https的配置（httpd+mod_ssl）

1.安裝Apache的mod_ssl模組

[[email protected]_k ~]# yum -y install mod_ssl

[[email protected]_k html]# rpm -ql mod_ssl
/etc/httpd/conf.d/ssl.conf
/usr/lib64/httpd/modules/mod_ssl.so
/var/cache/mod_ssl
/var/cache/mod_ssl/scache.dir
/var/cache/mod_ssl/scache.pag
/var/cache/mod_ssl/scache.sem

2.配置CA服務端

修改配置檔案：

[root@CA ~]# vim /etc/pki/tls/openssl.cnf

[ ca ]
default_ca      = CA_default            # The default ca section

####################################################################
[ CA_default ]

dir             = /etc/pki/CA           # CA的預設路徑
certs           = $dir/certs            # 客戶端證書
 

crl_dir         = $dir/crl              # 證書吊銷列表
database        = $dir/index.txt        # 給那些人發過證書
#unique_subject = no                    # Set to 'no' to allow creation of
                                        # several ctificates with same subject.
new_certs_dir   = $dir/newcerts         # 新生成證書的存放位置
 


certificate     = $dir/cacert.pem       # CA 的證書
serial          = $dir/serial           # 序列號
crlnumber       = $dir/crlnumber        # 證書吊銷列表的工作號
                                        # must be commented out to leave a V1 CRL
crl             = $dir/crl.pem          # 當前的證書吊銷列表
private_key     = $dir/private/cakey.pem # CA的私鑰
RANDFILE        = $dir/private/.rand    # private random number file

x509_extensions = usr_cert              # The extentions to add to the cert

default_days    = 365                   # 預設的認證時間是365天
default_crl_days= 30                    # 吊銷列表中內容的儲存時間
default_md      = default               # use public key default MD
preserve        = no      



[ req_distinguished_name ]
countryName                     = Country Name (2 letter code)
countryName_default             = CN   # 設定預設的國家
countryName_min                 = 2
countryName_max                 = 2

stateOrProvinceName             = State or Province Name (full name)
stateOrProvinceName_default     = BeiJing  #設定預設的省份

localityName                    = Locality Name (eg, city)
localityName_default    = BeiJing     #設定預設的城市

0.organizationName              = Organization Name (eg, company)
0.organizationName_default      = CA    #設定公司（組織）名稱

# we can do this but it is not needed normally :-)
#1.organizationName             = Second Organization Name (eg, company)
#1.organizationName_default     = World Wide Web Pty Ltd

organizationalUnitName          = Organizational Unit Name (eg, section)
organizationalUnitName_default  = IT  #設定部門（單位）

2.1 生成CA的私鑰

[root@CA CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048)
Generating RSA private key, 2048 bit long modulus
...........................................+++
................................................................................................+++
e is 65537 (0x10001)

2.2 生成CA的自簽證書

[[email protected] CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [BeiJing]:
Locality Name (eg, city) [BeiJing]:
Organization Name (eg, company) [CA]:
Organizational Unit Name (eg, section) [IT]:
Common Name (eg, your name or your server's hostname) []:ca.miner_k.com
Email Address []:[email protected]_k.com  

2.3 將CA伺服器下建立需要的檔案

[root@CA CA]# touch index.txt
[root@CA CA]# echo 01 > serial
[root@CA CA]# ls
cacert.pem  certs  crl  index.txt  newcerts  private  serial

3.在Apache的伺服器

3.1 生成金鑰對

[root@miner_k ~]# cd /etc/httpd/
[root@miner_k httpd]# ls
conf  conf.d  logs  modules  run
[root@miner_k httpd]# mkdir ssl
[root@miner_k httpd]# cd ssl/
[root@miner_k ssl]# (umask 077;openssl genrsa 1024 > httpd.key)
Generating RSA private key, 1024 bit long modulus
....................++++++
.......................++++++
e is 65537 (0x10001)

3.2 生成證書頒發請求(.csr)【Certificate signing request】

[[email protected]_k ssl]# openssl req -new -key httpd.key -out httpd.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [BeiJing]:
Locality Name (eg, city) [BeiJing]:
Organization Name (eg, company) [CA]:
Organizational Unit Name (eg, section) [IT]:
Common Name (eg, your name or your server's hostname) []:www.miner_k.com        #必須是這臺web伺服器的域名
Email Address []:[email protected]_k.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

注意：由於是私有的CA伺服器，關於預設的城市以及機構等都必須和CA的是一樣的

3.3 將證書傳送給CA的伺服器

[[email protected]_k ssl]# scp httpd.csr 101.200.87.99:/root
The authenticity of host '101.200.87.99 (101.200.87.99)' can't be established.
RSA key fingerprint is c8:bb:dc:fc:d0:27:4d:48:d2:0a:0f:db:a2:51:10:d2.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '101.200.87.99' (RSA) to the list of known hosts.
[email protected]101.200.87.99's password: 
httpd.csr                                                                                          100%  696     0.7KB/s   00:00 

4.在CA伺服器上的操作

4.1 簽署Apache傳送的證書請求

[[email protected] ~]# openssl ca -in httpd.csr -out httpd.crt -days 365
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: May 24 06:12:47 2017 GMT
            Not After : May 24 06:12:47 2018 GMT
        Subject:
            countryName               = CN
            stateOrProvinceName       = BeiJing
            organizationName          = CA
            organizationalUnitName    = IT
            commonName                = www.miner_k.com
            emailAddress              = [email protected]_k.com
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
                ED:E8:48:9D:30:0F:95:0B:19:63:D8:F9:9C:70:5C:7E:26:36:DA:30
            X509v3 Authority Key Identifier: 
                keyid:12:0E:C7:0F:0B:A6:06:3D:27:A1:5B:A7:EA:3D:C3:36:07:BE:77:13

Certificate is to be certified until May 24 06:12:47 2018 GMT (365 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

4.2 將簽署的證書傳送給Apache伺服器

[root@CA ~]# scp httpd.crt   114.*.*.229:/etc/httpd/ssl/

5. 在Apache伺服器上httpd的配置

[root@miner_k ssl]# cd /etc/httpd/conf.d/
[root@miner_k conf.d]# ls
README  ssl.conf  welcome.conf
[root@miner_k conf.d]# cp ssl.conf{,.bak} 
[root@miner_k conf.d]# ls
README  ssl.conf  ssl.conf.bak  welcome.conf

修改配置檔案ssl.conf
[root@miner_k conf.d]# grep -v "^#" ssl.conf | grep -v "^$"
LoadModule ssl_module modules/mod_ssl.so
Listen 443
SSLPassPhraseDialog  builtin
SSLSessionCache         shmcb:/var/cache/mod_ssl/scache(512000)
SSLSessionCacheTimeout  300
SSLMutex default
SSLRandomSeed startup file:/dev/urandom  256
SSLRandomSeed connect builtin
SSLCryptoDevice builtin
<VirtualHost _default_:443>    #預設主機，可以設定為IP地址
ErrorLog logs/ssl_error_log
TransferLog logs/ssl_access_log
LogLevel warn
SSLEngine on
SSLProtocol all -SSLv2
SSLCipherSuite DEFAULT:!EXP:!SSLv2:!DES:!IDEA:!SEED:+3DES
SSLCertificateFile /etc/httpd/ssl/httpd.crt    #修改內容，證書位置
SSLCertificateKeyFile /etc/httpd/ssl/httpd.key #修改內容，私鑰位置
<Files ~ "\.(cgi|shtml|phtml|php3?)$">
    SSLOptions +StdEnvVars
</Files>
<Directory "/var/www/cgi-bin">
    SSLOptions +StdEnvVars
</Directory>
SetEnvIf User-Agent ".*MSIE.*" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0
CustomLog logs/ssl_request_log \
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
</VirtualHost>                           

6.測試

6.1 直接使用瀏覽器測試https的網頁

重新啟動httpd服務：
[[email protected]_k conf.d]# service httpd restart

使用https協議訪問，但是可以看出是不安全的。

6.2 在客戶端載入CA的證書

• 1.將CA中的cacert.pem下載到本地然後改為為cacert.crt
  
• 2.將證書匯入到瀏覽器中