Apache配置https
配置https的注意事宜
yum安装httpd服务情况:
需要安装mod_ssl模块,其安装后会在/etc/httpd/conf.d/目录下生成ssl.conf文件,需要其配置文件中加载相应的模块文件及配置
编译安装httpd服务的情况:
要编译的时候可以使用 --enable-ssl选项启用ssl功能,只需要在httpd的配置文件中, 加载相应的ssl模块及配置相关ssl参数
SSL会议的简化过程
- 客户端发送可供选择的加密方式,并向服务器请求证书
- 服务器端发送证书以及选定的加密方式给客户端
- 客户端取得证书并先进行证书验证
- 验证证书的合法性,用CA的公钥解密证书上数字签名
- 验证证书的内容合法性:完整性验证
- 检查证书的有效期限
- 检查证书是否被吊销
- 证书中拥有者的名字,与访问的目标主机是否一致
- 客户端生成临时会议密码(对称密钥),并使用服务器端的公钥加密此数据发送给服务器,完成密钥交换
- 服务器用此密码加密用户请求的资源,响应给客户端
https配置实例
配置CA及证书
yum install httpd -y CA cd /etc/pki/CA/ [root@Centos7 CA]# ls certs crl newcerts private [root@Centos7 CA]# cd private/ [root@Centos7 private]# (umask 077; openssl genrsa -out cakey.pem 2048) Generating RSA private key, 2048 bit long modulus .........................................+++ ........................+++ e is 65537 (0x10001) [root@Centos7 private]# [root@Centos7 CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365 You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:CN State or Province Name (full name) []:CN Locality Name (eg, city) [Default City]:Beijing Organization Name (eg, company) [Default Company Ltd]:Mageedu Organizational Unit Name (eg, section) []:Ops Common Name (eg, your name or your server's hostname) []:ca.mageedu.com Email Address []:admin@mageedu.com [root@Centos7 CA]# ls cacert.pem certs crl newcerts private [root@Centos7 CA]# touch index.txt serial [root@Centos7 CA]# echo 01 > serial [root@Centos7 CA]# ls cacert.pem certs crl index.txt newcerts private serial http server root@Centos7 ~]# cd /etc/httpd/ [root@Centos7 httpd]# ls conf conf.d conf.modules.d logs modules run [root@Centos7 httpd]# mkdir ssl root@Centos7 ssl]# (umask 077;openssl genrsa -out httpd.key 2048) Generating RSA private key, 2048 bit long modulus ...+++ .................................................................................+++ e is 65537 (0x10001) [root@Centos7 ssl]# openssl req -new -key httpd.key -out httpd.csr -days 365 You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:CN State or Province Name (full name) []:CN Locality Name (eg, city) [Default City]:Beijing Organization Name (eg, company) [Default Company Ltd]:Mageedu Organizational Unit Name (eg, section) []:Ops Common Name (eg, your name or your server's hostname) []:www.zhenping.com Email Address []:admin@zhenping.com [root@Centos7 ssl]# scp httpd.csr root@172.16.36.71:/tmp CA Server [root@Centos7 CA]# openssl ca -in /tmp/httpd.csr -out certs/httpd.crt -days 365 Using configuration from /etc/pki/tls/openssl.cnf Check that the request matches the signature Signature ok Certificate Details: Serial Number: 1 (0x1) Validity Not Before: Jan 17 23:42:58 2016 GMT Not After : Jan 16 23:42:58 2017 GMT Subject: countryName = CN stateOrProvinceName = CN organizationName = Mageedu organizationalUnitName = Ops commonName = www.zhenping.com emailAddress = admin@zhenping.com X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: 61:7F:29:8A:68:A6:70:C2:F2:0E:49:15:D7:DD:4D:02:BF:EF:92:6A X509v3 Authority Key Identifier: keyid:18:F8:A6:71:FB:05:F3:0C:D3:56:9C:90:78:F1:4D:B5:0E:EC:51:5F Certificate is to be certified until Jan 16 23:42:58 2017 GMT (365 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated [root@Centos7 CA]# scp certs/httpd.crt root@172.16.36.70:/etc/httpd/ssl The authenticity of host '172.16.36.70 (172.16.36.70)' can't be established. ECDSA key fingerprint is f7:6e:2f:38:57:8e:8c:0b:12:74:cc:af:44:82:88:17. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '172.16.36.70' (ECDSA) to the list of known hosts. root@172.16.36.70's password: httpd.crt 100% 4606 4.5KB/s 00:00 httpd server vim /etc/httpd/conf.d/ssl.conf DocumentRoot "/var/www/html" ServerName www.zhenping.com SSLCertificateFile /etc/httpd/ssl/httpd.crt SSLCertificateKeyFile /etc/httpd/ssl/httpd.key
http的配置
root@Centos6-ser1 ~]# cat /etc/httpd/conf.d/vhost.conf
LoadModule status_module modules/mod_status.so
<Location /server-status>
SetHandler server-status
order deny,allow
deny from all
allow from 172.16.249.148
</Location>
namevirtualhost 172.16.36.60:80
<VirtualHost 172.16.36.60:80>
servername wwww.a.com
Documentroot "/www/a.com/htdocs/"
alias /download "/www/a.com/htdocs/file"
Errorlog /www/log/a.com/error.log
LogLevel warn
Customlog /www/log/a.com/access.log combined
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
<Directory "/www/a.com/htdocs/file/">
Options Indexes
AllowOverride None
AuthType Basic
AuthName "Please enter you username and password...."
AuthUserFile "/etc/httpd/conf/.htpass"
Require user zhenping
</Directory>
</virtualhost>
<virtualhost 172.16.36.60:80>
servername www.b.com
documentroot "/www/b.com/htdocs"
Errorlog /www/log/b.com/error.log
LogLevel warn
Customlog /www/log/b.com/access.log combined
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
<Directory "/www/b.com/htdocs">
Options None
AllowOverride None
AuthType Basic
AuthName "Please Enter your username and password."
AuthUserFile "/etc/httpd/conf/.htpass"
AuthGroupFile "/etc/httpd/conf/.htpass_group"
Require group mygrp
</Directory>
</virtualhost>
<virtualhost 172.16.36.60:80>
servername www.c.com
documentroot "/www/c.com/htdocs"
ErrorLog /www/log/c.com/error.log
LogLevel warn
CustomLog /www/log/c.com/access.log combined
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
<Directory "/www/c.com/htdocs">
Options None
AllowOverride None
order deny,allow
deny from all
allow from 172.16.249.148
</Directory>
</virtualhost>号外号外：
现在我们公众号推出参与奖和互动奖，凡是通过微信与我们参与讨论互动最多的朋友，将获得我们送出的神秘礼物，还有机会获得Ansible中文官网马上将出版的新书哦！ 我们将不定期的推
