Linux下使用Openssl頒發Apache證書
阿新 • • 發佈：2018-09-02
value req org 工作 pki 準備 提前 httpd try 1安裝openssl
#yum install -y openssl2進入目錄/etc/pki/tls/certs
#cd /etc/pki/tls/certs3.生成私鑰文件(key)
#openssl genrsa -des3 -out server.key 10244.為了避免每次服務啟動都需要輸入證書密碼，刪除證書密碼
#openssl rsa -in server.key -out server.key5.用server.key生成證書
#openssl req -new -key server.key -out server.csr #這時候會提示以下信息： Country Name (2 letter code) [XX]:CN State or Province Name (full name) []:Beijing Locality Name (eg, city) [Default City]:Beijing Organization Name (eg, company) [Default Company Ltd]:No Organizational Unit Name (eg, section) []:New Common Name (eg, your name or your server‘s hostname) []:No Email Address []:[email protected] Please enter the following ‘extra‘ attributes to be sent with your certificate request A challenge password []:#如果直接回車 An optional company name []:#這裏直接回車
6.生成CA的key文件ca.key和根證書ca.crt
openssl req -new -x509 -keyout ca.key -out ca.crt
#提示信息和第5步驟類似。7.用CA證書為server.csr證書簽名
#為了防止報錯，需要提前做一些準備工作 #touch /etc/pki/CA/index.txt #echo 01 > /etc/pki/CA/serial #openssl ca -in server.csr -out server.crt -cert ca.crt -keyfile ca.key -config ../openssl.cnf #這是會提示以下信息 Sign the certificate? [y/n]:y#選擇y 1 out of 1 certificate requests certified, commit? [y/n]y#選擇y
8.這時候會得到ca.crt，ca.key，server.crt，server.csr，server.key。
9.將ca.crt，server.crt，server.key發送到apache配置目錄。我的是/usr/local/apache/conf/ssl/
10.哎apache的vhost目錄裏使用
#進入配置目錄， #cd /usr/local/apache/conf #vi httpd.conf IncludeOptional conf/vhost/*.conf #去掉註釋，如果沒有則新增 #進入vhost目錄 #cd /usr/local/apache/conf/vhost #創建一個新的配置文件，名稱自己定義，以.conf為後綴 #vi httpd-vhost-ssl.conf <VirtualHost *:443> ServerAdmin 隨便輸入的郵箱地址 php_admin_value open_basedir "/home/www/:/tmp/:/var/tmp/:/proc/" DocumentRoot /home/www ServerName 域名:443 ErrorLog "/home/wwwlogs/error_log" CustomLog "/home/wwwlogs/access_log" combined SSLEngine on SSLCertificateFile /usr/local/apache/conf/ssl/server.crt#證書的路徑 SSLCertificateKeyFile /usr/local/apache/conf/ssl/server.key#證書的路徑 #SSLCertificateChainFile /usr/local/apache/conf/ssl/ca.crt#證書的路徑 Protocols h2 h2c http/1.1 <Directory "/home/www/"> SetOutputFilter DEFLATE Options FollowSymLinks AllowOverride All Order allow,deny Allow from all DirectoryIndex index.php index.html </Directory> </VirtualHost>
Linux下使用Openssl頒發Apache證書