Build your own CA issued certificate to do HTTPS encrypted Web site

If the site is for intranet access, build the CA server to issue certificates, if it is for the Internet to access, or to buy SSL certificate is better, today to introduce themselves to build CA server issued a certificate to do encrypted Web site.

192.168.10.187 CA Server

192.168.10.190 Web Server

(1) Build CA

Cd/etc/pki/ca

Create serial and Index.txt two files in this directory

echo > Serial (00 is the initial version number of the issuing certificate)

Touch Index.txt

(Umask 006;openssl genrsa-out private/cakey.pem 4096) generate private key

OpenSSL req-new-x509-key private/cakey.pem-out cacert.pem-days 3650 Generate self-signed CA certificate

(2) Web server request certificate, CA server issue certificate

MKDIR/ETC/HTTPD/CONF.D/SSL Create a directory to hold CA-issued certificates

(Umask 006;openssl genrsa-out/etc/httpd/conf.d/ssl/httpd.key 2048) Generate private key

OpenSSL REQ-NEW-KEY/ETC/HTTPD/CONF.D/SSL/HTTPD.KEY-OUT/ETC/HTTPD/CONF.D/SSL/HTTPD.CSR Application Certificate

Send this application certificate to the CA server

SCP/ETC/HTTPD/CONF.D/SSL/HTTPD.CSR 192.168.10.187:/etc/pki/ca

The CA server can then issue the certificate

OpenSSL ca-in httpd.csr-out certs/httpd.crt-days 300 issued a certificate with a 300-day validity period

Then send the certificate issued by the CA server to the Web server

SCP CERTS/HTTPD.CRT 192.168.10.190:/etc/httpd/conf.d/ssl/

In addition, the CA's own certificate files are also copied to the Web server

SCP Cacert.pem 192.168.10.190:/etc/httpd/conf.d/ssl/

At this point there are 4 files in the/etc/httpd/conf.d/ssl directory on the Web server

(3) to do an encrypted web site, self-signed certificate, just install a module mod_ssl can

1.yum Install Mod_ssl

Install this module, will generate/etc/httpd/conf.d/ssl.conf this configuration file, next to configure this configuration file

2. In the/etc/httpd/conf.d/ssl.conf configuration file, specify the new certificate path, the private key file, and the certificate path of the parent CA certificate

Vim/etc/httpd/conf.d/ssl.conf

After the configuration is complete, then restart the httpd service

Service httpd Restart

Ss-ntl See if there are 443 ports

(4) do a simple web interface under/var/www/html to access

(5) in the WinDOS above to do domain name resolution, C:\Windows\System32\drivers\etc\hosts

(6) Use HTTPS to access the website, install the certificate

Direct access will have alarm errors appearing

Click Certificate Error

Click View Certificate, go to the certificate path, locate the certificate path of the parent CA, and then install the certificate

Then go to use HTTPS to access the site, there will be no error

Build your own CA issued certificate to do HTTPS encrypted Web site