http服务详解（3）

https

https：http over ssl
SSL会话的简化过程

(1) 客户端发送可供选择的加密方式，并向服务器请求证书

(2) 服务器端发送证书以及选定的加密方式给客户端

(3) 客户端取得证书并进行证书验证

如果信任给其发证书的CA

(a) 验证证书来源的合法性；用CA的公钥解密证书上数字签名

(b) 验证证书的内容的合法性：完整性验证

(c) 检查证书的有效期限

(d) 检查证书是否被吊销

(e) 证书中拥有者的名字，与访问的目标主机要一致

(4) 客户端生成临时会话密钥（对称密钥），并使用服务器端的公钥加密此数据发送给服务器，完成密钥交换

(5) 服务用此密钥加密用户请求的资源，响应给客户端

注意：SSL是基于IP地址实现,单IP的主机仅可以使用一个https虚拟主机

https实现

(1) 为服务器申请数字证书
测试：通过私建CA发证书

(a) 创建私有CA

(b) 在服务器创建证书签署请求

(c) CA签证

(2) 配置httpd支持使用ssl，及使用的证书

yum -y install mod_ssl

配置文件：/etc/httpd/conf.d/ssl.conf

DocumentRoot

ServerName

SSLCertificateFile

SSLCertificateKeyFile

(3) 测试基于https访问相应的主机

openssl s_client [-connect host:port] [-cert filename] [-CApath directory] [-CAfile filename]

实现HTTP网站加密

第一种申请证书方式（自签名证书）

A主机：192.168.34.100 提供加密的网站

B主机：192.168.34.101　客户端

（1）在A主机安装mod_ssl模块

[root@centos7 ~]# yum install mod_ssl -y

（2）可以查看到安装mod_ssl模块时，执行了以下哎脚本就已经自动生成了公私钥文件，不需要我们再进行自签名证书

[root@centos7 ~]# rpm -q --scripts mod_ssl

postinstall scriptlet (using /bin/sh):

umask 077

if [ -f /etc/pki/tls/private/localhost.key -o -f /etc/pki/tls/certs/localhost.crt ]; then

   exit 0

fi

/usr/bin/openssl genrsa -rand /proc/apm:/proc/cpuinfo:/proc/dma:/proc/filesystems:/proc/interrupts:/proc/ioports:/proc/pci:/proc/rtc:/proc/uptime 2048 > /etc/pki/tls/private/localhost.key 2> /dev/null

FQDN=`hostname`

if [ "x${FQDN}" = "x" -o ${#FQDN} -gt 59 ]; then

   FQDN=localhost.localdomain

fi

cat << EOF | /usr/bin/openssl req -new -key /etc/pki/tls/private/localhost.key \

         -x509 -sha256 -days 365 -set_serial $RANDOM -extensions v3_req \

         -out /etc/pki/tls/certs/localhost.crt 2>/dev/null

--

SomeState

SomeCity

SomeOrganization

SomeOrganizationalUnit

${FQDN}

root@${FQDN}

EOF

证书存放路径：

[root@centos7 asite]# cd /etc/pki/tls/certs/

[root@centos7 certs]# ll

total 16

lrwxrwxrwx. 1 root root   49 Jan  4 16:32 ca-bundle.crt -> /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem

lrwxrwxrwx. 1 root root   55 Jan  4 16:32 ca-bundle.trust.crt -> /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt

-rw-------  1 root root 1391 Mar 31 10:43 localhost.crt  # 自签名颁发的证书

-rwxr-xr-x. 1 root root  610 Aug  9  2019 make-dummy-cert

-rw-r--r--. 1 root root 2516 Aug  9  2019 Makefile

-rwxr-xr-x. 1 root root  829 Aug  9  2019 renew-dummy-cert

（3）此时我们的/etc/httpd/conf.d/目录下就会生产一个ssl.conf加密文件，加密的关键信息，就是监听了443端口，并指定了https类型，不指定会默认为http，且加密默认访问的住配置文件的网站在/var/www/html目录下

vim /etc/httpd/conf.d/ssl.conf 生成的ssl.conf配置文件不需要修改，这里只是展示重要信息而已。

Listen 443 https

SSLCertificateFile /etc/pki/tls/certs/localhost.crt   # 证书存放路径

SSLCertificateKeyFile /etc/pki/tls/private/localhost.key  # 私钥存放路径

（4）注释掉httpd主配置文件的documenroot "/var/www/html"路径，并自定义访问路径。

1、注释掉httpd主配置文件的路径

[root@centos7 www]# vim /etc/httpd/conf/httpd.conf

#DocumentRoot "/var/www/html"  # 注释掉此行即可。

2、指定自定义的/data/www目录下访问网站

[root@centos7 www]# cat  /etc/httpd/conf.d/test.conf

documentroot "/data/www"  # 指定访问的网站路径

<directory "/data/www">

 require all granted  # 授权所有人都可以访问

</directory>

3、定义访问页面：

[root@centos7 www]# echo welcome to shanghai > /data/www/index.html

访问网站

1、在B主机客户端访问效果

[root@centos7 ~]# curl -k https://192.168.7.100   # -k是跳过检查

welcome to shanghai

2、此时就会提示不安全的网站：

第二种方法：搭建私有CA，实现HTTPS加密

（1）在A主机的/etc/pki/CA目录下生成私钥

[root@centos7html]#cd /etc/pki/CA

[root@centos7CA]#tree

.

├── certs

├── crl

├── newcerts

└── private

4 directories, 0 files

[root@centos7CA]#(umask 066;openssl genrsa  -out private/cakey.pem 2048)  生成私钥证书

Generating RSA private key, 2048 bit long modulus

..........................................................................................................+++

.......................................+++

e is 65537 (0x10001)

（2）在A主机上申请自签名证书：

[root@centos7CA]#openssl req -new -x509 -key  private/cakey.pem  -out cacert.pem

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [XX]:CN

State or Province Name (full name) []:beijing

Locality Name (eg, city) [Default City]:beijing

Organization Name (eg, company) [Default Company Ltd]:magedu

Organizational Unit Name (eg, section) []:devops

Common Name (eg, your name or your server's hostname) []:ca.magedu.com

Email Address []:

查看当前创建文件的tree结构

（3）在A主机上新建两个文件

[root@centos7CA]#touch index.txt

[root@centos7CA]#echo 01 > serial

（4）在A主机向服务端申请证书

1、先生成私钥

[root@centos7CA]#cd /etc/httpd/conf.d

[root@centos7conf.d]#ls

autoindex.conf  httpdgroup  httpdpass  manual.conf  README  ssl.conf  test.conf  userdir.conf  welcome.conf

[root@centos7conf.d]#mkdir ssl  新建一个ssl目录

[root@centos7conf.d]#cd ssl

[root@centos7ssl]#pwd

/etc/httpd/conf.d/ssl

[root@centos7ssl]#(umask 077;openssl genrsa -out httpd.key 1024)  生成私钥

Generating RSA private key, 1024 bit long modulus

..........++++++

.......++++++

e is 65537 (0x10001)

　2、生成证书申请文件

[root@centos7ssl]#openssl req -new -key  httpd.key -out  httpd.csr

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [XX]:CN   国家一致

State or Province Name (full name) []:beijing  省份一致

Locality Name (eg, city) [Default City]:beijing

Organization Name (eg, company) [Default Company Ltd]:magedu  公司一致

Organizational Unit Name (eg, section) []:beiguobu

Common Name (eg, your name or your server's hostname) []:*.magedu.com

Email Address []:

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

（5）在A主机开始颁发证书

[root@centos7CA]#cd /etc/pki/CA    切换到CA目录下

[root@centos7CA]#openssl ca -in /etc/httpd/conf.d/ssl/httpd.csr  -out  certs/httpd.crt  -days 100  颁发证书

Using configuration from /etc/pki/tls/openssl.cnf

Check that the request matches the signature

Signature ok

Certificate Details:

        Serial Number: 1 (0x1)

        Validity

            Not Before: Nov 28 14:09:59 2019 GMT

            Not After : Mar  7 14:09:59 2020 GMT

        Subject:

            countryName               = CN

            stateOrProvinceName       = beijing

            organizationName          = magedu

            organizationalUnitName    = beiguobu

            commonName                = *.magedu.com

        X509v3 extensions:

            X509v3 Basic Constraints:

                CA:FALSE

            Netscape Comment:

                OpenSSL Generated Certificate

            X509v3 Subject Key Identifier:

                E3:03:AB:A2:28:41:EB:41:A8:2F:35:DD:A1:D3:FA:F4:9B:2E:49:EB

            X509v3 Authority Key Identifier:

                keyid:E5:B6:6E:DC:62:18:90:3C:6E:BD:08:CF:4A:9A:1B:E5:2E:3A:15:F0

Certificate is to be certified until Mar  7 14:09:59 2020 GMT (100 days)

Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y

Write out database with 1 new entries

Data Base Updated

（6）将certs目录下的文件以及cacert.pem文件都复制到ssl目录下

[root@centos7CA]#cp certs/httpd.crt   /etc/httpd/conf.d/ssl/  复制httpd.crt文件到ssl目录下

[root@centos7CA]#cd /etc/httpd/conf.d/ssl

[root@centos7ssl]#ls

httpd.crt  httpd.csr  httpd.key

[root@centos7CA]#cp cacert.pem /etc/httpd/conf.d/ssl  复制cacert.pem文件到ssl目录下

[root@centos7CA]#ls /etc/httpd/conf.d/ssl

cacert.pem httpd.crt httpd.csr httpd.key

（7）修改mod_ssl配置文件信息

vim /etc/httpd/conf.d/ssl.conf

SSLCertificateFile /etc/httpd/conf.d/ssl/httpd.crt  证书文件路径

SSLCertificateKeyFile /etc/httpd/conf.d/ssl/httpd.key 私钥文件路径

SSLCACertificateFile /etc/httpd/conf.d/ssl/cacert.pem  CA证书文件路径

重启httpd服务：systemctl restart httpd　

在网页上查看结果：将证书安装后，就会信任此证书，就不会再提示危险网址

http重定向https

（1）将http请求转发至https的URL

（2）重定向

Redirect [status] URL-path URL

（3）status状态：

 Permanent：返回永久重定向状态码 301

 Temp：返回临时重定向状态码302. 此为默认值

示例：

 Redirect temp / https://www.magedu.com/

HSTS

HSTS:HTTP Strict Transport Security （常用此功能）

服务器端配置支持HSTS后，会在给浏览器返回的HTTP首部中携带HSTS字段。浏览器获取到该信息后，会将所有HTTP访问请求在内部做307跳转到HTTPS。而无需任何网络过程

HSTS preload list

是Chrome浏览器中的HSTS预载入列表，在该列表中的网站，使用Chrome浏览器访问时，会自动转换成HTTPS。Firefox、Safari、Edge浏览器也会采用这个列表

实现HSTS示例：

vim /etc/httpd/conf/httpd.conf

Header always set Strict-Transport-Security "max-age=31536000"  总是加密，但定义跳转时间有效期，以数s为单位，实际是1年

RewriteEngine on

RewriteRule ^(/.*)$ https://%{HTTP_HOST}$1 [redirect=302]

演示：网页跳转

修改httpd配置文件

vim /etc/httpd/conf/httpd.conf

RewriteEngine on

RewriteRule ^(/.*)$ https://%{HTTP_HOST}$1 [redirect=302]

在另一台主机上检测此时的主机跳转结果：

如果想定义一个跳转的有效期，就在/etc/httpd/conf/httpd.conf配置文件中加入一条代码，并实现HSTS功能，如下：

Header always set Strict-Transport-Security "max-age=31536000"  总是加密，定义跳转时间有效期，以数s为单位，算下来就是一年

vim /etc/httpd/conf/httpd.conf　在最底部写入此配置文件内容即可