Linux 搭建APache http_ssl(https)

 搭建APache http_ssl(https)

网站服务器(192.168.4.3)

1 网站服务器配置

运行网站服务 并编写网页文件 index.html

[root@WEB ~]# yum -y install httpd

[root@WEB ~]# echo www.test.com > /var/www/html/index.html

[root@WEB ~]# systemctl start httpd

[root@WEB ~]# systemctl stop firewalld

[root@WEB ~]# netstat -pantu | grep httpd

tcp6       0      0 :::80                   :::*                    LISTEN      6016/httpd    

客户端访问网站服务器

[root@test ~]# vim /etc/hosts

[root@test ~]# sed -n '3p' /etc/hosts

192.168.4.3 www.test.com

[root@test ~]# ping -c 2 www.test.com

PING www.test.com (192.168.4.3) 56(84) bytes of data.

64 bytes from www.test.com (192.168.4.3): icmp_seq=1 ttl=64 time=0.769 ms

64 bytes from www.test.com (192.168.4.3): icmp_seq=2 ttl=64 time=0.360 ms

客户端测试

[root@test ~]# firefox http://www.test.com

2 创建私钥文件 web.key

[root@WEB ~]# cd /etc/pki/tls/private/

[root@WEB private]# openssl genrsa 2048 > web.key

3 创建证书请求文件 web.csr

[root@WEB private]# openssl req -new -key web.key > /root/web.csr

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [XX]:CN

State or Province Name (full name) []:beijing

Locality Name (eg, city) [Default City]:beijing

Organization Name (eg, company) [Default Company Ltd]:Xuenqlve

Organizational Unit Name (eg, section) []:ope

Common Name (eg, your name or your server's hostname) []:www.test.com

Email Address []:[e-mail]

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

4 上传证书请求文件给CA服务器 (192.168.4.1)

[root@WEB private]# scp /root/web.csr 192.168.4.1:/root/

CA服务器 (192.168.4.1)

            CA服务器具体配置 http://blog.51cto.com/13558754/2057718

5 审核证书请求文件，并签发数字证书

[root@CA certs]# openssl ca -in /root/web.csr > web.crt

Using configuration from /etc/pki/tls/openssl.cnf

Enter pass phrase for /etc/pki/CA/private/my-ca.key:

Check that the request matches the signature

Signature ok

Certificate Details:

        Serial Number: 2 (0x2)

        Validity

            Not Before: Jan  5 05:15:56 2018 GMT

            Not After : Jan  5 05:15:56 2019 GMT

        Subject:

            countryName               = CN

            stateOrProvinceName       = beijing

            organizationName          = Xuenqlve

            organizationalUnitName    = ope

            commonName                = www.test.com

            emailAddress              = [e-mail]

        X509v3 extensions:

            X509v3 Basic Constraints: 

                CA:FALSE

            Netscape Comment: 

                OpenSSL Generated Certificate

            X509v3 Subject Key Identifier: 

                85:43:06:A3:7E:41:E5:15:AC:2C:ED:80:81:37:FE:BD:5F:5F:A1:8C

            X509v3 Authority Key Identifier: 

                keyid:87:06:18:98:79:53:0E:26:0A:91:2D:B9:93:8A:C3:86:2B:CC:DF:E7

Certificate is to be certified until Jan  5 05:15:56 2019 GMT (365 days)

Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y

Write out database with 1 new entries

Data Base Updated

[root@CA certs]# cat ../index.txt

V190105051556Z01unknown/C=CN/ST=beijing/O=Xuenqlve/OU=ope/CN=www.test.com/emailAddress=[e-mail]

[root@CA certs]# cat ../serial

02

6 下发证书给网站服务器(192.168.4.3)

[root@CA certs]# scp web.crt 192.168.4.3:/tmp/

7 配置服务运行时调用私钥文件和数字证书文件

[root@WEB ~]# yum -y install mod_ssl.x86_64

[root@WEB ~]# vim /etc/httpd/conf.d/ssl.conf 

[root@WEB ~]# sed -n '100p;107p' /etc/httpd/conf.d/ssl.conf

SSLCertificateFile /etc/pki/tls/certs/web.crt

SSLCertificateKeyFile /etc/pki/tls/private/web.key

[root@WEB ~]# cp /tmp/web.crt /etc/pki/tls/certs/web.crt

[root@WEB ~]# systemctl restart httpd

[root@WEB ~]# netstat -pantu | grep httpd

tcp6       0      0 :::80                   :::*                    LISTEN      6459/httpd          

tcp6       0      0 :::443                  :::*                    LISTEN      6459/httpd   

客户端进行测试

[root@test ~]# firefox https://www.test.com

单击'我已充分了解可能风险' ----> 单击 '添加例外' 

单击'确认安全例外'

然后就可以看见网页可以正常访问

在证书管理 --- 服务器  会添加此次访问例外

这是一种临时的方法 

8.下载并安装根证书

[root@test ~]# wget http://192.168.4.1/ca/my-ca.crt

--2018-01-05 01:15:07--  http://192.168.4.1/ca/my-ca.crt

正在连接 192.168.4.1:80... 已连接。

已发出 HTTP 请求，正在等待回应... 200 OK

长度：1424 (1.4K)

正在保存至: “my-ca.crt”

100%[===================================================================>] 1,424       --.-K/s 用时 0s      

2018-01-05 01:15:07 (66.0 MB/s) - 已保存 “my-ca.crt” [1424/1424])

在浏览器中添加证书可信  具体添加步骤见 http://blog.51cto.com/13558754/2057718

查看证书具体信息

9.修改配置文件 使得当用户访问http时 自动跳转到https

[root@WEB certs]# vim /etc/httpd/conf/httpd.conf 

[root@WEB certs]# tail -7 /etc/httpd/conf/httpd.conf

<IfModule ssl_module>

    SSLRandomSeed  startup  builtin

    SSLRandomSeed  connect  builtin

</IfModule>

RewriteEngine  on#启用模块

RewriteCond  %{SERVER_PORT}  !^443$#当变量SERVER_PORT 不是 443时 

RewriteRule  (.*)  https://%{SERVER_NAME}/$1  [R]#将访问网站url 跳转为https：