https自签证书
1、server端
1、安装证书生成工具openssl和openssl-devel
[root@server18 ~] yum install -y openssl openssl-devel
Last metadata expiration check: 2:06:56 ago on Fri 24 Mar 2023 08:33:56 AM CST.
Package openssl-1:1.1.1k-6.el8.x86_64 is already installed.
..............................
pcre2-devel-10.32-2.el8.x86_64 pcre2-utf16-10.32-2.el8.x86_64
pcre2-utf32-10.32-2.el8.x86_64 zlib-devel-1.2.11-17.el8.x86_64
Complete!
[root@server18 ~]#
2、生成密钥
[root@server18 ~] openssl genrsa -des3 -out server.key 2048
Generating RSA private key, 2048 bit long modulus (2 primes)
.................................+++++
...........................+++++
e is 65537 (0x010001)
Enter pass phrase for server.key: #设置密码
Verifying - Enter pass phrase for server.key: #确认密码
[root@server18 ~]#
3、导出不需要密语的密钥文件
[root@server18 ~] openssl rsa -in server.key -out unsafe.key
Enter pass phrase for server.key: #输入上一步的密码
writing RSA key
[root@server18 ~]#
4、生成证书申请文件,使用命令:openssl req -new -in unsafe.key -out server.csr
[root@server18 ~] openssl req -new -in unsafe.key -out server.csr
Generating a RSA private key
....................................................................................+++++
...................................................................................+++++writing new private key to 'privkey.pem'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:TJ
Locality Name (eg, city) [Default City]:TJ
Organization Name (eg, company) [Default Company Ltd]:school.edu
Organizational Unit Name (eg, section) []:school.edu
Common Name (eg, your name or your server's hostname) []:secure.web.com
Email Address []:sm@mail.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []: #可空
An optional company name []: #可空
[root@server18 ~]#
5、签发证书:
[root@server18 ~] openssl x509 -req -days 365 -in server.csr -signkey unsafe.key -out server.crt
Signature ok
subject=C = CN, ST = TJ, L = TJ, O = school.edu, OU = school.edu, CN = secure.web.com, emailAddress = sm@mail.com
Getting Private key
[root@server18 ~]#
6、查看前几步生成的文件
[root@server18 ~] ls server.*
server.crt server.csr server.key #证书 证书申请 密语保护
[root@server18 ~] ls unsafe.key
unsafe.key #无密语保护的公玥
[root@server18 ~] ls privkey.pem
privkey.pem #私玥
[root@server18 ~]#
7、安装扩展模块包
[root@server18 ~] yum install -y mod_ssl
Last metadata expiration check: 2:37:13 ago on Fri 24 Mar 2023 08:33:56 AM CST.
..................................
..................................
Installed:
mod_ssl-1:2.4.37-54.module_el8.8.0+1256+e1598b50.x86_64
Complete!
[root@server18 ~] ls /etc/httpd/modules/ | grep ssl
mod_ssl.so
[root@server18 ~]#
[root@server ~] ls /etc/httpd/conf.modules.d/00-ssl.conf
/etc/httpd/conf.modules.d/00-ssl.conf # 启用扩展模块
[root@server18 ~] ls /etc/httpd/conf.d/ssl.conf
/etc/httpd/conf.d/ssl.conf #默认的https虚拟主机配置
[root@server18 ~] grep -v '#' /etc/httpd/conf.d/ssl.conf | grep -v '^$' 查看默认配置文件
Listen 443 https #监听 443 只响应https
SSLPassPhraseDialog exec:/usr/libexec/httpd-ssl-pass-dialog
SSLSessionCache shmcb:/run/httpd/sslcache(512000)
SSLSessionCacheTimeout 300
SSLCryptoDevice builtin
<VirtualHost _default_:443> #默认https虚拟主机配置
ErrorLog logs/ssl_error_log
TransferLog logs/ssl_access_log
LogLevel warn
#下面是虚拟主机启用ssl的基本配置
SSLEngine on
SSLHonorCipherOrder on
SSLCipherSuite PROFILE=SYSTEM
SSLProxyCipherSuite PROFILE=SYSTEM
SSLCertificateFile /etc/pki/tls/certs/localhost.crt
SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory "/var/www/cgi-bin">
SSLOptions +StdEnvVars
</Directory>
BrowserMatch "MSIE [2-5]" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
CustomLog logs/ssl_request_log \
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
</VirtualHost>
[root@server18 ~]#
8、selinux设置为宽容模式
[root@server18 ~] setenforce 0
[root@server18 ~] getenforce
Permissive
9、
[root@server18 ~] cp unsafe.key /etc/pki/tls/private/
[root@server18 ~] cp server.crt /etc/pki/tls/certs/
10、新建/www/secure目录,作为https的家目录
[root@server18 ~] mkdir /www/secure
[root@server18 ~] ls -R /www/
/www/:
secure vhost1 vhost2
/www/secure:
/www/vhost1:
index.html
/www/vhost2:
index.html
[root@server18 ~]#
11、编辑配置文件
[root@server18 ~] vim /etc/httpd/conf.d/vhost.conf
#加入以下内容
Listen 80
#https_setting
<VirtualHost 192.168.189.100:443>
DocumentRoot /www/secure
ServerName secure.web.com
ServerAdmin admin@web.com
ErrorLog "logs/secure_err_log"
CustomLog "logs/secure_access_log" combined
SSLEngine On
SSLHonorCipherOrder on
SSLCipherSuite PROFILE=SYSTEM
SSLProxyCipherSuite PROFILE=SYSTEM
SSLCertificateFile /etc/pki/tls/certs/server.crt
SSLCertificateKeyFile /etc/pki/tls/private/unsafe.key
</VirtualHost>
<Directory /www/secure>
Require all granted
#AllowOverride None
</Directory>
12、重启httpd
[root@server18 ~] systemctl start httpd
[root@server18 ~]#
13、放行防火墙端口服务
[root@server18 ~] firewall-cmd --add-service=https --permanent
success
[root@server18 ~] firewall-cmd --reload
success
[root@server18 ~] firewall-cmd --list-all
public (active)
target: default
icmp-block-inversion: no
interfaces: ens160 ens224
sources:
services: cockpit dhcpv6-client dns https mountd nfs rpc-bind ssh
ports: 80/tcp
protocols:
forward: no
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
[root@server18 ~]#
查看https的端口
[root@server18 ~] ss -anput | grep httpd
tcp LISTEN 0 128 *:80 *:* users:(("httpd",pid=2198,fd=9),("httpd",pid=2197,fd=9),("httpd",pid=2196,fd=9),("httpd",pid=2183,fd=9))
tcp LISTEN 0 128 *:443 *:* users:(("httpd",pid=2198,fd=7),("httpd",pid=2197,fd=7),("httpd",pid=2196,fd=7),("httpd",pid=2183,fd=7))
[root@server18 ~]#
14、为https新建主页,以便验证
[root@server18 ~] echo "https web" > /www/secure/index.html
[root@server18 ~]#
2、在client端验证
1、配置hosts文件
[root@client18 ~] vim /etc/hosts
[root@client18 ~] cat /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
#192.168.189.100 server18
192.168.189.100 vhost1.web.com vhost2.web.com nginx.web.com web.secure.com #将web.secure.com加入
[root@client18 ~]#
2、在client的火狐浏览器验证
输入网址时,协议使用https