环境:

环境:

httpd服务器:10.140.165.169

CA服务器:10.140.165.93

CA服务器配置:

1.安装openssl

[root@cnhzdhcp16593 ~]# yum -y install openssl

2.生成CA自己的私钥.

[root@cnhzdhcp16593 ~]# cd /etc/pki/CA/

[root@cnhzdhcp16593 CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048)
Generating RSA private key, 2048 bit long modulus
................................+++
...........................+++
e is 65537 (0x10001)

3.定义openssl.cnf文件

[root@cnhzdhcp16593 CA]# grep "_default" ../tls/openssl.cnf | tail -6
countryName_default        = CN
stateOrProvinceName_default    = ZheJiang
localityName_default    = Hangzhou
0.organizationName_default    = izyno
#1.organizationName_default    = World Wide Web Pty Ltd
organizationalUnitName_default    = Tech

CA目录定义:

####################################################################
[ CA_default ]

dir             = /etc/pki/CA           # Where everything is kept
certs           = $dir/certs            # Where the issued certs are kept
crl_dir         = $dir/crl              # Where the issued crl are kept
database        = $dir/index.txt        # database index file.
#unique_subject = no                    # Set to 'no' to allow creation of
                                        # several ctificates with same subject.
new_certs_dir   = $dir/newcerts         # default place for new certs.

certificate     = $dir/cacert.pem       # The CA certificate
serial          = $dir/serial           # The current serial number
crlnumber       = $dir/crlnumber        # the current crl number
                                        # must be commented out to leave a V1 CRL
crl             = $dir/crl.pem          # The current CRL
private_key     = $dir/private/cakey.pem# The private key
RANDFILE        = $dir/private/.rand    # private random number file

4.生成自签证书.

[root@cnhzdhcp16593 CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 3655
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:     #设置国家
State or Province Name (full name) [ZheJiang]:   #省份
Locality Name (eg, city) [Hangzhou]:  #城市
Organization Name (eg, company) [izyno]:   #公司名称
Organizational Unit Name (eg, section) [Tech]:    #部门
www.izyno.com []:   #主机名
glq126@126.com []:

5.新建所需CA文件.

[root@localhost CA]# touch index.txt
[root@localhost CA]# echo 01 > serial
[root@localhost CA]# ls
certs  crl  index.txt  newcerts  private  serial
[root@localhost CA]#

httpd服务配置:

[root@localhost ~]# mkdir /etc/httpd/ssl    #新建一个密钥存放目录,此目录需要在ssl.conf文件配置.

1.生成httpd服务私有CA.

[root@localhost ssl]# (umask 077;openssl genrsa -out httpd.key 2048)
Generating RSA private key, 2048 bit long modulus
......+++
...............+++
e is 65537 (0x10001)
[root@localhost ssl]#

2.生成证书签署请求.

[root@localhost ssl]# openssl req -new -key httpd.key -out httpd.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [ZheJiang]:
Locality Name (eg, city) [Hangzhou]:
Organization Name (eg, company) [izyno]:
Organizational Unit Name (eg, section) [Tech]:
ca.izyno.com []:
glq126@126.com []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

3.CA服务器签署认证.

将生成的httpd.csr 文件传输到CA服务器,进行CA服务器签署认证.

在CA服务器进行签署认证:

[root@cnhzdhcp16593 CA]# openssl ca -in /tmp/httpd.csr -out /tmp/httpd.crt -days 3650
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Oct 11 14:19:54 2016 GMT
            Not After : Oct  9 14:19:54 2026 GMT
        Subject:
            countryName               = CN
            stateOrProvinceName       = ZheJiang
            organizationName          = izyno
            organizationalUnitName    = Tech
            commonName                = www.izyno.com
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            Netscape Comment:
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier:
                FD:9F:4F:11:0C:83:8E:78:69:1A:C1:0C:EA:1D:17:73:27:91:02:20
            X509v3 Authority Key Identifier:
               keyid:26:61:3D:38:E5:88:0F:D4:93:FA:AB:40:FC:4F:04:78:43:A0:86:95

Certificate is to be certified until Oct  9 14:19:54 2026 GMT (3650 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
[root@cnhzdhcp16593 CA]#

4.在CA服务器生成的httpd.crt文件传输到httpd服务器.

[root@cnhzdhcp16593 CA]# scp /tmp/httpd.crt 10.140.165.169:/etc/httpd/ssl/httpd.crt

配置ssl.conf文件在httpd服务器:

1.[root@localhost ssl]# vim /etc/httpd/conf.d/ssl.conf

<VirtualHost 10.140.165.169:443>    #设置虚拟主机IP

# General setup for the virtual host, inherited from global configuration
#DocumentRoot "/var/www/html"

ServerName www.izyno.com     #主机名
DocumentRoot "/www/izyno.com"  #主机根目录

# Use separate log files for the SSL virtual host; note that LogLevel
# is not inherited from httpd.conf.
ErrorLog logs/ssl_error_log   #错误日志
TransferLog logs/ssl_access_log  #访问日志定义
LogLevel warn

#   SSL Engine Switch:
#   Enable/Disable SSL for this virtual host.
SSLEngine on

#   SSL Protocol support:
# List the enable protocol levels with which clients will be able to
# connect.  Disable SSLv2 access by default:
SSLProtocol all -SSLv2

#   SSL Cipher Suite:
# List the ciphers that the client is permitted to negotiate.
# See the mod_ssl documentation for a complete list.
SSLCipherSuite DEFAULT:!EXP:!SSLv2:!DES:!IDEA:!SEED:+3DES

#   Server Certificate:
# Point SSLCertificateFile at a PEM encoded certificate.  If
# the certificate is encrypted, then you will be prompted for a
# pass phrase.  Note that a kill -HUP will prompt again.  A new
# certificate can be generated using the genkey(1) command.
SSLCertificateFile /etc/httpd/ssl/httpd.crt     #定义证书

#   Server Private Key:
#   If the key is not combined with the certificate, use this
#   directive to point at the key file.  Keep in mind that if
#   you've both a RSA and a DSA private key you can configure
#   both in parallel (to also allow the use of DSA ciphers, etc.)
SSLCertificateKeyFile /etc/httpd/ssl/httpd.key  #定义密钥

重启httpd服务.

在windos端访问:

导入CA服务器证书:

证书导入:

导入从CA服务器导出的crt格式文件.

访问:

HTTPD服务 openssl的https服务机制的更多相关文章

  1. 基于openssl的https服务配置

    环境: CA服务器:192.168.1.121 WEB服务器: 192.168.1.107 一.在CA服务器上生成自签证书 1.生成根私钥 (umask 077;openssl genrsa -out ...

  2. Nginx详解二十一:Nginx深度学习篇之配置苹果要求的openssl后台HTTPS服务

    配置苹果要求的证书: 1.服务器所有的连接使用TLS1.2以上的版本(openssl 1.0.2) 2.HTTPS证书必须使用SHA256以上哈希算法签名 3.HTTPS证书必须使用RSA2048位或 ...

  3. 如何通过Openssl实现私有CA,并为HTTP服务提供TLS/SLL安全机制

    原文链接:http://guodayong.blog.51cto.com/263451/1181059 Openssl是SSL的开源实现(可以免费下载应用程序),是一种安全机密程序,主要用于提高远程登 ...

  4. centos httpd开启https服务并申请免费https

    安装httpd yum -y install httpd httpd配置文件路径  /etc/httpd/conf/httpd.conf 安装OpenSSL yum install mod_ssl o ...

  5. Httpd服务入门知识-https(http over ssl)安全配置

    Httpd服务入门知识-https(http over ssl)安全配置 作者:尹正杰 版权声明:原创作品,谢绝转载!否则将追究法律责任. 一.SSL会话的简化过程 ()客户端发送可供选择的加密方式, ...

  6. 使用OpenSSL自建一个HTTPS服务

    1. 理论知识 1.1 什么是https 传统的 HTTP 协议以明文方式进行通信,不提供任何方式的数据加密,很容易被中间攻击者破解通信内容或者伪装成服务器与客户端通信,在安全性上存在很大问题. HT ...

  7. 使用poco 的NetSSL_OpenSSL 搭建https 服务端,使用C++客户端,java 客户端访问,python访问(python还没找到带证书访问的代码.)

    V20161028 由于项目原因,需要用到https去做一些事情. 这儿做了一些相应的研究. 这个https 用起来也是折腾人,还是研究了一周多+之前的一些积累. 目录 1,java client 通 ...

  8. 网络服务器之HTTPS服务

    import ssl, socket, time if __name__ == "__main__": context = ssl.SSLContext(ssl.PROTOCOL_ ...

  9. 本地开启https服务

    ### ##自签名证书 ##配置Apache服务器SSL ##自己作为CA签发证书 ###这里是OpenSSL和HTTPS的介绍 OpenSSL HTTPS 开启HTTPS配置前提是已在Mac上搭建A ...

随机推荐

  1. Ms sql pivot unpivot

    --建表 create table dbo.orders ( orderid int not null primary key nonclustered, orderdate datetime not ...

  2. leetcode 136

    136. Single Number Given an array of integers, every element appears twice except for one. Find that ...

  3. 微信 网页授权获取用户基本信息(OAuth 2.0)

    // 相关设置 $APPID = ""; $AppSecret = ""; $html = ""; // 拼接 URL // 跳转该连接 获 ...

  4. 记录今天学习python中for与while循环针对break和continue的用法

    python中有两个主要的循环for与while,其中针对这两个循环有两种不同的中断用法break与continue. 首先先看下面的循环代码: 1: for i in range(10):#变量i带 ...

  5. centos 7 u盘安装

    centos 7 u盘安装 http://www.centoscn.com/image-text/setup/2014/0724/3342.html

  6. css3的一些新属性1

    <body> /*文本阴影*/ <h1 style="text-shaow:5px 5px 5px #C0F">我爱你</h1> </bo ...

  7. C#将Enum枚举映射到文本字符串

    介绍 当将以前的C代码移植到C#中时,我快发疯了,因为有很多的数组需要将常量映射到字符串.当我在寻找一个C#的方法来完成的时候,我发现了一个自定义属性和映射的方法. 如何使用代码? 对每一个enum枚 ...

  8. PHP各种缓存

    缓存类型PHP缓存包括PHP变异缓存和PHP数据缓存两种:PHP编译缓存:        PHP数据缓存:    对数据库数据进行缓存    对PHP模板数据缓存 js数据缓存

  9. TFS2010安装办法及序列号

    安装过程: 一.安装操纵体系 安装Windows 2008 R2简体中文版 二.筹办安装过程中的须要的用户账户,并设置响应权限 具体流程如下: 1.点击“开端”——“经管对象”——“计较机经管” 2. ...

  10. linux中的开机和关机命令

    与关机.重新启动相关的命令 * 将数据同步写入硬盘中的命令  sync * 惯用的关机命令  shutdown * 重新启动.关机  reboot halt poweroff sync 强制将内存中的 ...