配置https

Posted 2020-10-23 juandx

配置httpd

mkdir /etc/ssl/private
chmod 700 /etc/ssl/private
openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout /etc/ssl/private/apache-selfsigned.key -out /etc/ssl/certs/apache-selfsigned.crt
openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048
cat /etc/ssl/certs/dhparam.pem | sudo tee -a /etc/ssl/certs/apache-selfsigned.crt

vi /etc/httpd/conf.d/ssl.conf
<VirtualHost _default_:443>
. . .
DocumentRoot "/var/www/your_dir"
ServerName www.example.com:443

#然后是配置flask，当然flask是必须用wsgi来搞apache了,官网有http的例子http://flask.pocoo.org/docs/0.12/deploying/mod_wsgi/
#这里其实只需要在/etc/httpd/conf.d/ssl.conf做这些工作就行啦 在上一步的后面中加入

WSGIDaemonProcess your_web_group user=apache group=apache threads=2
WSGIScriptAlias / /var/www/your_dir/your_web.wsgi

<Directory /var/www/your_dir>
    WSGIProcessGroup your_web_group
    WSGIApplicationGroup %{GLOBAL}
    Order deny,allow
    Allow from all
</Directory>

注释两行：
# SSLProtocol all -SSLv2
. . .
# SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5:!SEED:!IDEA

改两个地方：
SSLCertificateFile /etc/ssl/certs/apache-selfsigned.crt
SSLCertificateKeyFile /etc/ssl/private/apache-selfsigned.key


设置http强制proxy到https

vi /etc/httpd/conf.d/non-ssl.conf
<VirtualHost *:80>
        ServerName www.example.com
        Redirect "/" "https://www.example.com/"
</VirtualHost>

检查配置，重启服务，设置防火墙

apachectl configtest

systemctl restart httpd.service

iptables -I INPUT -p tcp -m tcp --dport 80 -j ACCEPT
iptables -I INPUT -p tcp -m tcp --dport 443 -j ACCEPT

访问ip，如果没有问题就ok了，注意防火墙和selinux的问题

关闭selinux
vim /etc/selinux/config
设置为disable

reboot