FreeBSD 10.1环境下apache2.4配置ssl实现https

2019独角兽企业重金招聘Python工程师标准>>>

环境：

FreeBSD 10.1 x86 64

Apache2.4

openssl 1.0

 

01 安装openssl（Linux 发行版自行安装）

先搜索一下

#pkg search openssl

openssl-1.0.2j_1,1             SSL and crypto library
openssl-devel-1.1.0c           SSL and crypto library (1.1.x)

这里我选择安装1.0

#pkg install openssl

安装之后的目录：/usr/local/openssl

配置文件

#cp /usr/local/openssl/openssl.cnf.sample /usr/local/openssl/openssl.cnf

 

02 生成key

# openssl req -new -nodes -out req.pem -keyout cert.key -sha256 -newkey rsa:2048
Generating a 2048 bit RSA private key
..................+++
.............................................................+++
writing new private key to 'cert.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:Beijing
Locality Name (eg, city) []:Beijing
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Minsec
Organizational Unit Name (eg, section) []:Administrator
Common Name (eg, YOUR name) []:col.minsec.cn
Email Address []:root@minsec.cn

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

 

03 生成RSA key

# openssl genrsa -rand -genkey -out cert.key 2048
0 semi-random bytes loaded
Generating RSA private key, 2048 bit long modulus
.............................................+++
.................................................................................................................+++
e is 65537 (0x10001)

 

04 生成crt

# openssl req -new -x509 -days 365 -key cert.key -out cert.crt -sha256
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:Beijing
Locality Name (eg, city) []:Beijing
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Minsec
Organizational Unit Name (eg, section) []:Administrator
Common Name (e.g. server FQDN or YOUR name) []:col.minsec.cn
Email Address []:root@minsec.cn

 

当前目录下生成 cert.key 和 cert.crt 文件

#cp ./cert.key /etc/ssl/col.key

#cp ./cert.crt /etc/ssl/col.crt

为了安全修改一下权限

#chmod 700 /etc/ssl/col.key /etc/ssl/col.crt

 

05 修改http.conf

启用模块

LoadModule ssl_module libexec/apache24/mod_ssl.so

LoadModule socache_shmcb_module libexec/apache24/mod_socache_shmcb.so

启用配置

Include etc/apache24/extra/httpd-ssl.conf

修改extra/httpd-ssl.conf文件

SSLCertificateFile "/etc/ssl/col.crt" #修改为crt文件位置

SSLCertificateKeyFile "/etc/ssl/col.crt" #修改为key文件位置

 

06 修改虚拟主机

添加443端口支持

<VirtualHost *:443>
    ServerAdmin root@minsec.cn
    DocumentRoot "/data/wwwroot"
    ServerName col.minsec.cn
    ServerAlias col.minsec.cn
    DirectoryIndex index.php index.html index.htm
    SSLEngine on
    SSLCertificateFile "/etc/ssl/col.crt" #crt文件位置
    SSLCertificateKeyFile "/etc/ssl/col.key" #key文件位置
    <Directory "/data/wwwroot">
        Options -Indexes +FollowSymlinks
        AllowOverride All
        Require all granted
    </Directory>
</VirtualHost>

07 http跳转到https

修改.htaccess文件

RewriteEngine On
RewriteBase /
RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^.*$ https://%{SERVER_NAME}%{REQUEST_RUI} [L,R]

 

08 测试

重启apache

#service apache24 restart

访问http://col.minsec.cn 重定向到https://col.minsec.cn

 

00 参考网址

https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/openssl.html

http://blog.csdn.net/a332708815/article/details/50461092

https://my.oschina.net/itblog/blog/651434

https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/network-ldap.html#ldap-config

 

 

 

 

 

 

 

转载于:https://my.oschina.net/u/877598/blog/807996