linux下apache安装ssl步骤

Posted 2022-03-31 xiaoleiel

制作证书：

             参考：linux下运用opensll制作ssl证书

            生成三个证书 server.crt 、server-ca.crt、server.key

安装openssl

tar -xzvf openssl-1.0.2h.tar.gz
cd openssl-1.0.2h
./config -fPIC enable-shared
make depend
make && make install
make clean && make distclean

#openssl类库做软连接
ln -s /usr/local/ssl//lib/*.so.* /usr/lib64
ln -s /usr/local/ssl//lib/*.so.* /usr/lib
安装apache

     apache依赖包安装不详细说明，

tar xvzf httpd-2.4.18.tar.gz
cd httpd-2.4.18
./configure \
--prefix=/usr/local/cp-httpd-2.4.18 \
--with-apr=/usr/local/cp-apr-1.5.2 \
--with-apr-util=/usr/local/cp-apr-util-1.5.4 \
--with-apr-iconv=/usr/local/cp-apr-iconv-1.2.1 \
--with-ssl=/usr/local/ssl \
--enable-so \
--enable-ssl \
--enable-mods-shared=all \
--enable-cache \
--enable-disk-cache \
--enable-file-cache \
--enable-mem-cache
make && make install
make clean && make distclean
配置apache的ssl

httpd.conf中配置

#启用ssl模块
sed -i ‘s:#LoadModule ssl_module modules/mod_ssl.so:LoadModule ssl_module modules/mod_ssl.so:‘ /usr/local/httpd/conf/httpd.conf
sed -i ‘s:#LoadModule socache_shmcb_module modules/mod_socache_shmcb.so:LoadModule socache_shmcb_module modules/mod_socache_shmcb.so:‘ /usr/local/httpd/conf/httpd.conf
sed -i ‘s:#Include conf/extra/httpd-ssl.conf:Include conf/extra/httpd-ssl.conf:‘ /usr/local/httpd/conf/httpd.conf
httpd-ssl.conf配置
sed -i ‘s:#SSLCertificateChainFile "/usr/local/httpd/conf/server-ca.crt":SSLCertificateChainFile "/usr/local/httpd/conf/server-ca.crt":‘ /usr/local/httpd/conf/extra/httpd-ssl.conf
拷贝server.crt 、server-ca.crt、server.key到/usr/local/httpd/conf目录下
apache结合openssl安装过程中出现的错误

1、apache错误提示libz.a: could not read symbols: Bad value”
                   重新安装openssl 加上-fPIC和enable-shared参数
./config -fPIC --prefix=/usr/local/openssl1.0.1 enable-shared
2、apache的httpd.conf缺乏LoadModule ssl_module modules/mod_ssl.so解决方法
                  原因是上一次编译的缓存存，需要清除掉才能重新生成执行

make clean && make distclean

3、httpd: Syntax error on line 129 of /usr/local/cp-httpd-2.4.18/conf/httpd.conf: Cannot load modules/mod_ssl.so into server: libssl.so.1.0.0: cannot open shared object file: No such file or directory
ln -s /usr/local/ssl/lib/*.so /usr/lib64
ln -s /usr/local/ssl//lib/*.so.* /usr/lib
                  这个问题比较奇怪，命名在httpd安装中指定了--enable-ssl和--with-ssl=/usr/local/openssl/还是无法生效，httpd只在/usr/lib64查找libssl.so.1.0.0，因此需要做个软连接处理。

配置rewrite规则实现访问http自动跳转到https

实现方法是定义一个.htaccess放在httdocs中，内容为：

<IfModule mod_rewrite.c>
Options +FollowSymlinks
RewriteEngine On

RewriteCond %SERVER_PORT !^443$
RewriteRule ^.*$ https://%SERVER_NAME%REQUEST_URI [L,R]

RewriteCond %REQUEST_FILENAME !-d
RewriteCond %REQUEST_FILENAME !-f
RewriteRule ^(.*)$ index.php/$1 [QSA,PT,L]

ErrorDocument 404 /404.html
ErrorDocument 403 /404.html
</IfModule>
特别说明：

     apache重新编译不会覆盖原有的httpd.conf文件，因此如果原有没有编译ssl的话，httpd.conf中必须手工加上mod_ssl.so模块配置