使用htpasswd添加相关的用户以及组：
[20:12 root@www/var/www/html]# htpasswd -c -m /etc/httpd/conf/.htpasswd hill
New password:
Re-type new password:
Adding password for user hill
[20:12 root@www/var/www/html]#htpasswd -m /etc/httpd/conf/.htpasswd jason
New password:
Re-type new password:
Adding password for user jason
[20:13 root@www/var/www/html]#htpasswd -m /etc/httpd/conf/.htpasswd nancy
New password:
Re-type new password:
Adding password for user nancy
[20:13 root@www/var/www/html]#cat /etc/httpd/conf/.htgroup
admin: hill nancy
[20:13 root@www/var/www/html]# cat /etc/httpd/conf/.htpasswd
hill:$apr1$Y66c0zU3$oK9237JoHPrbcc9JIYPjD0
jason:$apr1$lfmcM6jh$b2n50Np7dgST8qIBT/RL00
nancy:$apr1$ye576Up7$LvHzYot8mVl/EkO85HJI4.
下面来按步骤进行演示：
(1) 搭建私有根CA服务器：
[16:32 root@centos6.8/etc/pki/CA]# tree
.
├── certs
├── crl
├── index.txt
├── newcerts
├── private
└── serial
4 directories, 2 files
[16:32 root@centos6.8/etc/pki/CA]# (umask 066;openssl genrsa -out private/cakey.pem)
Generating RSA private key, 1024 bit long modulus
......................................++++++
.......++++++
e is 65537 (0x10001)
[16:33 root@centos6.8/etc/pki/CA]#openssl req -new -x509 -key private/cakey.pem -out /etc/pki/CA/cacert.pem -days 365
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:BEIJING
Locality Name (eg, city) [Default City]:BEIJING
Organization Name (eg, company) [Default Company Ltd]:nihao
Organizational Unit Name (eg, section) []:nihao.com
Common Name (eg, your name or your server's hostname) []:ca.nihao.com
Email Address []:admin@nihao.com
[16:35 root@centos6.8/etc/pki/CA]# tree
.
├── cacert.pem
├── certs
├── crl
├── index.txt
├── newcerts
├── private
│?? └── cakey.pem
└── serial
4 directories, 4 files web服务器生成证书的申请文件：
[00:31 root@www~]# mkdir -p /etc/httpd/ssl/private
[00:31 root@www~]#(umask 066;openssl genrsa -out /etc/httpd/ssl/private/httpd.key 2048)
Generating RSA private key, 2048 bit long modulus
..........................................................................+++
........................................................+++
e is 65537 (0x10001)
[00:32 root@www~]#openssl req -new -key /etc/httpd/ssl/private/httpd.key -out /etc/httpd/ssl/httpd.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:BEIJING
Locality Name (eg, city) [Default City]:BEIJING
Organization Name (eg, company) [Default Company Ltd]:nihao
Organizational Unit Name (eg, section) []:www.nihao.com
Common Name (eg, your name or your server's hostname) []:www.nihao.com
Email Address []:aadmin@nihao.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[00:34 root@www~]# scp /etc/httpd/ssl/httpd.csr 192.168.31.29:/etc/pki/CA/certs/
ssh: connect to host 192.168.31.29 port 22: No route to host
lost connection 把申请证书文件上传到根CA服务器以便签署：
[00:35 root@www~]# scp /etc/httpd/ssl/httpd.csr 192.168.31.49:/etc/pki/CA/certs/
The authenticity of host '192.168.31.49 (192.168.31.49)' can't be established.
RSA key fingerprint is d1:42:7c:63:7d:e2:7f:70:b5:b3:ea:4d:6e:bc:97:af.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.31.49' (RSA) to the list of known hosts.
root@192.168.31.49's password:
httpd.csr 100% 1062 1.0KB/s 00:00 (2)对申请证书进行签署，并把签署的证书发送回web服务器：
[16:44 root@centos6.8/etc/pki/CA]# openssl ca -in certs/httpd.csr -out httpd.key
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Sep 29 08:44:15 2016 GMT
Not After : Sep 29 08:44:15 2017 GMT
Subject:
countryName = CN
stateOrProvinceName = BEIJING
organizationName = nihao
organizationalUnitName = www.nihao.com
commonName = www.nihao.com
emailAddress = aadmin@nihao.com
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
A8:83:56:22:E3:F1:EE:B6:6D:59:A1:E1:59:87:E0:01:DA:06:11:33
X509v3 Authority Key Identifier:
keyid:CD:0B:CD:B6:10:FE:3D:8E:A9:CB:DF:B4:DC:AD:6F:C6:F2:4E:EE:13
Certificate is to be certified until Sep 29 08:44:15 2017 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
[16:44 root@centos6.8/etc/pki/CA]# ll certs/
total 4
-rw-r--r--. 1 root root 1062 Sep 29 16:41 httpd.csr
-rw-r--r--. 1 root root 0 Sep 29 16:43 httpd.key
[16:45 root@centos6.8/etc/pki/CA]# scp certs/httpd.key 192.168.31.212:/etc/httpd/ssl/
The authenticity of host '192.168.31.212 (192.168.31.212)' can't be established.
RSA key fingerprint is 37:57:be:b6:cb:a7:e4:2a:77:a1:98:ed:63:5e:30:73.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.31.212' (RSA) to the list of known hosts.
root@192.168.31.212's password:
httpd.key 100% 0 0.0KB/s 00:00
QQ群⑧：
窥视卡
雷达卡
发表于 2018-11-19 10:11:47
提升卡
置顶卡
沉默卡
喧嚣卡
变色卡
千斤顶
显身卡