HTTPD-based HTTPS

Server	Ip	Version
Ca	192.168.0.100/ca.abc.com	CentOS7
httpd	192.168.0.110/www.abc.com	CentOS6.7

1. Request a digital certificate for the HTTPD server

1.1 Creating a private CA (CA server)

~]# cd/etc/pki/ca/

ca]# (umask 077;openssl genrsa-out PRIVATE/CAKEY.PEM 2048) (Create private CA)

650) this.width=650; "src=" http://s4.51cto.com/wyfs02/M02/7F/38/wKioL1cXMDShBw15AAFaNQ4ixSY561.jpg "title=" 1.jpg " alt= "Wkiol1cxmdshbw15aafanq4ixsy561.jpg"/>

ca]# OpenSSL Req-new-x509-key private/cakey.pem-out cacert.pem-days 7300 (generated from the visa book, Ctrl+backspace can be modified)

From the visa form to fill in: CN, Jiangsu, City, Company, Ops, ca.abc.com, mailbox (can be omitted)

ca]# Touch Index.txt

ca]# echo > Serial

1.2 Creating a Certificate Signing Request (HTTPD server)

Create SSL in the/etc/httpd/directory and enter SSL

ssl]# (umask 077;openssl genrsa-out httpd.key 1024) (Generate private key)

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M02/7F/38/wKioL1cXMo7Ruxq2AAEQhbF9naI142.jpg "title=" 2.jpg " alt= "Wkiol1cxmo7ruxq2aaeqhbf9nai142.jpg"/>

ssl]# OpenSSL req-new-key httpd.key-out HTTPD.CSR (Create certificate signing request)

Note: the hostname in the request information is www.abc.com and must match the access domain name.

ssl]# SCP HTTPD.CSR ca_serverip:/tmp/(send signing request to CA server)

1.3 CA Visa (CA server)

~]# cd/etc/pki/ca/

ca]# OpenSSL ca-in/tmp/httpd.csr-out Certs/httpd.crt (signing the request certificate sent)

ca]# SCP certs/httpd.crt Httpd_serverip:/etc/httpd/ssl (send certificate to client)

2. Configure the HTTPD server to support SSL and the certificates used

~]# yum-y Install mod_ssl (load module via config file after installation)

~]# vim/etc/httpd/conf.d/ssl.conf

DocumentRoot "/var/www/html" #取消注释, if you need to modify the current path servername www.abc.com:443# uncomment, and modify the domain name sslcertificatefile/etc/httpd/ ssl/httpd.crt# Modify the default specified SSL certificate storage location sslcertificatekeyfile/etc/httpd/ssl/httpd.key# Modify the default specified SSL private key file storage location

650) this.width=650; "src=" http://s4.51cto.com/wyfs02/M01/7F/3B/wKiom1cXNjCQbC1gAAArRE8N8KE046.jpg "title=" 3.jpg " alt= "Wkiom1cxnjcqbc1gaaarre8n8ke046.jpg"/>

Other function annotations (without modification):

Sslengine on #开启SSL功能SSLProtocol all-sslv2 #支持SSL所有协议, but Sslv2sslciphersuite high:medium:!anull:! is not supported md5:! seed:! Idea #支持的SSL加密方式,! indicates no support

~]# httpd-t (test syntax)

~]# Service httpd Restart (change listening port)

because it points to the default path, it supports both HTTP and HTTPS, and if only HTTPS is allowed, turn off listen. However, the client access will generally only access HTTP, so it is not easy to close the 80 port, you need to do URL redirection.

3. Testing the host for HTTPS-based access response

~]# OpenSSL s_client

~]# OpenSSL s_client-connect Www.abc.com:443-CAfile/etc/pki/CA/cacert.pem (verified on CA server)

Other client browsers access HTTPS to import the CACERT.PEM certificate, otherwise an unsecured connection

This article is from the "kim1220" blog, make sure to keep this source http://228984.blog.51cto.com/218984/1765818

HTTPD-based HTTPS