httpd

#httpd基础

curl支持以下功能：https认证
http的POST/PUT等方法
ftp上传
kerberos认证
http上传
代理服务器
cookies
用户名/密码认证
下载文件断点续传
socks5代理服务器
通过http代理服务器上传文件到ftp服务器
###3.3.2httpd命令
语法：http [options]
常用的options
-l 查看静态编译的模块，列出核心中编译了哪些模块

[root@localhost ~]# httpd -l
Compiled in modules:
  core.c
  mod_so.c
  http_core.c

-M 输出一个已经启动的模块列表，包括静态编译在服务。

[root@localhost ~]# httpd -M
AH00558: httpd: Could not reliably determine the server's fully qualified
domain name, using localhost.localdomain. Set the 'ServerName' directive
globally to suppress this message
Loaded Modules:
core_module (static)
so_module (static)
http_module (static)
access_compat_module (shared)
actions_module (shared)
alias_module (shared)
allowmethods_module (shared)
auth_basic_module (shared)
......
......

-v 显示httpd的版本，然后退出

[root@localhost ~]# httpd -v
Server version: Apache/2.4.6 (CentOS)
Server built: Jun 27 2018 13:48:59

-V 显示httpd和apr/apr­util的版本和编译参数，然后退出
-­X 以调试模式运行httpd。仅启动一个工作进程，并且 服务器不与控制台脱离
-­t 检查配置文件是否有语法错误

###编码安装httpd-2.4
下载Apache的包
下载httpd

[root@localhost ~]# wget https://downloads.apache.org/httpd/httpd-2.4.54.tar.bz
2
下载apr
[root@localhost ~]# wget https://downloads.apache.org/apr/apr-1.6.5.tar.bz2
下载apr-util
[root@localhost ~]# wget https://downloads.apache.org/apr/apr-util-1.6.1.tar.bz
2
[root@localhost ~]# ls
apr-1.6.5.tar.bz2 file httpd-2.4.54.tar.bz2 outfile ss
apr-util-1.6.1.tar.bz2 home ifcfg-ens33 passwd yyds
[root@localhost ~]#

下载开发工具

[root@localhost ~]# dnf groups mark install -y "Development Tools"
下载各种依赖包
[root@localhost ~]# dnf install -y wget vim gcc gcc-c++ make pcre-devel expatdevel libxml2-devel libxml2

按顺序解压首先是apr

[root@localhost ~]# tar xf apr-1.6.5.tar.bz2
[root@localhost ~]# ls
apr-1.6.5 apr-util-1.6.1.tar.bz2 home ifcfg-en
s33 passwd yyds
apr-1.6.5.tar.bz2 file httpd-2.4.54.tar.bz2 outfile
ss
[root@localhost ~]#

进入到apr-1.6.5/configure中删掉 $RM"$cfgfile"
指定apr的安装路径

[root@localhost apr-1.6.5]# ./configure --prefix=/usr/local/apr

同时进行二步曲和三步曲

[root@localhost apr-1.6.5]# make && make install

在配置apr­util
解压apr-util

[root@localhost ~]# tar xf apr-util-1.6.1.tar.bz2
[root@localhost ~]# ls
apr-1.6.5 apr-util-1.6.1 file httpd-2.4.54.tar.bz2 ou
tfile ss
apr-1.6.5.tar.bz2 apr-util-1.6.1.tar.bz2 home ifcfg-ens33 pa
sswd yyds
[root@localhost ~]#

指定安装位置 依赖关系要带上apr的位置

[root@localhost apr-util-1.6.1]# ./configure --prefix=/usr/local/apr-util --wit
h-apr=/usr/local/apr/

进行二部三步曲

[root@localhost apr-util-1.6.1]# make && make install

配置httpd
解压httpd

[root@localhost ~]# tar xf httpd-2.4.54.tar.bz2
[root@localhost ~]# ls
apr-1.6.5 apr-util-1.6.1 file httpd-2.4.54 if
cfg-ens33 passwd yyds
apr-1.6.5.tar.bz2 apr-util-1.6.1.tar.bz2 home httpd-2.4.54.tar.bz2 ou
tfile ss
[root@localhost ~]#

指定安装位置

[root@localhost httpd-2.4.54]# ./configure --prefix=/usr/local/apache --with-ap
r=/usr/local/apr/ --with-apr-util=/usr/local/apr-util/

进行二部三部曲

[root@localhost httpd-2.4.54]# make && make install

启动Apache
用绝对路径启动

[root@localhost ~]# /usr/local/apache/bin/apachectl start
AH00558: httpd: Could not reliably determine the server's fully qualified
domain name, using fe80::3f31:1b71:96a5:5c42. Set the 'ServerName' direc
tive globally to suppress this message
[root@localhost ~]# ss -antl
State Recv-Q Send-Q Local Address:Port
Peer Address:Port
LISTEN 0 128 0.0.0.0:22
0.0.0.0:*
LISTEN 0 128 *:80
*:*
LISTEN 0 128 [::]:22
[::]:*
[root@localhost ~]#

关闭防火墙

[root@localhost ~]# systemctl stop firewalld
[root@localhost ~]# setenforce 0
[root@localhost ~]#

编写环境变量

[root@localhost ~]# vim /etc/profile.d/apache.sh
export PATH=$PATH:/usr/local/apache/bin/
~
~
~
"/etc/profile.d/apache.sh" 1L, 41C
1,40 A
[root@localhost ~]#
[root@localhost ~]# source /etc/profile.d/apache.sh

查看效果

[root@localhost ~]# apachectl
AH00558: httpd: Could not reliably determine the server's fully qualified
domain name, using fe80::3f31:1b71:96a5:5c42. Set the 'ServerName' direc
tive globally to suppress this message
[root@localhost ~]# ss -antl
State Recv-Q Send-Q Local Address:Port
Peer Address:Port
LISTEN 0 128 0.0.0.0:22
0.0.0.0:*
LISTEN 0 128 *:80
*:*
LISTEN 0 128
[root@localhost ~]# apachectl stop
AH00558: httpd: Could not reliably determine the server's fully qualified
domain name, using fe80::3f31:1b71:96a5:5c42. Set the 'ServerName' direc
tive globally to suppress this message
[root@localhost ~]# ss -antl
State Recv-Q Send-Q Local Address:Port
Peer Address:Port
LISTEN 0 128 0.0.0.0:22
0.0.0.0:*
LISTEN 0 128 [::]:22
[root@localhost ~]# which apachectl
/usr/local/apache/bin/apachectl
[root@localhost ~]#

设置软链接

[root@localhost apache]# ll /usr/include/
total 1564
-rw-r--r--. 1 root root 7456 May 2 2020 aio.h
-rw-r--r--. 1 root root 2031 May 2 2020 aliases.h
-rw-r--r--. 1 root root 1203 May 2 2020 alloca.h
-rw-r--r--. 1 root root 4350 May 2 2020 a.out.h
lrwxrwxrwx. 1 root root 26 Jul 15 04:29 apahe -> /usr/local/apache/i
nclude/
-rw-r--r--. 1 root root 25414 May 2 2020 argp.h
-rw-r--r--. 1 root root 6050 May 2 2020 argz.h
-rw-r--r--. 1 root root 1730 May 2 2020 ar.h
drwxr-xr-x. 2 root root 104 Jul 15 03:31 arpa
drwxr-xr-x. 2 root root 4096 Jul 15 03:31 asm
drwxr-xr-x. 2 root root 4096 Jul 15 03:31 asm-generic
-rw-r--r--. 1 root root 4561 May 2 2020 assert.h
drwxr-xr-x. 3 root root 8192 Jul 15 03:31 bits
-rw-r--r--. 1 root root 1404 May 2 2020 byteswap.h
drwxr-xr-x. 3 root root 15 Jul 15 03:31 c++
-rw-r--r--. 1 root root 7163 May 2 2020 complex.h
-rw-r--r--. 1 root root 2267 May 2 2020 cpio.h
-rw-r--r--. 1 root root 5404 May 8 2020 cpufreq.h
-rw-r--r--. 1 root root 844 May 8 2020 cpuidle.h
-rw-r--r--. 1 root root 9118 May 11 2019 crypt.h
-rw-r--r--. 1 root root 10963 May 2 2020 ctype.h
-rw-r--r--. 1 root root 12484 May 2 2020 dirent.h
-rw-r--r--. 1 root root 7018 May 2 2020 dlfcn.h
drwxr-xr-x. 2 root root 4096 Jul 15 03:31 drm
-rw-r--r--. 1 root root 174768 May 2 2020 elf.h
-rw-r--r--. 1 root root 3189 May 2 2020 endian.h
-rw-r--r--. 1 root root 2866 May 2 2020 envz.h
-rw-r--r--. 1 root root 2209 May 2 2020 err.h
-rw-r--r--. 1 root root 1678 May 2 2020 errno.h
-rw-r--r--. 1 root root 2039 May 2 2020 error.h
-rw-r--r--. 1 root root 1522 May 2 2020 execinfo.h
-rw-r--r--. 1 root root 3517 May 11 2019 expat_config.h
-rw-r--r--. 1 root root 5532 May 11 2019 expat_external.h
-rw-r--r--. 1 root root 43512 May 11 2019 expat.h
-rw-r--r--. 1 root root 10958 May 2 2020 fcntl.h
-rw-r--r--. 1 root root 15721 May 2 2020 features.h
-rw-r--r--. 1 root root 5857 May 2 2020 fenv.h
drwxr-xr-x. 2 root root 35 Jul 15 03:31 finclude
-rw-r--r--. 1 root root 3239 May 2 2020 fmtmsg.h
-rw-r--r--. 1 root root 2295 May 2 2020 fnmatch.h
-rw-r--r--. 1 root root 3583 May 2 2020 fpu_control.h
-rw-r--r--. 1 root root 3111 May 2 2020 fstab.h
-rw-r--r--. 1 root root 8372 May 2 2020 fts.h
-rw-r--r--. 1 root root 5251 May 2 2020 ftw.h
-rw-r--r--. 1 root root 4410 May 2 2020 gconv.h
-rw-r--r--. 1 root root 1468 May 2 2020 getopt.h
-rw-r--r--. 1 root root 6614 May 2 2020 glob.h
drwxr-xr-x. 2 root root 102 Jul 15 03:31 gnu
-rw-r--r--. 1 root root 2912 Mar 26 2020 gnumake.h
-rw-r--r--. 1 root root 2342 May 2 2020 gnu-versions.h
-rw-r--r--. 1 root root 6686 May 2 2020 grp.h
-rw-r--r--. 1 root root 4528 May 2 2020 gshadow.h
-rw-r--r--. 1 root root 1857 May 2 2020 iconv.h
-rw-r--r--. 1 root root 4910 May 2 2020 ieee754.h
-rw-r--r--. 1 root root 2840 May 2 2020 ifaddrs.h
-rw-r--r--. 1 root root 11892 May 2 2020 inttypes.h
-rw-r--r--. 1 root root 17848 May 2 2020 langinfo.h
-rw-r--r--. 1 root root 126 May 2 2020 lastlog.h
-rw-r--r--. 1 root root 1385 May 2 2020 libgen.h
-rw-r--r--. 1 root root 4579 May 2 2020 libintl.h
drwxr-xr-x. 3 root root 20 Jul 15 03:31 libxml2
-rw-r--r--. 1 root root 5412 May 2 2020 limits.h
-rw-r--r--. 1 root root 7206 May 2 2020 link.h
drwxr-xr-x. 28 root root 20480 Jul 15 03:31 linux
-rw-r--r--. 1 root root 7674 May 2 2020 locale.h
drwxr-xr-x. 2 root root 234 Jul 15 03:31 lzma
-rw-r--r--. 1 root root 9817 Apr 29 2018 lzma.h
-rw-r--r--. 1 root root 6102 May 2 2020 malloc.h
-rw-r--r--. 1 root root 53318 May 2 2020 math.h
-rw-r--r--. 1 root root 2434 May 2 2020 mcheck.h
-rw-r--r--. 1 root root 955 May 2 2020 memory.h
drwxr-xr-x. 2 root root 33 Jul 15 03:31 misc
-rw-r--r--. 1 root root 3358 May 2 2020 mntent.h
-rw-r--r--. 1 root root 1803 May 2 2020 monetary.h
-rw-r--r--. 1 root root 3759 May 2 2020 mqueue.h
drwxr-xr-x. 2 root root 98 Jul 15 03:31 mtd
drwxr-xr-x. 2 root root 174 Jul 15 03:31 net
drwxr-xr-x. 2 root root 19 Jul 15 03:31 netash
drwxr-xr-x. 2 root root 18 Jul 15 03:31 netatalk
drwxr-xr-x. 2 root root 20 Jul 15 03:31 netax25
-rw-r--r--. 1 root root 28099 May 2 2020 netdb.h
drwxr-xr-x. 2 root root 18 Jul 15 03:31 neteconet
drwxr-xr-x. 2 root root 198 Jul 15 03:31 netinet
drwxr-xr-x. 2 root root 19 Jul 15 03:31 netipx
drwxr-xr-x. 2 root root 20 Jul 15 03:31 netiucv
drwxr-xr-x. 2 root root 22 Jul 15 03:31 netpacke


----------


t
drwxr-xr-x. 2 root root 22 Jul 15 03:31 netrom
drwxr-xr-x. 2 root root 20 Jul 15 03:31 netrose
drwxr-xr-x. 2 root root 19 Jul 15 03:31 nfs
-rw-r--r--. 1 root root 1752 May 2 2020 nl_types.h
-rw-r--r--. 1 root root 1878 May 2 2020 nss.h
-rw-r--r--. 1 root root 21306 May 2 2020 obstack.h
-rw-r--r--. 1 root root 2977 May 2 2020 paths.h
-rw-r--r--. 1 root root 6783 May 11 2019 pcrecpparg.h
-rw-r--r--. 1 root root 26529 May 11 2019 pcrecpp.h
-rw-r--r--. 1 root root 31718 May 11 2019 pcre.h
-rw-r--r--. 1 root root 5452 May 11 2019 pcreposix.h
-rw-r--r--. 1 root root 6600 May 11 2019 pcre_scanner.h
-rw-r--r--. 1 root root 6312 May 11 2019 pcre_stringpiece.h
-rw-r--r--. 1 root root 22 May 2 2020 poll.h
-rw-r--r--. 1 root root 6800 May 2 2020 printf.h
-rw-r--r--. 1 root root 3476 May 2 2020 proc_service.h
drwxr-xr-x. 2 root root 67 Jul 15 03:31 protocols
-rw-r--r--. 1 root root 41269 May 2 2020 pthread.h
-rw-r--r--. 1 root root 1569 May 2 2020 pty.h
-rw-r--r--. 1 root root 6158 May 2 2020 pwd.h
drwxr-xr-x. 2 root root 27 Jun 28 02:50 python3.6m
drwxr-xr-x. 3 root root 4096 Jul 15 03:31 rdma
-rw-r--r--. 1 root root 962 May 2 2020 re_comp.h
-rw-r--r--. 1 root root 24715 May 2 2020 regex.h
-rw-r--r--. 1 root root 1447 May 2 2020 regexp.h
-rw-r--r--. 1 root root 12012 May 2 2020 resolv.h
drwxr-xr-x. 2 root root 21 Jul 15 03:31 rpc
-rw-r--r--. 1 root root 4732 May 2 2020 sched.h
drwxr-xr-x. 3 root root 154 Jul 15 03:31 scsi
-rw-r--r--. 1 root root 5223 May 2 2020 search.h
-rw-r--r--. 1 root root 2399 May 2 2020 semaphore.h
-rw-r--r--. 1 root root 3669 May 2 2020 setjmp.h
-rw-r--r--. 1 root root 1343 May 2 2020 sgtty.h
-rw-r--r--. 1 root root 5471 May 2 2020 shadow.h
-rw-r--r--. 1 root root 12243 May 2 2020 signal.h
drwxr-xr-x. 3 root root 4096 Jul 15 03:31 sound
-rw-r--r--. 1 root root 6690 May 2 2020 spawn.h
-rw-r--r--. 1 root root 264 May 2 2020 stab.h
-rw-r--r--. 1 root root 2289 May 2 2020 stdc-predef.h
-rw-r--r--. 1 root root 8469 May 2 2020 stdint.h
-rw-r--r--. 1 root root 2799 May 2 2020 stdio_ext.h
-rw-r--r--. 1 root root 30168 May 2 2020 stdio.h
-rw-r--r--. 1 root root 35653 May 2 2020 stdlib.h
-rw-r--r--. 1 root root 17545 May 2 2020 string.h
-rw-r--r--. 1 root root 4752 May 2 2020 strings.h
drwxr-xr-x. 2 root root 4096 Jul 15 03:31 sys
-rw-r--r--. 1 root root 25 May 2 2020 syscall.h
-rw-r--r--. 1 root root 5232 May 2 2020 sysexits.h
-rw-r--r--. 1 root root 24 May 2 2020 syslog.h
-rw-r--r--. 1 root root 3785 May 2 2020 tar.h
-rw-r--r--. 1 root root 214 May 2 2020 termio.h
-rw-r--r--. 1 root root 3598 May 2 2020 termios.h
-rw-r--r--. 1 root root 31489 May 2 2020 tgmath.h
-rw-r--r--. 1 root root 16023 May 2 2020 thread_db.h
-rw-r--r--. 1 root root 6655 May 2 2020 threads.h
-rw-r--r--. 1 root root 10360 May 2 2020 time.h
-rw-r--r--. 1 root root 2494 May 2 2020 ttyent.h
-rw-r--r--. 1 root root 2001 May 2 2020 uchar.h
-rw-r--r--. 1 root root 2036 May 2 2020 ucontext.h
-rw-r--r--. 1 root root 1583 May 2 2020 ulimit.h
-rw-r--r--. 1 root root 42738 May 2 2020 unistd.h
-rw-r--r--. 1 root root 1501 May 2 2020 utime.h
-rw-r--r--. 1 root root 3222 May 2 2020 utmp.h
-rw-r--r--. 1 root root 4099 May 2 2020 utmpx.h
-rw-r--r--. 1 root root 1955 May 2 2020 values.h
drwxr-xr-x. 2 root root 52 Jul 15 03:31 video
-rw-r--r--. 1 root root 22 May 2 2020 wait.h
-rw-r--r--. 1 root root 31111 May 2 2020 wchar.h
-rw-r--r--. 1 root root 5548 May 2 2020 wctype.h
-rw-r--r--. 1 root root 2501 May 2 2020 wordexp.h
drwxr-xr-x. 2 root root 73 Jul 15 03:31 xen
-rw-r--r--. 1 root root 16262 Apr 7 2020 zconf.h
-rw-r--r--. 1 root root 96239 Apr 7 2020 zlib.h
[root@localhost apache]#

设置man文件路径
在[root@localhost apache]# vi /etc/man_db.conf 中添加
MANDATORY_MANPATH /usr/local/apache/man
###httpd常用配置
有三种，分别是
prefork
event
worker

[root@localhost ~]# vim /etc/httpd/conf.modules.d/00-mpm.conf
# Select the MPM module which should be used by uncommenting exactly
# one of the following LoadModule lines. See the httpd.conf(5) man
# page for more information on changing the MPM.
# prefork MPM: Implements a non-threaded, pre-forking web server
# See: http://httpd.apache.org/docs/2.4/mod/prefork.html
#
# NOTE: If enabling prefork, the httpd_graceful_shutdown SELinux
# boolean should be enabled, to allow graceful stop/shutdown.
#
#LoadModule mpm_prefork_module modules/mod_mpm_prefork.so
# worker MPM: Multi-Processing Module implementing a hybrid
# multi-threaded multi-process web server
# See: http://httpd.apache.org/docs/2.4/mod/worker.html
#
#LoadModule mpm_worker_module modules/mod_mpm_worker.so
# event MPM: A variant of the worker MPM with the goal of consuming
# threads only for connections with active processing
# See: http://httpd.apache.org/docs/2.4/mod/event.html
#
LoadModule mpm_event_module modules/mod_mpm_event.so
~

访问控制法则：
法则及功能
Require all granted 允许所有主机访问
Require all deny 拒绝所有主机访问
Require ip IPADDR 授权指定来源地址的主机访问
Require not ip IPADDR 拒绝指定来源地址的主机访问
Require host HOSTNAME 授权指定来源主机名(域名，除非主机名设置了映射)的主机访问
Require not host
HOSTNAME
拒绝指定来源主机名（域名，除非主机名设置了映射）的主机访
问

IPADDR的类型 HOSTNAME的类型
IP：192.168.1.1 Network/mask：192.168.1.0/255.255.255.0
Network/Length：192.168.1.0/24 Net:192.168
FQDN：特定主机的全名
DOMAIN：指定域内的所有主机
注意：httpd­2.4版本默认是拒绝所有主机访问的，所以安装以后必须做显示授权访问
###虚拟主机：
虚拟主机有三类：在

[root@localhost ~]# vim /etc/httpd/conf/httpd.conf

下去修改
相同IP不同端口
不同IP相同端口
相同IP相同端口不同域名
###ssl:
下载ssl：

[root@localhost ~]# yum install -y mod_ssl
Last metadata expiration check: 2:36:33 ago on Thu 21 Jul 2022 07:08:34 P
M CST.
Dependencies resolved.
=========================================================================
=====
Package Arch Version Repo
Size
=========================================================================
=====
Installing:
mod_ssl x86_64 1:2.4.37-30.module_el8.3.0+462+ba287492.0.1 AppStream 1
33 k
Installing dependencies:
sscg x86_64 2.3.3-14.el8 AppStream
49 k
Transaction Summary
=========================================================================
=====
Install 2 Packages
Total size: 182 k
Installed size: 360 k
Downloading Packages:
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
Preparing :
1/1
Installing : sscg-2.3.3-14.el8.x86_64
1/2
Installing : mod_ssl-1:2.4.37-30.module_el8.3.0+462+ba287492.0.
2/2
Running scriptlet: mod_ssl-1:2.4.37-30.module_el8.3.0+462+ba287492.0.
2/2
Verifying : mod_ssl-1:2.4.37-30.module_el8.3.0+462+ba287492.0.
1/2
Verifying : sscg-2.3.3-14.el8.x86_64
2/2
Installed:
mod_ssl-1:2.4.37-30.module_el8.3.0+462+ba287492.0.1.x86_64
sscg-2.3.3-14.el8.x86_64
Complete!
[root@localhost ~]#

启用模块：
编辑/etc/httpd/conf.modules.d/00­base.conf文件，添加下面这行，如果已经有了但是注释了，则取
消注释即可

[root@localhost conf.modules.d]# systemctl restart httpd
[root@localhost conf.modules.d]# httpd -M | grep ssl
[Thu Jul 21 22:03:06.108490 2022] [so:warn] [pid 4802:tid 14040896332422
4] AH01574: module ssl_module is already loaded, skipping
ssl_module (shared)
[root@localhost conf.modules.d]# ss -antl
State Recv-Q Send-Q Local Address:Port Peer Address:Po
rt
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 128 [::]:22 [::]:*
LISTEN 0 128 *:443 *:*
LISTEN 0 128 *:80 *:*
[root@localhost conf.modules.d]#

配置https步骤：
生成证书(参考博客linux运维系列第6章)
1.生成密钥

[root@localhost pki]# mkdir CA
[root@localhost pki]# cd CA/
[root@localhost CA]# mkdir private
[root@localhost CA]# (umask 077;openssl genrsa -out private/cakey.pem 204
8)
Generating RSA private key, 2048 bit long modulus (2 primes)
............................................+++++
......................................................................................................................................................
+++++
e is 65537 (0x010001)
[root@localhost CA]#

提取密钥

[root@localhost CA]# openssl rsa -in private/cakey.pem -pubout
writing RSA key
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw9iQaA47Zt80hM9F44UQ
30Y1JGc1gX+sfamyQHnG8ZjrZA8Z0L9eX9bSlBKWuwW7yH4HwMCs44cmu1Xzz7no
Y9lnfgLMgS69L1dpLNJlY9uGjXb+PFwGjJtEtTw30mVbo4zvb+81pX5SOgQaq1+h
0HAEsLrVN/CyLHuVCV8YaN5OhmzGgKke7DY5JXSlXxfBIapjLxNby6C0QBH9AI9N
W70bljJUnWHc6cGowxK3j22NINbCodj8x+INv3Ekf0kErJ3D6uOnfkWWzJ1M8HAC
nombp3EVMqqnNm7GGXfCB7gtsLbqGrFKyyhhpW0k2tmp9isNghrfMTMRxovv2zfD
hwIDAQAB
-----END PUBLIC KEY-----
[root@localhost CA]#

2.生成自签证书

[root@localhost CA]# openssl req -new -x509 -key private/cakey.pem -out c
acert.pem -days 365
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a D
N.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn （国家）
State or Province Name (full name) []:hb （省份）
Locality Name (eg, city) [Default City]:wh （城市）
Organization Name (eg, company) [Default Company Ltd]:L (公司)
Organizational Unit Name (eg, section) []:xuexi （部门）
Common Name (eg, your name or your server's hostname) []:www.zhuawawa.com
（服务名）
Email Address []:1@1.com （邮箱）
[root@localhost CA]# ls
cacert.pem private
[root@localhost CA]#

创建目录

[root@localhost CA]# mkdir certs newcerts crl
[root@localhost CA]# ls
cacert.pem certs crl newcerts private
[root@localhost CA]# touch index.txt && echo 01 > serial
[root@localhost CA]# ls
cacert.pem certs crl index.txt newcerts private serial
[root@localhost CA]#

3.给服务器生成密钥

[root@localhost CA]# cd /etc/httpd && mkdir ssl && cd ssl
[root@localhost ssl]# pwd
/etc/httpd/ssl
[root@localhost ssl]# (umask 077;openssl genrsa -out httpd.key 2048)
Generating RSA private key, 2048 bit long modulus (2 primes)
.........................+++++
.................................................................................................
+++++
e is 65537 (0x010001)
[root@localhost ssl]# ls
httpd.key

4.在网站服务器生成证书

[root@localhost ssl]# openssl req -new -key httpd.key -days 365 -out http
d.csr
Ignoring -days; not generating a certificate
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a D
N.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:hb
Locality Name (eg, city) [Default City]:wh
Organization Name (eg, company) [Default Company Ltd]:L
Organizational Unit Name (eg, section) []:xuexi
Common Name (eg, your name or your server's hostname) []:www.zhuawawa.com
Email Address []:1@1.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@localhost ssl]# ls
httpd.csr httpd.key

签署证书

[root@localhost ssl]# openssl ca -in httpd.csr -out httpd.crt -days 365
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Jul 21 15:12:57 2022 GMT
Not After : Jul 21 15:12:57 2023 GMT
Subject:
countryName = cn
stateOrProvinceName = hb
organizationName = L
organizationalUnitName = xuexi
commonName = www.zhuawawa.com
emailAddress = 1@1.com
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
8E:A1:06:40:DB:8A:54:63:C2:73:04:43:47:0C:E0:2B:DF:D4:49:35
X509v3 Authority Key Identifier:
keyid:A9:44:F6:F4:66:E5:9A:4B:F9:E0:27:B5:90:7F:D9:69:0F:97:B1:02
Certificate is to be certified until Jul 21 15:12:57 2023 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
[root@localhost ssl]# ls
httpd.crt httpd.csr httpd.key

在httpd­ssl.conf中配置证书的位置
进入到/etc/httpd/conf.d/ssl.conf中注释以下内容 注意更改文件位置
DocumentRoot “/var/www/html/zhuawawa”
ServerName www.zhuawawa.com:443
更改httpd.crt 和httpd.key的文件位置

SSLCertificateFile /etc/httpd/ssl/httpd.crt
# Server Private Key:
# If the key is not combined with the certificate, use this
# directive to point at the key file. Keep in mind that if
# you've both a RSA and a DSA private key you can configure
# both in parallel (to also allow the use of DSA ciphers, etc.)
# ECC keys, when in use, can also be configured in parallel
SSLCertificateKeyFile /etc/httpd/ssl/httpd.key

检查配置文件是否有语法错误
启动或重启服务

[root@localhost conf.d]# systemctl restart httpd
[root@localhost conf.d]# ss -antl
State Recv-Q Send-Q Local Address:Port Peer Addre
ss:Port
LISTEN 0 128 0.0.0.0:22
0.0.0.0:*
LISTEN 0 128 [::]:22
[::]:*
LISTEN 0 128 *:443
*:*
LISTEN 0 128 *:80
*:*
[root@localhost conf.d]