apache+openssl搭建

环境：centos7.6 
openssl 版本

[root@localhost ~]# openssl version -a
OpenSSL 1.0.2k-fips 26 Jan 2017
built on: reproducible build, date unspecified
platform: linux-x86_64
options: bn(64,64) md2(int) rc4(16x,int) des(idx,cisc,16,int) idea(int) blowfish(idx)
compiler: gcc -I. -I.. -I../include -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DKRB5_MIT -m64 -DL_ENDIAN -Wall -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -Wa,--noexecstack -DPURIFY -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DRC4_ASM -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM
OPENSSLDIR: "/etc/pki/tls"
engines: rdrand dynamic

安装所需的包

yum -y install gcc* expat-devel

cd /usr/local/src
tar xf apr-1.7.0.tar.gz
cd apr-1.7.0/
./configure --prefix=/usr/local/apr
make && make install

cd ..
tar xf apr-util-1.6.1.tar.gz
cd apr-util-1.6.1/
./configure --prefix=/usr/local/apr-util --with-apr=/usr/local/apr
make && make install

cd ..
tar xf pcre-8.43.tar.gz
cd pcre-8.43/
./configure --prefix=/usr/local/pcre
make && make install

cd ..
tar xf openssl-1.1.1c.tar.gz 
cd openssl-1.1.1c/
./config --prefix=/usr/local/ssl --shared
make && make install
echo "/usr/local/ssl/lib" >>/etc/ld.so.conf
ldconfig     #使库文件生效

cd ..
tar xf httpd-2.4.41.tar.gz
cd httpd-2.4.41/
./configure --prefix=/usr/local/httpd --with-apr=/usr/local/apr --with-apr-util=/usr/local/apr-util --with-pcre=/usr/local/pcre  --enable-so --enable-rewrite --enable-ssl --with-ssl=/usr/local/ssl --with-mpm=prefork
make && make install

vim /usr/local/httpd/conf/httpd.conf
ServerName localhost:80

/usr/local/httpd/bin/apachectl start

#私钥
/usr/local/ssl/bin/openssl genrsa -des3 -out server.key 1024
#生成服务器证书请求
openssl req -new -key server.key -out server.csr
#自签证
[root@mylinux conf]# /usr/local/ssl/bin/openssl x509 -req -days 700 -in server.csr -signkey server.key -out server.crt
Signature ok
subject=C = CN, ST = beijing, L = beijing, O = lenovo.com, OU = IT, CN = liullm7
Getting Private key
Enter pass phrase for server.key:


vim httpd.conf
Include conf/extra/httpd-ssl.conf  #httpd-ssl.conf文件里面的两个密钥名称serve.crt  server.key
LoadModule ssl_module modules/mod_ssl.so
LoadModule socache_shmcb_module modules/mod_socache_shmcb.so

去除私钥短语，启动的时候就不用输入了
[root@mylinux conf]# /usr/local/ssl/bin/openssl rsa -in server.key -out server.key
Enter pass phrase for server.key:
writing RSA key

/usr/local/httpd/bin/apachectl restart

[root@mylinux ~]# /usr/local/ssl/bin/openssl version -a
OpenSSL 1.1.1c  28 May 2019
built on: Thu Aug 22 15:33:35 2019 UTC
platform: linux-x86_64
options:  bn(64,64) rc4(16x,int) des(int) idea(int) blowfish(ptr) 
compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -Wall -O3 -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM -DNDEBUG
OPENSSLDIR: "/usr/local/ssl/ssl"
ENGINESDIR: "/usr/local/ssl/lib/engines-1.1"
Seeding source: os-specific
[root@mylinux ~]# openssl version -a
OpenSSL 1.0.2k-fips  26 Jan 2017
built on: reproducible build, date unspecified
platform: linux-x86_64
options:  bn(64,64) md2(int) rc4(16x,int) des(idx,cisc,16,int) idea(int) blowfish(idx) 
compiler: gcc -I. -I.. -I../include  -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DKRB5_MIT -m64 -DL_ENDIAN -Wall -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches   -m64 -mtune=generic -Wa,--noexecstack -DPURIFY -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DRC4_ASM -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM
OPENSSLDIR: "/etc/pki/tls"
engines:  rdrand dynamic