Listen 80 监听端口
Listen 800 创建基于虚拟主机的监听端口
LoadModule 后面是可以动态调用的模块
User apache 运行apache的用户
Group apache 运行apache的用户组
UseCanonicalName Off 做虚拟主机就为off
DocumentRoot "/var/www/html" 默认该站点的主目录
目录安全性，实现站点得安全
Options FollowSymLinks
AllowOverride None
保证基本站点的安全性：
Options Indexes FollowSymLinks 选项indexes 目录浏览属性，主页没人内容时可以看到主目录的一些文件 fllowsymlinks 在主目录中可以防止符号链接进行跳转
AllowOverride None 身份验证（all） AllowOverride all
Order allow,deny 先看deny，再看allow
Allow from all 允许访问的主机（可以设定某个ip）
此时CA服务器器已经做好
CA客户端得像CA服务器做一个请求，使用一个工具openssl，用这个工具产生一个请求文件
[root@workstation253 ~]# cd /etc/httpd/
[root@workstation253 httpd]# mkdir certs （创建一个目录，存放所有请求文件，钥匙等）
[root@workstation253 httpd]# cd certs/
先做钥匙，在根据钥匙产生请求文件
[root@workstation253 certs]# openssl genrsa 1024 （产生非对称加密算法，1024位长度）
Generating RSA private key, 1024 bit long modulus
..............................................++++++
..++++++
e is 65537 (0x10001)
-----BEGIN RSA PRIVATE KEY-----
MIICXQIBAAKBgQDImDeuIH3QvvlQJOFHomeSEosRNb6+WbKmkNzkwC9dDr6h2YOp
K9JBM/d+ajQbJy0h94qaRqx6GurJCBCTCwuABEqZAzAUL4N/SmMbNnNGI7kV51C0
2GAIeBIOVMaCE7FUvlIpnGt7kA6hEWXtRPA1pT3NHQMC1Hy6qqDh2P1gjQIDAQAB
AoGAQwJ+jz+xZ/t0A67eRvTcznI9XLlsh+AlCvmXoR8Gc3rKefzUu7201i1K/0Lx
NyTmMdOkzJbRZVT6m7+C8ewdocWrkvlsZpq+eZWqCLFghDBTbSObLBFpD45L/bvb
j8D94ICWZWzU2QLNHEcQ3CzCP2HWnPrZrXFtDgBv5QiyiGECQQDvZqjtluWlG+m6
Aq1/gLczkEx9bSikoBLgva56MhzxB9julQlyUnuto7nFJ8Rhr1+RlC5NofdH6Y8d
mkxR/JBZAkEA1oC/jrZnIlt3WNaYor04CSz3rvIKFa9d9fTgG2ROKdWVseMa6VlZ
aXYazfFMGboj5O+8MJPHVF8SXp3RoqarVQJBALWax9zr0isM4KGldF27k73+4bdn
/iPb9lYcLeYua7wAOvTJhBAAOCgBgmPoBdYghjvWD8X+bqpTp6hKK0kqcYkCQCUq
O4Zjji0CwgPvcpTHyhy04Nk78IlfUB1cZzP3xh8zdXNT0QbbR0Whg/VouHHAsZVq
ACY+hIvWyR0BpR/UVt0CQQCmPbK1k9pom9PaFK9iBdM9WiOq56GjFnMIU9T+j+9z
oc+MO+YEh2lFZxriy3IE2bcAeKayESTfHbDlHfFIGMu0
-----END RSA PRIVATE KEY----- （产生了私钥，但是里面包含公钥）
[root@workstation253 certs]# openssl genrsa 1024 >httpd.key （产生钥匙文件）
Generating RSA private key, 1024 bit long modulus
........++++++
.............................++++++
e is 65537 (0x10001)
[root@workstation253 certs]# chmod 600 httpd.key （为了安全起见更改钥匙文件的权限）
根据钥匙文件产生一个证书的请求
[root@workstation253 certs]# openssl req -new -key httpd.key -out httpd.csr 输出请求文件
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:CN 国家
State or Province Name (full name) [Berkshire]:HENAN 省份
Locality Name (eg, city) [Newbury]:ZHENGZHOU 城市
Organization Name (eg, company) [My Company Ltd]:ll 单位名
Organizational Unit Name (eg, section) []:tec 部门名
Common Name (eg, your name or your server's hostname) []:www.ll.com 为哪个服务器申请
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@workstation253 certs]# ll
total 8
-rw-r--r-- 1 root root 643 Sep 8 00:55 httpd.csr 产生了这个请求文件
-rw------- 1 root root 887 Sep 8 00:47 httpd.key
CA客户端把请求文件发给CA
使用linux做CA
自己做自签发的证书：
（1）产生自己的私钥并指明CA的目录
[root@ttttttttt ~]# cd /etc/pki/CA/ 切换待CA目录下
[root@ttttttttt CA]# ll
drwx------ 2 root root 4096 2010-03-12 private
[root@ttttttttt CA]# openssl genrsa 1024 >private/cakey.pem
Generating RSA private key, 1024 bit long modulus
....................................................................................++++++
..................++++++
e is 65537 (0x10001)
[root@ttttttttt CA]# chmod 600 private/* 更改私钥文件的权限
编译[root@ttttttttt ~]# vim /etc/pki/tls/openssl.cnf
45 dir = /etc/pki/CA 指明CA的目录
（2）产生一个自签发的证书（不需要请求文件）
[root@ttttttttt CA]# openssl req -x509 -new -key private/cakey.pem -out cacert.pem -days 3655
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
Country Name (2 letter code) [GB]:CN
State or Province Name (full name) [Berkshire]:HENAN
Locality Name (eg, city) [Newbury]:ZHENGZHOU
Organization Name (eg, company) [My Company Ltd]:TT
Organizational Unit Name (eg, section) []:TEC
Common Name (eg, your name or your server's hostname) []:rootca.tt.com
Email Address []:
[root@ttttttttt CA]# ll
-rw-r--r-- 1 root root 1123 09-05 03:09 cacert.pem 产生的证书文件
drwx------ 2 root root 4096 09-05 03:03 private
（3）让CA给服务器颁发证
[root@ttttttttt CA]# cd /etc/httpd/certs/
[root@ttttttttt certs]# opensslgenrsa 1024 >httpd.key
-bash: opensslgenrsa: command not found
You have new mail in /var/spool/mail/root
[root@ttttttttt certs]# openssl genrsa 1024 >httpd.key
Generating RSA private key, 1024 bit long modulus
...++++++
......................................++++++
e is 65537 (0x10001) 产生一个钥匙文件
[root@ttttttttt certs]# openssl req -new -key httpd.key -out httpd.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
Country Name (2 letter code) [GB]:CN
State or Province Name (full name) [Berkshire]:HENAN
Locality Name (eg, city) [Newbury]:ZHENGZHOU
Organization Name (eg, company) [My Company Ltd]:LL
[root@ttttttttt certs]# openssl req -new -key httpd.key -out httpd.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
Country Name (2 letter code) [GB]:CN
State or Province Name (full name) [Berkshire]:HENAN
Locality Name (eg, city) [Newbury]:ZHENGZHOU
Organization Name (eg, company) [My Company Ltd]:TT
Organizational Unit Name (eg, section) []:TEC
Common Name (eg, your name or your server's hostname) []:www.ll.com
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
产生一个请求
[root@ttttttttt certs]# ll
-rw-r--r-- 1 root root 643 09-05 03:23 httpd.csr 产生的请求文件
-rw-r--r-- 1 root root 887 09-05 03:20 httpd.key 产生的密钥文件
（4）为客户端签发证书
[root@ttttttttt etc]# cd /etc/httpd/certs/
[root@ttttttttt certs]# openssl ca -in httpd.csr -out httpd.crt
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Sep 4 19:50:10 2011 GMT
Not After : Sep 3 19:50:10 2012 GMT
Subject:
countryName = CN 客户端请求的信息
stateOrProvinceName = HENAN
organizationName = TT
organizationalUnitName = TEC
commonName = www.ll.com
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
B1:0E:57:5F:90:70:1E:6A:EA:CC:C4:8F:BB:AC:47:9C:5E:2B:2A:C6
X509v3 Authority Key Identifier:
keyid:B4:F1:BF:63:BF:B9:73:DD:DF:E7:29:39:D9:01:86:4A:F8:00:64:39
Certificate is to be certified until Sep 3 19:50:10 2012 GMT (365 days)
Sign the certificate? [y/n]:y 是否签发
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
[root@ttttttttt certs]# ll
-rw-r--r-- 1 root root 3047 09-05 03:50 httpd.crt 产生它
-rw-r--r-- 1 root root 643 09-05 03:23 httpd.csr
-rw-r--r-- 1 root root 887 09-05 03:20 httpd.key
（5）改变一下主配置，编译/etc/httpd/conf.d/ssl.conf
SSLCertificateFile /etc/httpd/certs/httpd.crt
SSLCertificateKeyFile /etc/httpd/certs/httpd.key
测试语法是否错误，可以使用了httpd -t 然后重启httpd
（6）使用www客户端使得证书被信任
[root@ttttttttt certs]# vim /etc/httpd/conf.d/ssl.conf
131 SSLCertificateChainFile /etc/pki/CA/cacert.pem
SSLCertificateKeyFile /etc/httpd/certs/httpd.key
然后重启httpd
用客户端浏览器打开：
QQ群⑧：
窥视卡
雷达卡
发表于 2018-11-29 08:26:48
提升卡
置顶卡
沉默卡
喧嚣卡
变色卡
千斤顶
显身卡