Building HTTPS services based on OpenSSL

A variety of application layer protocols, such as HTTP,FTP,SMTP, are clear-text protocols, which are indispensable in Internet communications, and sometimes security is particularly important, such as online shopping, so the emergence of SSL/TLS technology, and now to implement the following SSL-based HTTPS services

2. See if the Mod_ssl module is installed on the current HTTPD server

   Httpd-m

   Generally when the use of RPM package installation, the module will not be installed, when compiling and installing httpd, in the./configure--enable-ssl Compile the module

4. If you install Mod_ssl by using RPM alone, you can see the files generated by installing this module

   650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M01/74/B0/wKiom1YmCDyTVPt7AACai68o0n0277.jpg "title="] Ks1bjbj]b2vn]s}iv2nc4q.png "alt=" Wkiom1ymcdytvpt7aacai68o0n0277.jpg "/>

   First, a ssl.conf is generated in the/ETC/HTTPD/CONF.D directory, which is the configuration file for configuring SSL, and a dynamic load module is generated to implement the feature.

6. Use another virtual machine to create a private CA (the process will not repeat), local switch to the/ETC/HTTPD directory to create an SSL directory for your own private key, as well as the certificate signed by the CA 650) this.width=650; "src=" http:/ S3.51cto.com/wyfs02/m02/74/ac/wkiol1ymcbitotj5aailhyxy9zm870.jpg "title=" 9cy29) 3H128MK5@KS}QNWUW.png "alt=" Wkiol1ymcbitotj5aailhyxy9zm870.jpg "/>

   As you can see, the private key has been created, and a signature request has been generated APACHE.CSR, we assume that the CA has been signed and the certificate of the person is stored in that directory, named Apache.crt

   The session setup for HTTPS differs from HTTP because the HTTPS session is to establish an SSL session after the TCP three handshake, because the SSL session is based on an IP address, so there can only be one HTTPS service on top of the single IP address, if a domain-based virtual host is used, Then there is only one, and the hostname should be specified when generating the certificate signing request

8. Edit/etc/httpd/conf.d/ssl.conf File

   Special attention is required in this document:

   <virtualhost _default_:443> This should be modified to give us the hostname of the HTTPS service, for example

   <virtualhost www.abc.com:443>

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M01/74/AC/wKioL1YmC6zxMZuzAAA0wS3q0Pc446.jpg "title=" G (@ Gzna ' {v6k8 ' $2n ' [0ce.png ' alt= ' wkiol1ymc6zxmzuzaaa0ws3q0pc446.jpg '/>

Enable these two items, documentroot, should be consistent with using HTTP to access the same site

ServerName, defining host names

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M02/74/AC/wKioL1YmDEGAqGvWAAA4mn0B5pg231.jpg "title=" MSGVSO %0rmd8np}nqj3r7ns.png "alt=" Wkiol1ymdegaqgvwaaa4mn0b5pg231.jpg "/>

Note that theerror log definition for HTTPS is consistent with HTTP, the access log is used with the Transferlog directive, and then defines the access log format when the Customlog definition is still used

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M00/74/B0/wKiom1YmDK_S0GLlAAAzfhri7f0300.jpg "title=" Q29hat ]rmkykpuqr0p{%ywq.png "alt=" Wkiom1ymdk_s0gllaaazfhri7f0300.jpg "/>

To use the SSL feature, the Sslengine must be on

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M01/74/B0/wKiom1YmDPSCU1uUAAEDboLxPkw917.jpg "title=" F{]w_ EB9G%HR (xt76_mo8sf.png "alt=" Wkiom1ymdpscu1uuaaedbolxpkw917.jpg "/>

Modify the path of the certificate and the private key file to be in use, typically placed in the configuration file directory of the service, for example, here is the two files in the/etc/httpd/ssl directory

Also note the Directory Access configuration <directory> in the master configuration file when using HTTP to access the host, and if you are only providing an HTTPS service, you can define it directly in the file.

Start the httpd service to see if port 443 is listening, and you can import the CA self-signed certificate into the browser for testing.

This article is from the "Zxcvbnm Xuan ye" blog, please be sure to keep this source http://10764546.blog.51cto.com/10754546/1704634

Building HTTPS services based on OpenSSL