//生成密钥
[root@SR1 ~]# mkdir ssl
[root@SR1 ~]# cd ssl/
[root@SR1 ssl]# openssl genrsa -out server.key 2048
Generating RSA private key, 2048 bit long modulus (2 primes)
..................................+++++
.....................+++++
e is 65537 (0x010001)
//生成证书请求文件
[root@SR1 ssl]# openssl req -new -key server.key -out server.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn //国家
State or Province Name (full name) []:hubei //省份
Locality Name (eg, city) [Default City]:wuhan //城市
Organization Name (eg, company) [Default Company Ltd]:wa // 公司
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:web01.example.com //域名
Email Address []: //邮箱地址
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
//生成证书crt
[root@SR1 ssl]# openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
Signature ok
subject=C = cn, ST = hubei, L = wuhan, O = wa, CN = web01.example.com
Getting Private key
//复制证书到指定位置
[root@SR1 ssl]# cd
[root@SR1 ~]# cd /etc/httpd/
[root@SR1 httpd]# cp -r /root/ssl/ /etc/httpd/
[root@SR1 httpd]# ll |grep ssl
drwxr-xr-x 2 root root 60 Oct 18 09:39 ssl //此处大小不能为0
//ssl.conf配置文件导入证书,默认站点使用此配置文件
[root@SR1 httpd]# vi /etc/httpd/conf.d/ssl.conf
DocumentRoot "/var/www/html" //取消此行注释
ServerName www.example.com:443 //取消此行注释
SSLCertificateFile /etc/httpd/ssl/server.crt //修改此行路径
SSLCertificateKeyFile /etc/httpd/ssl/server.key //修改此行路径
//将文件传输到RS2上面去
[root@SR2 ~]# mkdir /etc/httpd/ssl
[root@SR1 ssl]# scp server.crt server.key 192.168.218.133:/etc/httpd/s
ssl/ state/
[root@SR1 ssl]# scp server.crt server.key 192.168.218.133:/etc/httpd/ssl/
The authenticity of host '192.168.218.133 (192.168.218.133)' can't be established.
ECDSA key fingerprint is SHA256:R2vMn4cw3OiR2qHPNLGGvDqsJHfs36bHDGVkOUX7pqU.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.218.133' (ECDSA) to the list of known hosts.
root@192.168.218.133's password:
server.crt 100% 1172 1.5MB/s 00:00
server.key 100% 1675 2.8MB/s 00:00
//
DocumentRoot "/var/www/html" //取消此行注释
ServerName www.example.com:443 //取消此行注释
SSLCertificateFile /etc/httpd/ssl/server.crt //修改此行路径
SSLCertificateKeyFile /etc/httpd/ssl/server.key //修改此行路径
//重启服务
[root@SR1 ~]# systemctl restart httpd
[root@SR2 ~]# systemctl restart httpd
修改配置文件
[root@DR ~]# vi /etc/haproxy/haproxy.cfg
#--------------全局配置----------------
global
log 127.0.0.1 local0 info
#log loghost local0 info
maxconn 20480
#chroot /usr/local/haproxy
pidfile /var/run/haproxy.pid
#maxconn 4000
user haproxy
group haproxy
daemon
#---------------------------------------------------------------------
#common defaults that all the 'listen' and 'backend' sections will
#use if not designated in their block
#---------------------------------------------------------------------
defaults
mode tcp //模式改为tcp
log global
option dontlognull
option httpclose
option httplog
#option forwardfor
option redispatch
balance roundrobin
timeout connect 10s
timeout client 10s
timeout server 10s
timeout check 10s
maxconn 60000
retries 3
#--------------统计页面配置------------------
listen admin_stats
bind 0.0.0.0:8189
stats enable
mode http
log global
stats uri /haproxy_stats
stats realm Haproxy\ Statistics
stats auth admin:admin
#stats hide-version
stats admin if TRUE
stats refresh 30s
#---------------web设置-----------------------
listen webcluster
bind 0.0.0.0:443 //端口改为443
mode tcp //模式改为tcp
#option httpchk GET /index.html
log global
maxconn 3000
balance roundrobin
server web01 192.168.218.132:443 check inter 2000 fall 5 //端口改为443
server web02 192.168.218.133:443 check inter 2000 fall 5 //端口改为443
#server web01 192.168.80.102:80 cookie web01 check inter 2000 fall 5
//重启服务
[root@DR ~]# systemctl restart haproxy.service