Enable HTTPS access based on OpenSSL

1. Description

Before deployment, give an example to facilitate understanding.

For example, I want to rent a house, so I search on a website, the results of contact found that many are false.

Have a fancy house, and worry about the landlord is a liar. This time, I to rent, found a house intermediary company, although charges, but can rest assured that the rental of the house.

650) this.width=650; "Src=" https://s3.51cto.com/wyfs02/M01/97/A3/wKiom1kwz6SxV5SEAAC9fvbngJE199.png-wh_500x0-wm_ 3-wmp_4-s_1986526782.png "title=" Https.png "alt=" Wkiom1kwz6sxv5seaac9fvbngje199.png-wh_50 "/>

2. Deployment

CA server:192.168.1.10

HTTP server:192.168.1.200

2-1) generate the self-visa CACERT.PEM on the CA

Switch to CA server:192.168.1.10

2-1-1) Create private key

# (Umask 077;openssl Genrsa-out/etc/pki/ca/private/cakey.pem)

* Description: The permissions of the private key are set to a minimum and can be created using the child shell method.

2-1-2) generate self-visa (for distribution to individual users)
#openssl Req-new-x509-key/etc/pki/ca/private/cakey.pem-out/etc/pki/ca/cacert.pem

650) this.width=650; "Src=" https://s5.51cto.com/wyfs02/M00/97/A5/wKioL1kw07jTXzjlAACHoMimGoI730.png-wh_500x0-wm_ 3-wmp_4-s_3600412225.png "title=" Ca.png "alt=" Wkiol1kw07jtxzjlaachomimgoi730.png-wh_50 "/>

What you need to fill out can be set in the configuration file.

#vim/etc/pki/tls/openssl.cnf

650) this.width=650; "Src=" https://s2.51cto.com/wyfs02/M02/97/A4/wKiom1kw1T3g_RaHAABRjoLya-4763.png-wh_500x0-wm_ 3-wmp_4-s_2403684741.png "title=" Sslfile.png "alt=" Wkiom1kw1t3g_rahaabrjolya-4763.png-wh_50 "/>

2-2-1) server-side request generation certificate

Switch to HTTP server:192.168.1.200

#yum Install mod_ssl-y #用于https的配置

#mkdir/etc/httpd/ssl

#cd/etc/httpd/ssl

# (Umask 077;openssl genrsa-out httpd.key) #生成私钥

#openssl Req-new-key httpd.key-out HTTPD.CSR #生成证书请求

* Note: The fields in the red box are identical to those set on the CA (refer to 2-1-2), and the domain name in the yellow box is the domain name that the CA authenticates.

650) this.width=650; "Src=" https://s1.51cto.com/wyfs02/M01/97/A5/wKiom1kw14LidN64AACBivdKles847.png-wh_500x0-wm_ 3-wmp_4-s_1255796940.png "title=" Httpdcsr.png "alt=" Wkiom1kw14lidn64aacbivdkles847.png-wh_50 "/>

2-2-2) sends the generated HTTPD.CSR certificate request file to the CA server and the certificate is sent by the CA.

#pwd

/etc/httpd/ssl

#scp HTTPD.CSR [Email protected]:/tmp

2-2-3) switch to CA server for certificate distribution

#openssl ca-in/tmp/httpd.csr-out/tmp/httpd.crt-days 365

Send the generated certificate to the HTTP server

#scp/tmp/httpd.crt [Email Protected]:/etc/httpd/ssl

2-2-4) switch to HTTP server view

#ls/etc/httpd/ssl

HTTPD.CRT HTTPD.CSR Http.key

In/etc/httpd/conf.d/ssl.conf modify the private key and certificate storage location, restart Apache, view port 443

Sslcertificatekeyfile/etc/httpd/ssl/httpd.key

Sslcertificatefile/etc/httpd/ssl/httpd.crt

#netstat-TUNLP |grep httpd

TCP 0 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 15608/httpd

TCP 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 15608/httpd

2-3) The client downloads the certificate Cacert.pem file on the CA and renamed CECERT.CRT. Double-click the installation certificate.

Doing domain mapping in native hosts

192.168.1.200 www.slitobo.com

browser access can be;

650) this.width=650; "Src=" https://s2.51cto.com/wyfs02/M02/97/A7/wKioL1kw3EDCaluUAACsOfenYvs929.png-wh_500x0-wm_ 3-wmp_4-s_1577656434.png "title=" C1.png "alt=" Wkiol1kw3edcaluuaacsofenyvs929.png-wh_50 "/>

650) this.width=650; "Src=" https://s2.51cto.com/wyfs02/M00/97/A6/wKiom1kw3ECzdSHSAACd5ylhzdY400.png-wh_500x0-wm_ 3-wmp_4-s_2896313806.png "style=" Float:none; "title=" C2.png "alt=" Wkiom1kw3eczdshsaacd5ylhzdy400.png-wh_50 "/>

650) this.width=650; "Src=" https://s2.51cto.com/wyfs02/M00/97/A7/wKioL1kw3f6gdJHLAAAiqMDTDig506.png-wh_500x0-wm_ 3-wmp_4-s_1902198745.png "title=" C3.png "alt=" Wkiol1kw3f6gdjhlaaaiqmdtdig506.png-wh_50 "/>

This article is from the "remote to the South" blog, please be sure to keep this source http://slitobo.blog.51cto.com/12957087/1931603

Enable HTTPS access based on OpenSSL