环境:
windows7 32位系统IP:192.168.10.123
wampserver2.5 (Apache-2.4.9 Mysql-5.6.17php5.5.12-32b)
目录:
D:\wamp\bin\apache\apache2.4.9\bin openssl.exe
D:\wamp\bin\apache\apache2.4.9\conf httpd.conf
D:\wamp\bin\apache\apache2.4.9\conf openssl.conf
D:\wamp\bin\apache\apache2.4.9\conf\extra httpd-ssl.conf
1.apache2.4.9中建立文件夹
bin/ca/, bin/ca/newcerts/,bin/ca/private/
还要建立几个文件:
a. bin/ca/index.txt 一个0字节的空文件
b.bin/ca/serial (无后缀),内容写 2个(0-9,A-F)的字符即可,如1A
2.配置httpd.conf
去掉一下行前面的注释,默认端口为80,检查是否被占用,按需修改
<span style="font-family:Microsoft YaHei;font-size:12px;">LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
LoadModule ssl_module modules/mod_ssl.so
Include conf/extra/httpd-ssl.conf</span>
a.路径问题,注意Apache路径以及ip等需修改
b.ServerName 这个要注意,一定是本机地址或域名,另外在命令行时,也要多次用到
c.如果是单向认证,34行的值修改成 none 同时把所有 client 字样的行注释掉即可(用#)
<span style="font-family:Microsoft YaHei;font-size:12px;">Listen 2443
SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
SSLPassPhraseDialog builtin
SSLSessionCache "shmcb:D:/wamp/bin/apache/apache2.4.9/logs/ssl_scache(512000)"
SSLSessionCacheTimeout 300
<VirtualHost _default_:2443>
DocumentRoot "D:/wamp/www"
ServerName 192.168.10.123:2443
ServerAdmin admin@localhost
ErrorLog "D:/wamp/bin/apache/apache2.4.9/logs/error.log"
TransferLog "D:/wamp/bin/apache/apache2.4.9/logs/access.log"
SSLEngine on
SSLCertificateFile "D:/wamp/bin/apache/apache2.4.9/bin/server.crt"
SSLCertificateKeyFile "D:/wamp/bin/apache/apache2.4.9/bin/server.key"
SSLCertificateChainFile "D:/wamp/bin/apache/apache2.4.9/bin/root.key"
SSLCACertificateFile "D:/wamp/bin/apache/apache2.4.9/bin/root.crt"
SSLVerifyClient require
SSLVerifyDepth 10
<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory "D:/wamp/bin/apache/apache2.4.9/cgi-bin">
SSLOptions +StdEnvVars
</Directory>
BrowserMatch "MSIE [2-5]" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
CustomLog "D:/wamp/bin/apache/apache2.4.9/logs/ssl_request.log" \
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
</VirtualHost>
</span>
4.openssl.conf修改(去除注释后)(只贴出修改过的地方)
<span style="font-family:Microsoft YaHei;font-size:12px;"> dir = ./ca # Where everything is kept
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crl # Where the issued crl are kept
database = $dir/index.txt # database index file.
# several ctificates with same subject.
new_certs_dir = $dir/newcerts # default place for new certs.
certificate = $dir/cacert.pem # The CA certificate
serial = $dir/serial # The current serial number
crlnumber = $dir/crlnumber # the current crl number
# must be commented out to leave a V1 CRL
crl = $dir/crl.pem # The current CRL
private_key = $dir/private/cakey.pem# The private key
RANDFILE = $dir/private/.rand # private random number file</span>
指明配置文件:
set OPENSSL_CONF=../conf/openssl.cnf
生成根密钥 (未加保护密码)(openssl genrsa -des3 -out root.key 1024 这个是加保护密码的命令) 以下都没加保护密码:
openssl genrsa >root.key
生成服务端密钥:
openssl genrsa >server.key
生成客户端密钥:
openssl genrsa >client.key
生成自签名的根证书 (CRT即PEM格式):
openssl req -x509 -new -key root.key >root.crt
生成服务端签名请求文件CSR:
openssl req -new -key server.key -out server.csr
生成客户端签名请求文件:
openssl req -new -key client.key -out client.csr
注意: 以上如果会要求输入一些信息,注意Common Name<eg, YOUR name>处,必须是本机域名或IP地址 ,我是写的 192.168.10.123 (我本机IP),其余信息需要对应的匹配
以下为申请证书时填写的基本内容解释:
<span style="font-family:Microsoft YaHei;font-size:12px;">Country Name (2 letter code) [AU]:CNISO国家代码(只支持两位字符)
State or Province Name (full name) [Some-State]:ZJ所在省份
Locality Name (eg, city) []:HZ所在城市
Organization Name (eg, company):THS公司名称
Organizational Unit Name (eg, section) []:THS组织名称
Common Name (eg, YOUR name) []:localhost(申请证书的域名或IP地址)
Email Address []:laoniangke@xxx.com管理员邮箱(可随意填写)</span>
继续执行以下命令:
使用根证书为服务端及客户端签名:
openssl ca -in server.csr -cert root.crt -keyfile root.key -out server.crt
openssl ca -in client.csr -cert root.crt -keyfile root.key -out client.crt
客户端证书转换成PFX格式:
openssl pkcs12 -export -clcerts -in client.crt -inkey client.key -out client.pfx
6.把root.crt 和 client.pfx 复制到客户端(随便哪台电脑,生成一组证书可多台电脑拷贝通用)
双击client.pfx导入在个人/您的证书
root 通过IE导入到 可信任的根证书签发机构
7.重启服务器Apache
个人遇到的问题:
a.开始使用的是wamp2.2版本的,cmd到bin目录使用openssl时报错sseay32.dll问题,网上各种百度方法尝试无解
b.百度配置SSL文章大多是wamp2.2版本的,按步照班的一步步来结果还是出现Apache无任何报错,但wamp就是启动不了,所以换2.5版本,未出现问题
c.遇到wamp无法启动大多是httpd.conf和httpd-ssl.conf配置文件中的问题,一般为80端口或者443端口问题,所以需要注意,详情见错误日志
d.检测Apache是否正常cmd到D:\wamp\bin\apache\apache2.4.9\bin输入httpd -t
无证书:
有证书: