上一篇文章已經介紹瞭如何在CentOS7環境下安裝SVN並整合HTTP訪問

http://www.cnblogs.com/fjping0606/p/7581093.html

那麼本文則介紹如何新增HTTPS證書加密訪問SVN（apache環境）

開啟/opt/apache/conf/httpd.conf

將

#LoadModule socache_shmcb_module modules/mod_socache_shmcb.so

去掉註釋：

loadModule socache_shmcb_module modules/mod_socache_shmcb.so

將

#LoadModule ssl_module modules/mod_ssl.so

去掉註釋：

LoadModule ssl_module modules/mod_ssl.so

將

#Include conf/extra/httpd-ssl.conf

去掉註釋：

Include conf/extra/httpd-ssl.conf

儲存並退出httpd.conf

開啟/opt/apache/conf/extra/httpd-vhosts.conf

新增以下內容

<VirtualHost _default_:443>

    DocumentRoot "/data/subversion"                           ##svn倉庫目錄

    ServerName svn.test.com:443                                ##上一篇檔案配置的訪問svn的域名

    ServerAlias svn.test.com

    ServerAdmin [email protected]

    DirectoryIndex index.html index.htm index.php default.php app.php u.php

    ErrorLog logs/example_error.log

    CustomLog logs/example_access.log \

    "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

    SSLEngine on

    SSLCertificateFile "/opt/apache/ssl/2_svn.test.com.crt"         ##在騰訊雲申請的https證書

    SSLCertificateKeyFile "/opt/apache/ssl/3_svn.test.com.key"

    SSLCertificateChainFile "/opt/apache/ssl/1_root_bundle.crt"

<Directory "svn.test.com">

    SSLOptions +StdEnvVars

    AllowOverride All

    Require all granted

</Directory>

<FilesMatch "\.(shtml|phtml|php)$">

    SSLOptions +StdEnvVars

</FilesMatch>

    BrowserMatch "MSIE [2-5]" \

    nokeepalive ssl-unclean-shutdown \

    downgrade-1.0 force-response-1.0

</VirtualHost>

儲存並退出httpd-vhost.conf

如果此時嘗試重啟http，會報錯，因為還缺少兩個檔案（/opt/apache/conf/extra/httpd-ssl.conf）：

/opt/apache/conf/server.crt

/opt/apache/conf/server.key

下面介紹如何生成這兩個檔案

由於Centos 7移除了Openssl的MD5支援，所以會在下面最後一步生成server.crt的時候報錯（ ./sign-server-cert.sh server ）：

error 7 at 0 depth lookup:certificate signature failure

配置在CentOS 7上啟用MD5支援

1、暫時啟用，在命令列下直接執行

export NSS_HASH_ALG_SUPPORT=+MD5

export OPENSSL_ENABLE_MD5_VERIFY=1

2、通過NetworkManager啟用MD5支援

vim /usr/lib/systemd/system/NetworkManager.service

追加下面內容：

[Service]

Environment="OPENSSL_ENABLE_MD5_VERIFY=1 NSS_HASH_ALG_SUPPORT=+MD5"

並重新啟動守護程序

systemctl daemon-reload

systemctl restart NetworkManager.service

開始配置生成證書

wget  ftp://ftp.pl.vim.org/vol/rzm4/replay.old/mirror/ftp.modssl.org/mod_ssl_contrib/ssl.ca-0.1.tar.gz

tar zxvf ssl.ca-0.1.tar.gz

cd ssl.ca-0.1

./new-root-ca.sh (生成根證書)

No Root CA key round. Generating one

Generating RSA private key, 1024 bit long modulus

...........................++++++

....++++++

e is 65537 (0x10001)

Enter pass phrase for ca.key: (輸入一個密碼)

Verifying - Enter pass phrase for ca.key: (再輸入一次密碼)

......

Self-sign the root CA... (簽署根證書)

Enter pass phrase for ca.key: (輸入剛剛設定的密碼)

........

........ (下面開始簽署)

Country Name (2 letter code) [MY]:CN

State or Province Name (full name) [Perak]:GuangDong

Locality Name (eg, city) [Sitiawan]:GuangZhou

Organization Name (eg, company) [My Directory Sdn Bhd]:leishen

Organizational Unit Name (eg, section) [Certification Services Division]:kuaiyin

Common Name (eg, MD Root CA) []:H5 CA

Email Address []:[email protected]

這樣就生成了ca.key和ca.crt兩個檔案，下面還要為我們的伺服器生成一個證書：

./new-server-cert.sh server (這個證書的名字是server)

......

......

Country Name (2 letter code) [MY]:CN

State or Province Name (full name) [Perak]:GuangDong

Locality Name (eg, city) [Sitiawan]:GuangZhou

Organization Name (eg, company) [My Directory Sdn Bhd]:leishen

Organizational Unit Name (eg, section) [Secure Web Server]:kuaiyin

Common Name (eg, www.domain.com) []:svn.test.com       ##注意這個Common Name不能和上面第一個Common Name設定相同

Email Address []:[email protected]

這樣就生成了server.csr和server.key這兩個檔案。

還需要簽署一下才能使用的：

./sign-server-cert.sh server

CA signing: server.csr -> server.crt:

Using configuration from ca.config

Enter pass phrase for ./ca.key:            (輸入上面設定的根證書密碼)

Check that the request matches the signature

Signature ok

The Subject's Distinguished Name is as follows

countryName           :PRINTABLE:'CN'

stateOrProvinceName   :PRINTABLE:'GuangDong'

localityName          :PRINTABLE:'GuangZhou'

organizationName      :PRINTABLE:'leishen'

organizationalUnitName:PRINTABLE:'kuaiyin'

commonName            :PRINTABLE:'svn.test.com'

emailAddress          :IA5STRING:'[email protected]'

Certificate is to be certified until Jan 27 12:05:17 2019 GMT (365 days)

Sign the certificate? [y/n]: y

1 out of 1 certificate requests certified, commit? [y/n] y

Write out database with 1 new entries

Data Base Updated

CA verifying: server.crt <-> CA cert

server.crt: OK

(如果這裡出現錯誤，最好重新來過，刪除ssl.ca-0.1這個目錄，從解壓縮處重新開始。)

完成上面步驟，就生成了server.crt server.key兩個檔案

將這兩個檔案拷貝到/opt/apache/conf/

然後重啟http

/opt/apache/bin/apachectl restart

完成上面所有步驟，就可以使用https訪問svn域名了

https://svn.test.com/leishen/mysvn

參考文章

http://www.eit.name/catool/

http://blog.csdn.net/magicbreaker/article/details/1566742

http://www.zeali.net/entry/532

http://software-engineer.gatsbylee.com/centos7openvpn-verify-error-depth0-errorcertificate-signature-failure/

http://php.upupw.net/apache/6/6325.html              配置HTTP強制跳轉到HTTPS