[原创]Apache配置https

Posted 2021-04-21 运维部落

tags:

篇首语：本文由小常识网(cha138.com)小编为大家整理，主要介绍了[原创]Apache配置https相关的知识，希望对你有一定的参考价值。

Apache配置https

配置https的注意事宜

yum安装httpd服务情况:

  需要安装mod_ssl模块,其安装后会在/etc/httpd/conf.d/目录下生成ssl.conf文件,需要其配置文件中加载相应的模块文件及配置

编译安装httpd服务的情况:

要编译的时候可以使用 --enable-ssl选项启用ssl功能,只需要在httpd的配置文件中, 加载相应的ssl模块及配置相关ssl参数

SSL会议的简化过程

客户端发送可供选择的加密方式,并向服务器请求证书
服务器端发送证书以及选定的加密方式给客户端
客户端取得证书并先进行证书验证
- 验证证书的合法性,用CA的公钥解密证书上数字签名
- 验证证书的内容合法性:完整性验证
- 检查证书的有效期限
- 检查证书是否被吊销
- 证书中拥有者的名字,与访问的目标主机是否一致
客户端生成临时会议密码(对称密钥),并使用服务器端的公钥加密此数据发送给服务器,完成密钥交换
服务器用此密码加密用户请求的资源,响应给客户端

https配置实例

配置CA及证书

yum install httpd -y

CA
cd /etc/pki/CA/
[root@Centos7 CA]# ls
certs  crl  newcerts  private
[root@Centos7 CA]# cd private/
[root@Centos7 private]# (umask 077; openssl genrsa -out cakey.pem 2048)
Generating RSA private key, 2048 bit long modulus
.........................................+++
........................+++
e is 65537 (0x10001)
[root@Centos7 private]#

[root@Centos7 CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:CN
Locality Name (eg, city) [Default City]:Beijing
Organization Name (eg, company) [Default Company Ltd]:Mageedu
Organizational Unit Name (eg, section) []:Ops
Common Name (eg, your name or your server's hostname) []:ca.mageedu.com
Email Address []:admin@mageedu.com
[root@Centos7 CA]# ls
cacert.pem  certs  crl  newcerts  private

[root@Centos7 CA]# touch index.txt serial
[root@Centos7 CA]# echo 01 > serial
[root@Centos7 CA]# ls
cacert.pem  certs  crl  index.txt  newcerts  private  serial

http server
root@Centos7 ~]# cd /etc/httpd/
[root@Centos7 httpd]# ls
conf  conf.d  conf.modules.d  logs  modules  run
[root@Centos7 httpd]# mkdir ssl

root@Centos7 ssl]# (umask 077;openssl genrsa -out httpd.key 2048)
Generating RSA private key, 2048 bit long modulus
...+++
.................................................................................+++
e is 65537 (0x10001)

[root@Centos7 ssl]# openssl req -new -key httpd.key -out httpd.csr -days 365
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:CN
Locality Name (eg, city) [Default City]:Beijing
Organization Name (eg, company) [Default Company Ltd]:Mageedu
Organizational Unit Name (eg, section) []:Ops
Common Name (eg, your name or your server's hostname) []:www.zhenping.com
Email Address []:admin@zhenping.com

[root@Centos7 ssl]# scp httpd.csr root@172.16.36.71:/tmp

CA Server
[root@Centos7 CA]# openssl ca -in /tmp/httpd.csr -out certs/httpd.crt -days 365
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Jan 17 23:42:58 2016 GMT
            Not After : Jan 16 23:42:58 2017 GMT
        Subject:
            countryName               = CN
            stateOrProvinceName       = CN
            organizationName          = Mageedu
            organizationalUnitName    = Ops
            commonName                = www.zhenping.com
            emailAddress              = admin@zhenping.com
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            Netscape Comment:
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier:
                61:7F:29:8A:68:A6:70:C2:F2:0E:49:15:D7:DD:4D:02:BF:EF:92:6A
            X509v3 Authority Key Identifier:
                keyid:18:F8:A6:71:FB:05:F3:0C:D3:56:9C:90:78:F1:4D:B5:0E:EC:51:5F

Certificate is to be certified until Jan 16 23:42:58 2017 GMT (365 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

[root@Centos7 CA]# scp certs/httpd.crt root@172.16.36.70:/etc/httpd/ssl
The authenticity of host '172.16.36.70 (172.16.36.70)' can't be established.
ECDSA key fingerprint is f7:6e:2f:38:57:8e:8c:0b:12:74:cc:af:44:82:88:17.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '172.16.36.70' (ECDSA) to the list of known hosts.
root@172.16.36.70's password:
httpd.crt                                                                                                                                       100% 4606     4.5KB/s   00:00

httpd server

vim /etc/httpd/conf.d/ssl.conf
DocumentRoot "/var/www/html"
ServerName www.zhenping.com
SSLCertificateFile /etc/httpd/ssl/httpd.crt
SSLCertificateKeyFile /etc/httpd/ssl/httpd.key

http的配置

root@Centos6-ser1 ~]# cat /etc/httpd/conf.d/vhost.conf
    LoadModule status_module modules/mod_status.so
    <Location /server-status>
        SetHandler server-status
        order deny,allow
        deny from all
        allow from 172.16.249.148
    </Location>

    namevirtualhost 172.16.36.60:80
    <VirtualHost 172.16.36.60:80>
        servername wwww.a.com
        Documentroot "/www/a.com/htdocs/"
        alias /download "/www/a.com/htdocs/file"
        Errorlog /www/log/a.com/error.log
        LogLevel warn
        Customlog /www/log/a.com/access.log combined
        LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
        <Directory "/www/a.com/htdocs/file/">
            Options Indexes
            AllowOverride None
            AuthType Basic
            AuthName "Please enter you username and password...."
            AuthUserFile "/etc/httpd/conf/.htpass"
            Require user zhenping
        </Directory>
    </virtualhost>

    <virtualhost 172.16.36.60:80>
        servername www.b.com
        documentroot "/www/b.com/htdocs"
        Errorlog /www/log/b.com/error.log
        LogLevel warn
        Customlog /www/log/b.com/access.log combined
        LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
        <Directory "/www/b.com/htdocs">
            Options None
            AllowOverride None
            AuthType Basic
            AuthName "Please Enter your username and password."
            AuthUserFile "/etc/httpd/conf/.htpass"
            AuthGroupFile "/etc/httpd/conf/.htpass_group"
            Require group mygrp
        </Directory>
    </virtualhost>

    <virtualhost 172.16.36.60:80>
        servername www.c.com
        documentroot "/www/c.com/htdocs"
        ErrorLog /www/log/c.com/error.log
        LogLevel warn
        CustomLog /www/log/c.com/access.log combined
        LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
        <Directory "/www/c.com/htdocs">
            Options None
            AllowOverride None
            order deny,allow
            deny from all
            allow from 172.16.249.148
        </Directory>
    </virtualhost>