Enable https for CentOS web services

Httpshttps: HypertextTransferProtocolSecure

Https

Https: Hypertext Transfer Protocol Secure created an https

Https is the http that uses the ssl/tls protocol for communication # The current version of SSL/TLS # SSL: Secure Socket Layer v3 # TLS: the importance of SSL/TLS for Transport Layer Security v1 # (1) all information is encrypted and cannot be eavesdropped by a third party. # (2) the verification mechanism is in place. once tampered with, both parties will immediately discover the communication. # (3) provide an ID card to prevent your identity from being impersonated.

 

Differences between https and http

Http text protocol tcp: Port 80 application layer https binary protocol tcp: port 443 transport layer

 

(1) http transaction and encrypted https transaction

 

 

(2) Introduction to important concepts

SSL session

What to do with the ssl Handshake: Select the version number of the exchange protocol, but both parties support the encryption method to implement the authentication key exchange between the two ends. note: The SSL session is based on the IP address: it cannot be implemented on an FQDN-based virtual host.

 

X509.3 certificate format

Certificate format version number certificate serial number Certificate Signature algorithm certificate issuer validity period Holder's Name Holder's public key ca id holder's ID other extended information basic constraints certificate policy Key Usage restrictions CA signature

PKI (Public Key Infrastructure)

 

Client entity (applicant) registration institution (RC) visa institution (CA) --> Visa institution (CA) certificate revocation list (CRL) publishing institution certificate access library

 

Client-side server certificate verification

Date Check: whether the certificate is within the validity period the reliability of the certificate issuer: Certificate Signature check: identity check of the holder:

 

 

 

 

Server configuration https

 

(1) make sure that the mod_ssl module is loaded

If this module is not loaded, # yum-y install mod_ssl *

 

(2) self-built server CA (self-built CA issuer)

Create the private key of the server

 

# Cd/etc/pki/CA enter the CA Directory # (umask 077; openssl genrsa 2048> private/cakey. pem) create the server private key

Server self-generated CA certificate

 

# Openssl req-new-x509-key/private/cakey. pem-out cacert. pem-days 3655

 

Create index.txt (index file database) and serial (visa number)

 

# Touch index.txt serial crlnumber # echo 01> serial

 

(3) apply for a CA on the client. We also use the server as the client.

1. Generate the client's own private key httpd. key

# Cd/etc/httpd # (umask 077; openssl genrsa 1024> httpd. key)

2. the client generates a certificate signing request for httpd. csr.

# Cd/etc/httpd # openssl req-new-key httpd. key-out httpd. csr

 

3. the server signs a certificate to the client to generate httpd. crt

# Openssl ca-in httpd. csr-out httpd. crt-days 3665

4. View keys and certificates

(4) edit the configuration file

1. open the extended configuration file and the mod_socache module.

# Vim/etc/httpd. conf

2. edit/etc/httpd/extra/httpd-ssl.conf

Set Client certificate and key path

Set ssl-based virtual hosts

3. restart the httpd service.

# Httpd-t test whether the configuration file is incorrect # service httpd restart

 

 

(5) client test

Https://www.a.com: 443

Client import CA certificate

 

# Copy the CA certificate/etc/pki/CA/cacert. pem to window and change it to cacert. crt. install this certificate

Client retest

Https://www.a.com: 443

 

 

 

(6) view certificate information

 

(7) linux client testing

 

# Openssl s_client-quiet-connect 172.16.251.183: 443-CAfile/etc/pki/CA/cacert. pem

 

Defective. please point it out in time ~

This article from the "wind thin pig" blog, please be sure to keep this source http://jungege.blog.51cto.com/4102814/1393008