（2）Rocky中https服务域名搭建，用ssl协议

莱茵x

已于 2024-07-22 08:46:25 修改

阅读量567

点赞数 24

分类专栏： lnx的Linux 文章标签：运维 linux 服务器

于 2024-07-16 19:13:41 首次发布

本文链接：https://blog.csdn.net/2201_75745826/article/details/140471117

版权

lnx的Linux 专栏收录该内容

20 篇文章 1 订阅

订阅专栏

前言：所以主机先联网，下载chrond,统一时间，IP地址的内容最后设置，因为要连网下载软件包，服务器和selinux和防火墙关掉。

Rocky要换源，打开crb，下载epel源。因为原本默认的地址，全是国外的地址，下载速度慢

#mkdir a

#cp rocky* /a

# 阿里

sed -e 's|^#mirrorlist=|mirrorlist=|g' \

-e 's|^baseurl=https://mirrors.aliyun.com/rockylinux|#baseurl=http://dl.rockylinux.org/$contentdir|g' \

-i.bak \

/etc/yum.repos.d/rocky*.repo

# 中科大

sed -e 's|^mirrorlist=|#mirrorlist=|g' \

-e 's|^#baseurl=http://dl.rockylinux.org/$contentdir|baseurl=https://mirrors.ustc.edu.cn/rocky|g' \

-i.bak \

/etc/yum.repos.d/rocky-extras.repo \

/etc/yum.repos.d/rocky.repo

————————————————

原文链接：https://blog.csdn.net/song5bai/article/details/132566228

#yum config-manager --set-enabled crb 开启crb为Complete Releasabld Binding完全可释放绑定，轻松解决绑定或链接机制

#yum -y install epel-release 安装epel源，解决一些依赖关系

#yum -y install vim 安装vim

#yum -y install bash-completion 安装自动补齐

dns服务器为web.example.com，IP地址为192.168.121.30;CA（证书发行机构）为私有CA,主机为ca.example.com，IP地址为192.168.121.40;最后客户端的地址为192.168,121.100,dns为192.168.121.30。所以网关为192.168.121.2。

1、在web.example.com主机上(先搭建http,再搭建https)

#hostnamectl hostname web.example.com

#bash

#yum -y install httpd bind bind-utils

#cp -p /etc/name.conf /etc/name.conf.bak 备份，防止改错了，恢复不了

#vim /etc/name.conf
options {
listen-on port 53 { any; };
listen-on-v6 port 53 { any; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
secroots-file "/var/named/data/named.secroots";
recursing-file "/var/named/data/named.recursing";
allow-query { any; };

# cp -p /etc/named.rfc1912.zones /etc /name.rfc1912.zones.bak
# vim /etc/named.rfc1912.zones

zone "example.com" IN {
type master;
file "laiyingx.com";
allow-update { none; };
};

zone "121.168.192.arpa" IN {
type master;
file "com.laiyingx";
allow-update { none; };
};

# cd /var/named/

[root@web named]# cp -p named.localhost laiyingx.com -p连带它的所有者所属组不发生改变

注意：这里要写完全域名web.example.com.在com后面有一个点，是根域，也叫顶级域，不能省略，访问的时候一般省略

#vim laiyingx.com

$TTL 1D
@ IN SOA web.example.com. root.example.com. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS web.example.com.
A 127.0.0.1
AAAA ::1

web IN A 192.168.121.30
ca IN A 192.168.121.40

[root@web named]# ll -Z named.localhost
-rw-r----- 1 root named ? 152 May 1 00:27 named.localhost

[root@web named]# cp -p com.laiyingx named.empty

#vim com.laiyingx

$TTL 3H
@ IN SOA web.example.com. root.example.com. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS web.example.com.
A 127.0.0.1
AAAA ::1

30 IN PTR web.example.com.
40 IN PTR ca.example.com.

2、CA是权威证书发行机构，https端口号是443。https是密文加密，并且有证书。密文是客户端随机生成一组32字节的数据random_c，里面包含支持的版本，支持的加密的算法。然后服务器端也生成一组32字节的数据random_s,确认版本和算法。random_c和random_s共同组成公钥pre_master。在客户端访问时，用公钥解密。这是一种作用，另一种作用就是证书，反正就是一张纸，找权威机构颁发就行了，然后客户端访问时，会先下载证书，有之后，安全访问。

[root@ca ~]# hostname
ca.example.com
[root@ca ~]# yum -y install openssl

[root@ca ~]# vim /etc/pki/tls/openssl.cnf 查看ca的步骤

[ CA_default ]

dir = /etc/pki/CA # Where everything is kept
certs = $dir/certs # Where the issued certs are kept

$dir是调用上面的目录/etc/pki/CA
crl_dir = $dir/crl # Where the issued crl are kept
database = $dir/index.txt # database index file.
#unique_subject = no # Set to 'no' to allow creation of
# several certs with same subject.
new_certs_dir = $dir/newcerts # default place for new certs.

certificate = $dir/cacert.pem # The CA certificate
serial = $dir/serial # The current serial number
crlnumber = $dir/crlnumber # the current crl number
# must be commented out to leave a V1 CRL
crl = $dir/crl.pem # The current CRL
private_key = $dir/private/cakey.pem# The private key

# mkdir -p /etc/pki/CA/{certs,crl,newcerts,private}

[root@ca ~]# cd /etc/pki/CA/
[root@ca CA]# (umask 077;openssl genrsa -out private/cakey.pem) 生成CA的私钥放在private目录里面，将umask值改为077，这样别人就不能查看，私钥不能被别人看

umask: linux默认的umask为022,首先系统会给一个最大权限减去umask值的权限为最终权限。比如创建目录的最大权限为777，减去022，所以创建目录的默认权限为755。创建文件的最大权限是666,减去022，为644，所以创建文件的默认权限为644。7为最高权限，2代表写，4代表读取，1为执行。分别是所有者，所诉组，其他人。

[root@ca CA]# openssl req -new -x509 -key /etc/pki/CA/private/cakey.pem -out /etc/pki/CA/cacert.pem 用ca私钥生成的证书

下面的地区，名字，机构，邮箱乱填就行，但是要记住，最后一个邮箱不用(忽略下面的错误)

Country Name (2 letter code) [XX]:ca^H^H
String too long, must be at most 2 bytes long
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HUBEI
Locality Name (eg, city) [Default City]:WUHAN
Organization Name (eg, company) [Default Company Ltd]:HYZY
Organizational Unit Name (eg, section) []:C^H
Common Name (eg, your name or your server's hostname) []:ca.example.com
Email Address []:root@master^H
[root@ca CA]# echo 01 > serial 写一个序列号
[root@ca CA]# touch index.txt 数据库文件

3、在web.example.com服务器

[root@web ~]# yum -y install mod_ssl openssl
[root@web ~]# cd /etc/httpd/
[root@web httpd]# mkdir ssl

[root@web httpd]# (umask 077;openssl genrsa -out /etc/httpd/ssl/httpd.key) 生成dns服务端的的私钥

[root@web httpd]# openssl req -new -key /etc/httpd/ssl/httpd.key -out /etc/httpd/ssl/httpd.csr -days 365 用web私钥生成证书，放在/etc/httpd/ssl目录下，命令为httpd.csr

Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HUBEI
Locality Name (eg, city) [Default City]:WUHAN
Organization Name (eg, company) [Default Company Ltd]:HYZY
Organizational Unit Name (eg, section) []:WE^H^H
Common Name (eg, your name or your server's hostname) []:web.example.com
Email Address []:root@example.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
最后两个直接敲回车，前面内容于=与ca对应，最后两个不用，一个是域名，一个是邮箱

[root@web httpd]# vim /etc/NetworkManager/system-connections/ens160.nmconnection

dns=192.168.121.30;

[root@web ~]# systemctl restart NetworkManager
[root@web ~]# nmcli connection up ens160

在ca.example.com里面

[root@ca CA]# vim /etc/NetworkManager/system-connections/ens160.nmconnection

dns=192.168.121.30;
[root@ca CA]# systemctl restart NetworkManager
[root@ca CA]# nmcli connection up ens160

回到web.example.com

[root@web ssl]# pwd
/etc/httpd/ssl
[root@web ssl]# scp httpd.csr root@ca.example.com:/etc/pki/CA 将文件复制到CA，其实就是给CA，现实是纸张和网上的两份
The authenticity of host 'ca.example.com (192.168.121.40)' can't be established.
ED25519 key fingerprint is SHA256:xuvfYxwIGIYEqq8VSlj7qiGimmP6QY0Gt9Sf7vMhUEw.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? y
Please type 'yes', 'no' or the fingerprint: y
Please type 'yes', 'no' or the fingerprint: yes
Warning: Permanently added 'ca.example.com' (ED25519) to the list of known hosts.
root@ca.example.com's password:

在ca.example.com上

#cd /etc/pki/CA

[root@ca CA]# pwd
/etc/pki/CA

[root@ca CA]# openssl ca -in /etc/pki/CA/httpd.csr -out /etc/pki/CA/certs/httpd.crt -days 366 签署最后的证书，也就是用户访问网站下载的证书放在 /etc/pki/CA/certs目录下，命名为httpd.crt。时间可以不用设置，默认就是一年365天。

在客户端和dns服务器端各下载一份最终的证书

[root@web ~]# cd /etc/httpd/ssl/

[root@web ssl]# scp root@192.168.121.40:/etc/pki/CA/certs/httpd.crt .
后面有一个点，代表当前目录，将证书下载到web.example.com的 /etc/httpd/ssl/目录
[root@web ssl]# vim /etc/httpd/conf.d/ssl.conf 改两行文件

SSLEngine on

SSLCertificateFile /etc/httpd/ssl/httpd.crt
SSLCertificateKeyFile /etc/httpd/ssl/httpd.key
不想解释了，硬看吧

[root@web conf.d]# pwd
/etc/httpd/conf.d
[root@web conf.d]# find / -name "*httpd*host*"
/etc/httpd/conf.d/httpd-vhosts.conf
/usr/share/doc/httpd-core/httpd-vhosts.conf
[root@web conf.d]# cp -p /usr/share/doc/httpd-core/httpd-vhosts.conf . 后面有个点，复制到当前目录，也就是/etc/httpd/conf.d目录
[root@web conf.d]# vim httpd-vhosts.conf 最后加上这几段，前面两段不用删，是模板

<VirtualHost 192.168.121.30:443>
DocumentRoot "/var/www/html"
ServerName web.example.com
SSLEngine on
SSLCertificateFile /etc/httpd/ssl/httpd.crt
SSLCertificateKeyFile /etc/httpd/ssl/httpd.key
</VirtualHost>
4、验证，在图形化客户端

[root@localhost ~]# vim /etc/NetworkManager/system-connections/ens160.nmconnection

将dns改为192.168.121.40

[ipv4]
address1=192.168.121.100/24,192.168.121.2
dns=192.168.121.30;
method=manual

[root@localhost ~]# systemctl restart NetworkManager
[root@localhost ~]# nmcli connection up ens160

并将CA的公钥发给客户端

[root@localhost ~]# scp root@ca.example.com:/etc/pki/CA/cacert.pem . 后有一个点
The authenticity of host 'ca.example.com (192.168.121.40)' can't be established.
ED25519 key fingerprint is SHA256:xuvfYxwIGIYEqq8VSlj7qiGimmP6QY0Gt9Sf7vMhUEw.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'ca.example.com' (ED25519) to the list of known hosts.
root@ca.example.com's password:
cacert.pem

在客户端

设置----安全与私密----证书----添加证书----ok