Configuring an HTTPS server based on Mod_ssl

Lab Notes:

Experimental host 1:192.168.1.11, as a Web server

Experimental host 2:192.168.1.12, the host that signed the certificate as CA

Configuration process:

(1) to apply for a digital certificate for the server; For testing purposes, you need to establish a private CA

1. Create Private Ca

2. Create a certificate signing request on the Web server

3. CA Certificate Signing

(2) Configure httpd to support the use of SSL and certificates used

(3) testing the host for HTTPS -based access

Configuration steps:

on the host:

[[email protected] ~]# cd /etc/pki/ca[[email protected] ca]#  (umask  077;openssl genrsa -out private/cakey.pem2048) generating rsa private key,  2048 bit long modulus ..............................................................................+++........................................ ..........................+++e is 65537  (0x10001) [[Email protected] ca]# openssl  req -new -x509 -key private/cakey.pem -outcacert.pem -days 10000               CN               BJ               BJ               magedu              ops               ca.mageu.com[[email protected] ca]# touch index.txt[[email protected] ca]#  Echo 01 > serial

on One host:

#cd/etc/httpd/#mkdir ssl#cd ssl# (umask077;openssl genrsa-out http.key 1024x768) #openssl Req-new-key http.key-out HTTP.CSR CN BJ BJ mageeduopswww.a.com #scp [Email protected]:/tmp

on the host:

[Email protected] tmp]# cd/tmp/[[email protected] tmp]# opensslca-in http.csr-out http.crt-days 3655[[email protecte D] TMP] #scp http.crt172.16.100.11:/etc/httpd/ssl/

on One host:

#yum  install mod_ssl-y     #rpm  -ql mod_ssl     #vim  /etc/httpd/conf.d/ssl.conf         ...........< virtualhost192.168.1.11:443>       documentroot  "/vhosts/a.com/ Htdocs "       ServerName www.a.com:443          .........         sslcertificatefile/etc/httpd/ Ssl/http.crt         sslcertificatekeyfile/etc/httpd/ssl/http.key          ...........           #httpd –t          #servicehttpd  restart           #ss –tnl                 &nbSP;&NBSP;&NBSP: To see if there are 443 ports ..... 

on the host:

#cd/etc/pki/ca #scpcacert. Pem 172.16.1.11:/tmp

at this point you can enter: https://192.168.1.11 test in the browser ;

In the final step, import the certificate Cacert.pem file from the /tmp directory into the Windows Desktop and change the name to Cacert.crt, and then double-click Install certificate; Now we need to enter in the browser:https://www.a.com can display the Web page information, in windows to change the hosts file:

........ add ..... .....

192.168.1.11 www.a.com

Enter https://ww.a.com againto observe the results

pressure test tool AB Use of:

usage:

#ab [Options] URL

- C : Maximum number of concurrent requests

- N: Total number of requests

- K: Test in a persistent connection mode

Examples of Use:

#cd/vhosts/a.com/htdocs/   #vim  tc.txt       www.a.com   [[email protected]]# ab -n 100 -c 10 http://www.a.com/rc.txtthis  is ApacheBench, Version 2.3< $Revision: 655654 $>copyright 1996  adam twiss, zeus technologyltd, http://www.zeustech.net/licensed to the  apache software foundation,http://www.apache.org/ benchmarking www.a.com  (bepatient) ..... done  server software:        apache/2.2.15server  Hostname:        www.a.comServer Port:             80 Document Path:           /rc.txtDocument Length:         279 bytes concurrency level:      10time taken for tests:    0.042 secondscomplete requests:      100failed requests:         0Write errors:            0Non-2xx responses:      102Total transferred:       46818 bytesHTML transferred:        28458 bytesrequests per second:    2406.68 [#/sec]  (mean) time  per request:       4.155 [ms]  (mean) time per  request:       0.416 [ms]  (mean, across all  concurrentrequests) transfer rate:          1100.35  [kbytes/sec] received connection times  (MS)                min  mean[+/-sd] median   maxConnect:         0   0   0.2      0       1Processing:     0   3    6.0      1     20waiting:         0   2   5.3      1      20total:          1   4    6.0      1     20 percentage  of the requests served within acertain time  (MS)  50%       1 66%      1 75%      2 80%       3 90%     14 95%     20  98%     20 99%     20 100%     20  (Longest request) [[Email protected] htdocs]# ab -n 1000 -c  100http://www.a.com/rc.txtThis is ApacheBench, Version 2.3< $Revision:  655654  $>copyright 1996 adam twiss, zeus technologyltd, http:// www.zeustech.net/Licensed to The Apache Software Foundation,http://www.apache.org/  Benchmarking www.a.com  (be patient) completed 100 requestscompleted 200  requestsCompleted 300 requestsCompleted 400 requestsCompleted 500  Requestscompleted 600 requestscompleted 700 requestscompleted 800 requestscompleted 900 requestscompleted 1000  requestsFinished 1000 requests  Server Software:         Apache/2.2.15Server Hostname:         www.a.comserver port:            80  Document path:          /rc.txtdocument length:         279 bytes Concurrency Level:       100Time taken for tests:   0.228 secondsComplete  requests:      1000failed requests:         0write errors:           0non-2xx  responses:      1005total transferred:      461295 byteshtml  transferred:       280395 bytesrequests per second:     4386.10 [#/sec]  (mean) time per request:        22.799 [ms]  (mean) time per request:        0.228 [ms]  (mean, across all concurrentrequests) transfer rate:           1975.87 [kbytes/sec] received connection times   (MS)               min   mean[+/-sd] median   maxconnect:        0    1   1.3      1       8processing:     8  20   9.9     18      52waiting:        8  20  10.0      18     51total:         10   22  10.2     20     54 percentage  of the requests served within acertain time  (MS)  50%      20 66%     21 75%     22 80 %     22 90%     46 95%      51 98%     53 99%     53 100%     54  (longest request) [[email protected] htdocs]# ab -n  10000 -c 100http://www.a.com/rc.txtthis is apachebench, version 2.3< $Revision: 655654 $> Copyright 1996 adam twiss, zeus technologyltd, http://www.zeustech.net/licensed  to The Apache Software Foundation,http://www.apache.org/ Benchmarking  www.a.com  (be patient) completed 1000 requestscompleted 2000 requestscompleted  3000 requestscompleted 4000 requestscompleted 5000 requestscompleted 6000  requestsCompleted 7000 requestsCompleted 8000 requestsCompleted 9000  Requestscompleted 10000 requestsfinished 10000 requests  server software:         Apache/2.2.15Server Hostname:         www.a.comServer Port:             80 document path:          /rc.txtdocument length:         279 bytes Concurrency Level:       100time taken for tests:   1.303 secondscomplete requests:       10000Failed requests:        0Write  errors:           0non-2xx responses:       10016total transferred:      4597344 byteshtml  transferred:       2794464 bytesrequests per second:     7672.46 [#/sec]  (mean) time per request:        13.034 [ms]  (mean) time per request:        0.130 [ms]  (mean, across all concurrentrequests) transfer rate:           3444.62 [Kbytes/sec] received Connection Times  (MS) &NBSP;&NBSP;&NBSP;&NBSP;&NBSP;&NBSP;&NBSP;&NBSP;&NBSP;&NBSP;&NBSP;&NBSP;&NBSP;&NBSP;MIN&NBSP;&NBSP;MEAN[+/-SD]  median   maxconnect:        0   2    0.7      2      7processing:      6  11   2.3     11      24Waiting:        6  11    2.3     10     24total:           9  13   2.4     12      26 percentage of the requests served within acertain time  (MS)  50%      12 66%     13 75%      13 80%     14 90%     16 95%      18 98%     20 99%     22  100%    26  (Longest request)

Configuring an HTTPS server based on Mod_ssl