GMT (365 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated
确保httpd2.2服务器上面安装有mod_ssl模块，如果没有的话，用yum install mod_ssl安装，或者编译安装。
$ httpd -M | grep ssl ssl_module (shared) Syntax OK
创建一个测试页面ssl.html
echo "This is ssl page for www2.stuX.com." > /web/vhosts/www2/ssl.html
在原有的virtualhost.conf文件上面配置一个新的<VirtualHost>，提供https服务，并将服务器私钥和CA签发的证书配置上去，配置完毕之后，重启httpd服务service httpd restart：
<VirtualHost 192.168.5.121:443> ServerName www2.stuX.com DocumentRoot "/web/vhosts/www2" DirectoryIndex ssl.html ErrorLog /web/vhosts/www2/ssl_error_log LogLevel info TransferLog /web/vhosts/www2/ssl_access_log SSLEngine on SSLProtocol all -SSLv2 SSLCipherSuite DEFAULT:!EXP:!SSLv2:!DES:!IDEA:!SEED:+3DES SSLCertificateFile /web/vhosts/www2/ssl/www2.crt SSLCertificateKeyFile /web/vhosts/www2/ssl/www2.key <Directory "/web/vhosts/www2"> Order allow,deny Allow from all </Directory> </VirtualHost>
httpd2.4服务器生成证书请求并到CA签名
生成私钥
$ mkdir /web/vhosts/www4/ssl $ cd /web/vhosts/www4/ssl/ $ (umask 077; openssl genrsa -out www4.key 2048)
根据私钥生成证书申请请求
$ openssl req -new -key www4.key -out www4.csr You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter ‘.‘, the field will be left blank. ----- Country Name (2 letter code) [XX]:CN State or Province Name (full name) []:BJ Locality Name (eg, city) [Default City]:BJ Organization Name (eg, company) [Default Company Ltd]:CA Organizational Unit Name (eg, section) []:ops Common Name (eg, your name or your server‘s hostname) []:www4.stuX.com Email Address []: Please enter the following ‘extra‘ attributes to be sent with your certificate request A challenge password []: An optional company name []:
将证书申请请求发送到CA服务器上面，CA进行签名，签完之后再返回给httpd2.2服务器
$ openssl ca -in www4.csr -out www4.crt -days 365 Using configuration from /etc/pki/tls/openssl.cnf Check that the request matches the signature Signature ok Certificate Details: Serial Number: 2 (0x2) Validity Not Before: Jun 4 16:14:45 2017 GMT Not After : Jun 4 16:14:45 2018 GMT Subject: countryName = CN stateOrProvinceName = BJ organizationName = CA organizationalUnitName = ops commonName = www4.stuX.com X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: DE:84:D5:8C:11:7F:F8:C4:F4:26:49:A3:C2:0E:1A:07:62:00:06:8F X509v3 Authority Key Identifier: keyid:D0:3B:30:3D:AF:76:F3:47:7D:83:FA:F1:19:F9:1D:29:11:9C:42:E1 Certificate is to be certified until Jun 4 16:14:45 2018 GMT (365 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated
确保httpd2.4服务器上面安装有mod_ssl模块，如果没有的话，用yum install mod_ssl安装，或者编译安装。
$ httpd -M | grep ssl ssl_module (shared)
创建一个测试页面ssl.html
echo "This is ssl page for www4.stuX.com." > /web/vhosts/www4/ssl.html
在原有的virtualhost.conf文件上面配置一个新的<VirtualHost>，提供https服务，并将服务器私钥和CA签发的证书配置上去，配置完毕之后，重启httpd服务systemctl restart httpd.service：
<VirtualHost 192.168.5.181:443> ServerName www4.stuX.com DocumentRoot "/web/vhosts/www4" DirectoryIndex ssl.html ErrorLog /web/vhosts/www4/ssl_error_log LogLevel info TransferLog /web/vhosts/www4/ssl_access_log SSLEngine on SSLProtocol all -SSLv2 SSLCipherSuite DEFAULT:!EXP:!SSLv2:!DES:!IDEA:!SEED:+3DES SSLCertificateFile /web/vhosts/www4/ssl/www4.crt SSLCertificateKeyFile /web/vhosts/www4/ssl/www4.key <Directory "/web/vhosts/www4"> Options None AllowOverride None Require all granted </Directory> </VirtualHost>
客户端测试
将CA服务器的自签名证书拷贝到客户端上面，用curl工具进行测试，分别访问httpd2.2服务器和httpd2.4服务器的https服务页面：
root@alternative:~# curl --cacert cacert.pem https://www2.stuX.com This is ssl page for www2.stuX.com. root@alternative:~# curl --cacert cacert.pem https://www4.stuX.com This is ssl page for www4.stuX.com.
本文出自 “技术成就梦想” 博客，请务必保留此出处http://jiangche00.blog.51cto.com/4377920/1932165
标签：httpd ssl证书 mysql认证 linux.web服务
原文地址：http://jiangche00.blog.51cto.com/4377920/1932165
