安装基于openssl的https服务配置

 

前提：
   httpd必须安装mod_ssl模块

一、CA自签证书
1.建立CA的私钥
[root@localhost CA]# cd /etc/pki/CA
[root@localhost CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048)
[root@localhost CA]# ll private/cakey.pem

2.生成自签证书
[root@localhost CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 3655
-----
Country Name (2 letter code) [GB]:CN
State or Province Name (full name) [Berkshire]:AH
Locality Name (eg, city) [Newbury]:CZ
Organization Name (eg, company) [My Company Ltd]:ca ltd
Organizational Unit Name (eg, section) []:ca eg
Common Name (eg, your name or your server's hostname) []:www.ca.com
Email Address []:admin@ca.com
-----

3.创建需要使用的文件和文件夹
[root@localhost CA]# touch index.txt serial
[root@localhost CA]# echo 00 > serial
[root@localhost CA]# mkdir certs crl newcerts
[root@localhost CA]# ls

二、httpd证书申请
1.在/etc/httpd 在新建文件夹ssl

2.新建httpd的私钥
[root@localhost ssl]# (umask 077;openssl genrsa -out httpd.key 1024)

3.生成证书签署请求文件
[root@localhost ssl]# openssl req -new -key httpd.key -out httpd.csr
-----
Country Name (2 letter code) [GB]:CN
State or Province Name (full name) [Berkshire]:AH
Locality Name (eg, city) [Newbury]:CZ
Organization Name (eg, company) [My Company Ltd]:ca ltd
Organizational Unit Name (eg, section) []:ca eg
Common Name (eg, your name or your server's hostname) []:www.example1.com
Email Address []:admin@example1.com
-----

4.请求文件发送给CA
[root@localhost ssl]# scp httpd.csr 192.168.246.100@root:/etc/pki/sign

三、CA签署证书
1.签署发送过来的证书申请
[root@localhost sign]# openssl ca -in httpd.csr -out httpd.crt -days 365 

2.将签署的证书返回给申请者

四、修改httpd的ssl配置文件

  在/etc/httpd/conf.d/ssl中,需要修该的部分如下：

  <VirtualHost 192.168.246.100:443>
    ServerName www.example1.com
    DocumentRoot /www/example1
    SSLCertificateFile /etc/httpd/ssl/httpd.crt
    SSLCertificateKeyFile /etc/httpd/ssl/httpd.key
  <VirtualHost>

五、测试
  通过浏览器就可访问https://www.example1.com/
  在浏览网页时会出现安全警告，将/etc/pki/CA/cacert.pem复制到windows中更名为cacert.crt并安装即可