Apache自签ssl证书
Apache的web服务的ssl证书申请配置，这里是自签证书！！！
关于ssl证书相关原理啥的，请先自行搜索了解下。
操作系统环境，如下：
# cat /etc/issue
CentOS release 6.4 (Final)
Kernel \r on an \m
# uname -r
2.6.32-358.el6.x86_64
# uname -m
x86_64
#
IP 角色
192.168.33.132 CA证书服务器签发端
192.168.33.131 证书申请端
由于web服务是Apache，所以在证书申请端已经安装了httpd服务。
# yum install httpd -y//如源码编译安装的httpd，加入enable-ssl
CA证书服务器签发端，操作，步骤如下：
# pwd
/etc/pki/CA
# ls
certscrlnewcertsprivate
生成自签证书
生成私钥
# (umask 077; openssl genrsa -out private/cakey.pem 2048)
Generating RSA private key, 2048 bit long modulus
...........................................................................+++
................................+++
e is 65537 (0x10001)
# ls -l private/
total 4
-rw-------. 1 root root 1679 Mar3 21:07 cakey.pem
生成自签证书
修改openssl.cnf文件，生成过程中减少二次输入相关内容
# vim /etc/pki/tls/openssl.cnf
130 countryName_default = CN//修改为CN
135 stateOrProvinceName_default = Beijing//省份名称
138 localityName_default = Beijing//城市名称
141 0.organizationName_default = zxl//组织名称
148 organizationalUnitName_default= Tech//部门名称# pwd
/etc/pki/CA
# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) :
State or Province Name (full name) :
Locality Name (eg, city) :
Organization Name (eg, company) :
Organizational Unit Name (eg, section) :
Common Name (eg, your name or your server's hostname) []:ca.zxl.com
Email Address []:1987277672@qq.com
# ls
cacert.pemcertscrlnewcertsprivate
# ll cacert.pem
-rw-r--r--. 1 root root 1403 Mar3 21:22 cacert.pem
# pwd
/etc/pki/CA
# vim ../tls/openssl.cnf
42 dir = /etc/pki/CA //修改CA证书路径
如果certs crl newcerts目录不存在手动创建目录即可
# ls certs/ crl/ newcerts/
certs/:
crl/:
newcerts/:
# touch index.txt
# echo 01 > serial
# ls
cacert.pemcertscrlindex.txtnewcertsprivateserial
证书申请端，操作步骤如下：
# yum install mod_ssl -y
# rpm -ql mod_ssl
/etc/httpd/conf.d/ssl.conf
/usr/lib64/httpd/modules/mod_ssl.so
/var/cache/mod_ssl
/var/cache/mod_ssl/scache.dir
/var/cache/mod_ssl/scache.pag
/var/cache/mod_ssl/scache.sem
可以通过-M参数查看模块是否有ssl_module (shared)
# httpd -M|grep ssl_module
ssl_module (shared)
Syntax OK# mkdir /etc/httpd/ssl//用于存放证书的目录
# cd ssl/
# ls# (umask 077; openssl genrsa 2048 > httpd.key)//
Generating RSA private key, 2048 bit long modulus
.........................+++
........+++
e is 65537 (0x10001)
# ll
total 4
-rw------- 1 root root 1675 Mar4 22:05 httpd.key
证书签署请求
# pwd
/etc/httpd/ssl
# openssl req -new -key httpd.key -out httpd.csr//生成证书请求，由于是自签证书，所以一下信息必须和CA服务器签发一致。
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) :CN //两个字母的国家代号
State or Province Name (full name) []:Beijing //省份名称
Locality Name (eg, city) :Beijing //城市名称
Organization Name (eg, company) :zxl //公司名称
Organizational Unit Name (eg, section) []:Tech //部门名称
Common Name (eg, your name or your server's hostname) []:www.zxl.com //我这里就一个www.zxl.com，如要使用bbs.zxl.com，这里可以填写为*.zxl.com
Email Address []:1987277627@qq.com //邮箱
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []: //无
An optional company name []: //无
注：由于是自签证书，所以以上信息必须要和CA服务器端信息一致，不然无法签发成功
证书申请端服务器上的证书签署请求发送到CA服务器端
# pwd
/etc/httpd/ssl
# ls
httpd.csrhttpd.key
# scp httpd.csr root@192.168.33.132:/opt/
root@192.168.33.132's password:
httpd.csr 100% 1045 1.0KB/s 00:00
CA证书服务器签发端，操作，步骤如下：
# openssl ca -in /opt/httpd.csr-out /opt/httpd.crt -days 365//签发证书一年365天，信息内容如下：
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Mar3 13:58:01 2016 GMT
Not After : Mar3 13:58:01 2017 GMT
Subject:
countryName = CN
stateOrProvinceName = Beijing
organizationName = zxl
organizationalUnitName = Tech
commonName = www.zxl.com
emailAddress = 1987277627@qq.com
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
0D:15:BB:9D:B9:2D:8F:09:E7:BA:94:18:03:F9:7C:1A:57:C6:B6:96
X509v3 Authority Key Identifier:
keyid:6D:3B:91:4E:73:C7:16:34:C7:70:7D:E4:18:24:F8:0A:D8:32:F4:E0
Certificate is to be certified until Mar3 13:58:01 2017 GMT (365 days)
Sign the certificate? :y
1 out of 1 certificate requests certified, commit? y
Write out database with 1 new entries
Data Base Updated
# cd /etc/pki/CA/
# ls
cacert.pemcrl index.txt.attrnewcertsserial
certs index.txtindex.txt.old private serial.old
# cat index.txt//相关信息
V170303135801Z01unknown/C=CN/ST=Beijing/O=zxl/OU=Tech/CN=www.zxl.com/emailAddress=1987277627@qq.com
# cat serial//下次签发编号为02
02
CA服务器端的证书发放给证书请求方
# pwd
/opt
# ls
httpd.crthttpd.csr
# scp httpd.crt root@192.168.33.131:/etc/httpd/ssl
The authenticity of host '192.168.33.131 (192.168.33.131)' can't be established.
RSA key fingerprint is 34:fc:c0:cc:11:05:7d:a3:48:60:3d:93:91:35:7d:0e.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.33.131' (RSA) to the list of known hosts.
root@192.168.33.131's password:
httpd.crt 100% 4588 4.5KB/s 00:00
证书申请端查看发放的证书
# ls /etc/httpd/ssl/httpd.crt -l
-rw-r--r-- 1 root root 4588 Mar4 22:32 /etc/httpd/ssl/httpd.crt
# pwd
/etc/httpd/conf.d
# cp ssl.conf ssl.conf.bak
# vi ssl.conf
105 SSLCertificateFile /etc/httpd/ssl/httpd.crt//签发的证书文件
112 SSLCertificateKeyFile /etc/httpd/ssl/httpd.key//私钥文件key
检查语法
# httpd -t
Syntax OK# service httpd restart
Stopping httpd:
Starting httpd: 查看443端口
# netstat -ntpl|grep httpd
tcp 0 0 :::80 :::* LISTEN 1941/httpd
tcp 0 0 :::443 :::* LISTEN 1941/httpd
在window端，
C:\Windows\System32\drivers\etc\hosts文件在末尾添加内容如下：
192.168.33.131 www.zxl.com
打开浏览器访问
安装证书，吧CA服务器端的cacert.pem文件拿到本地，怎么拿，方法你懂的。
# pwd
/etc/pki/CA
# ls cacert.pem //数字证书
cacert.pem
#
把cacert.pem文件改成cacert.crt即可，然后安装
打开浏览器再次访问即可
页:
[1]