配置https虚拟主机

取消注释

[root@tao conf]# vim httpd.conf
[root@tao conf]# 
///LoadModule ssl_module modules/mod_ssl.so  		将这行取消注释///

生成证书

openssl实现私有CA：

[root@tao ~]# mkdir /etc/pki/CA
[root@tao ~]# cd /etc/pki/CA
[root@tao CA]# pwd
/etc/pki/CA
[root@tao CA]# mkdir -p /etc/pki/CA/private
[root@tao CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048)			
[root@tao CA]# ls
private
[root@tao CA]# ll private/
total 4
-rw------- 1 root root 1679 Dec 26 18:42 cakey.pem
[root@tao CA]# 
————————————————

///查看公钥
[root@tao CA]# openssl rsa -in private/cakey.pem -pubout 
writing RSA key
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2UcQem6veBTitNvuOk6Q
XxrU1qhW8URbcx1VU3SYXeo0TjUw3UDuJcJXXI9DZAusZBgs4g2b5oH7sWXmtApt
93XVhfK4MyRK25otNb2hMvnolzhkCsgxjLpiEZkqXAGc0aWd/iwNJm9Ef/V1S1S1
WO+PAPRlZyCfYp6zhiRnSh40jfiDx4GDMoHQPcBSZWiUg+V/8nw+ty/v0Rgu2PHT
7F0D7oSMw4T3Np8Gr+j9QkZWL+/v7/JhsIhMVEpbjicj4IQMBygbzp72JHFyxf+2
cnncVqm83dPH7FWpK18xd3xxHMGuwt7D7LJ+ExH2ki7ahztK2kBkq/3ZOlCERo29
GQIDAQAB
-----END PUBLIC KEY-----
[root@tao CA]# 

///CA生成自签署证书
[root@tao CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN		///询问国家
State or Province Name (full name) []:HB		///询问省份
Locality Name (eg, city) [Default City]:WH		///询问城市
Organization Name (eg, company) [Default Company Ltd]:runtime			///询问公司名
Organizational Unit Name (eg, section) []:runtime		///询问组织单位名称
Common Name (eg, your name or your server's hostname) []:www.wangqing.com		///询问域名，需要给哪个网站用，就填写哪个域名  
Email Address []:11@.com  		///询问邮箱
[root@tao CA]# ls
cacert.pem  private
[root@tao CA]# 

客户端生成密钥

[root@tao ~]# cd /usr/local/apache
[root@tao apache]# cd conf
[root@tao conf]# mkdir ssl
[root@tao conf]# pwd
/usr/local/apache/conf
[root@tao conf]# ls
extra  httpd.conf  magic  mime.types  original  ssl
[root@tao conf]# cd ssl
[root@tao ssl]# (umask 077;openssl genrsa -out httpd.key 2048)
Generating RSA private key, 2048 bit long modulus (2 primes)
.................................................................................................................................................+++++
..............+++++
e is 65537 (0x010001)

网站生成证书.

[root@tao ssl]# openssl req -new -key httpd.key -days 365 -out httpd.csr
Ignoring -days; not generating a certificate
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HB
Locality Name (eg, city) [Default City]:WH
Organization Name (eg, company) [Default Company Ltd]:runtime
Organizational Unit Name (eg, section) []:runtime
Common Name (eg, your name or your server's hostname) []:www.wangqing.com
Email Address []:11@.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:			///加密
An optional company name []:
[root@tao ssl]# 

CA签署客户端提交的证书

[root@tao ssl]# openssl ca -in httpd.csr -out httpd.crt -days 365
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Dec 26 11:21:19 2022 GMT
            Not After : Dec 26 11:21:19 2023 GMT
        Subject:
            countryName               = CN
            stateOrProvinceName       = HB
            organizationName          = runtime
            organizationalUnitName    = runtime
            commonName                = www.wangqing.com
            emailAddress              = 11@.com
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
                1D:05:65:D9:32:23:2F:74:B1:21:81:D6:D3:50:A8:6E:14:4E:BC:3B
            X509v3 Authority Key Identifier: 
                keyid:B9:1E:BC:7F:FC:7F:B4:1F:8A:09:A9:AC:A3:FF:88:5F:C0:11:FD:AE

Certificate is to be certified until Dec 26 11:21:19 2023 GMT (365 days)
Sign the certificate? [y/n]:y   


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
[root@tao ssl]# 
[root@tao ssl]# ls
httpd.crt  httpd.csr  httpd.key
[root@tao ssl]# 

使用证书

[root@tao conf]# vim httpd.conf 
Include conf/extra/httpd-ssl.conf
LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
LoadModule ssl_module modules/mod_ssl.so

[root@tao conf]# vim extra/httpd-vhosts.conf 
[root@tao conf]# vim httpd.conf
[root@tao conf]# tail extra/httpd-vhosts.conf 

<VirtualHost *:80>
    DocumentRoot "/usr/local/apache/htdocs/blog.wangqing.com"
    ServerName blog.wangqing.com
    ErrorLog "logs/blog.wangqing.com-error_log"
    CustomLog "logs/blog.wangqing.com-access_log" common
</VirtualHost>



[root@tao conf]# mkdir -p /usr/local/apache/htdocs/{www.wangqing.com,blog.wangqing.com}
[root@tao conf]# ls /usr/local/apache/htdocs
blog.wangqing.com  index.html  www.wangqing.com
[root@tao conf]# ls /usr/local/apache/htdocs
blog.wangqing.com  index.html  www.wangqing.com
[root@tao conf]# mv /var/www/html/www/* /usr/local/apache/htdocs/www.wangqing.com
[root@tao conf]# mv /var/www/html/blog/* /usr/local/apache/htdocs/blog.wangqing.com/.wangqing.com
[root@tao conf]#