Configuring HTTPD to support HTTPS

1. First create a private CA for 192.168.108.159

#cd/etc/pki/ca

# (Umask 077;openssl genrsa-out PRIVATE/CAKEY.PEM 2048)

#ls private/

#touch Index.txt

#echo Index.txt

2. Create a self-signed certificate on the server

#openssl Req-new-x509-key private/cakey.pem-out cacert.pem-days 7300

3. Generate a Certificate signing request on the Web server, on the 192.168.108.160 virtual machine

#cd/etc/httpd

#mkdir SSL

#cd ssl/

# (Umask 077;openssl genrsa-out httpd.key 1024)//Generate key

# OpenSSL Req-new-key httpd.key-out HTTPD.CSR//Generate Certificate signing request

#scp HTTPD.CSR [Email protected]:/tmp///Put HTTPD.CSR in the TMP directory of the server 192.168.108.159

4, on the server for the Wei server CA visa

#cd/etc/pki/ca

#openssl ca-in/tmp/httpd.csr-out certs/web1.magedu.com.crt-days 356

#ls newcerts/In this directory has 01.PEM

#ls certs/

#scp certs/web1.magedu.com.crt [Email protected]:/etc/httpd/ssl/

Next start configuring the HTTPD service to support HTTPS

#httpd-M | grep SSL//View 160 host that is HTTPD server support Mod_ssl

#yum Install mod_ssl//If it does not exist

#rpm-QL Mod_ssl

/etc/httpd/conf.d/ssl.conf//Master configuration file
/usr/lib64/httpd/modules/mod_ssl.so
/var/cache/mod_ssl
/var/cache/mod_ssl/scache.dir
/var/cache/mod_ssl/scache.pag
/var/cache/mod_ssl/scache.sem

#cd/etc/httpd/conf.d/

#cp ssl.conf{,.bak}//should make a backup before modifying the configuration file

#vim/etc/httpd/conf.d/ssl.conf

Modify <virtualhost _default_:443> to <virtualhost *:443>

DocumentRoot "/var/www/html"//need to be turned on and respond to changes, such as/vhosts/web1/htdocs
ServerName www.example.com:443//server name is web1.magedu.com

Sslengine on this must be turned on

Modify SSLCERTIFICATEFILE/ETC/PKI/TLS/CERTS/LOCALHOST.CRT to sslcertificatefile/etc/httpd/ssl/web1.magedu.com.crt// This file is the certificate file that the current HTTPD service takes to authenticate to other clients

Modify the Sslcertificatekeyfile/etc/pki/tls/private/localhost.key to match the above private key file sslcertificatekeyfile/etc/httpd/ssl/ Httpd.key

Client certificates should not be validated because most clients do not have certificates

#ss-TNL//Check to see if 443 ports are listening

The test is based on HTTPS access to the appropriate host;

# OpenSSL s_client [-connect host:port] [-cert filename] [-capath directory] [-cafile filename]

#openssl S_client-connect 192.168.108.160:443-cafile/etc/pki/ca/cacert.pem

get/http/1.1

Host:web1.magedu.com Enter two times, you can see the requested page

Configuring HTTPD to support HTTPS