HTTPS Simple configuration

SSL Session Process

(1) the client sends an alternative encryption method and requests a certificate from the server

(2) the server-side sends the certificate and the selected encryption method to the client

(3) the client obtains the certificate and verifies the certificate;

If the new CA is issued a certificate;

(a) verifying the legality of the source of the certificate; decrypt the digital signature on the certificate with the Ca's public key;

(b) verifying the legality of the contents of the certificate;

(c) Check the validity period of the certificate and whether it expires;

(d) Check whether the certificate has been revoked;

(e) the name of the owner of the certificate, consistent with the target host of the visit;

(4) the client generates a temporary session key (symmetric Key) and uses the Server-side public key to encrypt the data sent to the server to complete the key exchange;

(5) The server uses this key to encrypt the resource requested by the user and responds to the client;

It is important to note that SSL sessions are created based on IP addresses, so only one HTTPS virtual host can be used on a single IP host;

Configuration Process:

(1) apply for a digital certificate for the server; generally we use private build CA to send certificate

(a) Create a private CA on 172.16.20.244

1, Production key pair, Create a private key, the public key does not need to process

[[email protected] ca]# (umask 077;openssl genrsa-out Private/cakey.pem 2048) generating RSA private key, 2048 bit long mo Dulus..........+++..............+++e is 65537 (0x10001) [[email protected] ca]#

2. Generate self-signed Certificate

[[email protected] ca]# openssl req -new -x509 -key private/cakey.pem  -out cacert.pem -days 3655you are about to be asked to  enter information that will be incorporatedinto your certificate  request. what you are about to enter is what is called a  Distinguished name or a dn. there are quite a few fields but you can leave some  blankfor some fields there will be a default value,if you  enter  '. ',  the field will be left blank.-----country name  (2  letter code)  [xx]:cn            //   Here you need to enter information about the certificate, Note that state or province name  (full name) &NBsp []:beijing   //  the information entered here to generate a certificate request with the HTTP server locality name  (eg, city)  [ The default city]:beijing //  part remains the same because it is privately built caorganization name  (eg, company)  [ default company ltd]:gump ltd organizational unit name  (eg, section)  []:OpsCommon Name  (eg, your name or your server ' S hostname)  []:ca.gump.comEmail Address []:[email protected]  [[email protected]  ca]#

3, before signing the certificate, you need to manually create two files, specific details please refer to the OpenSSL chapter

[[email protected] ca]# touch/etc/pki/ca/index.txt[[email protected] ca]# touch/etc/pki/ca/serial[[email protected] CA ]# Echo >/etc/pki/ca/serial

(2) generate a certificate request on the HTTP server 172.16.20.242

(a) The key is stored in the configuration file directory of the service to which the certificate is applied, the establishment of the HTTPS session and the data transfer process.

[[email protected] ~]# mkdir/etc/httpd/ssl[[email protected] ~]# cd/etc/httpd/ssl[[email protected] ssl]# (umask 077;ope Nssl genrsa-out Httpd.key 1024x768) generating RSA private key, 1024x768 bit long modulus.......++++++..........++++++e is 65537 ( 0x10001) [[email protected] ssl]#

    (b) generate certificate request requests based on key

[[email protected] ssl]# openssl req -new -key httpd.key -out  Httpd.csryou are about to be asked to enter information that  will be incorporatedinto your certificate request. what you are about to enter is what is called a  Distinguished name or a dn. there are quite a few fields but you can leave some  blankfor some fields there will be a default value,if you  enter  '. ',  the field will be left blank.-----country name  (2  letter code)  [XX]:CNState or Province Name  (full name)  []: beijinglocality name  (eg, city)  [Default City]:BeijingOrganization Name  (eg ,  company)  [default company ltd]:gump ltdorganizational unit name  (eg, section)  [] :opscommon name  (eg, your name or your server ' S hostname)  []: web1.gump.comemail address []:[email protected]please enter the following  ' Extra '  attributesto be sent with your certificate requesta challenge  password []:                           //  here the password and name are not necessary to an  optional company name []:                       //  Direct Ignore [[email protected] ssl ]#

As you can see here, both the key and the certificate request are stored in the previously created/etc/httpd/ssl/directory

[[email protected] ssl]# pwd/etc/httpd/ssl[[email protected] ssl]# lshttpd.csr httpd.key[[email protected] ssl]#

(3) send the request for a certificate on the HTTP server 172.16.20.242 to the CA server 172.16.20.244 complete the certificate signing

172.16.20.242:

[[email protected] ssl]# scp httpd.csr [email protected]:/tmp/the  authenticity of host  ' 172.16.20.244  (172.16.20.244) '  can ' T be established. ecdsa key fingerprint is bc:9c:21:b5:a6:4d:ef:b6:f3:00:94:80:b4:7f:18:f5. are you sure you want to continue connecting  (yes/no)?  yesWarning : permanently added  ' 172.16.20.244 '   (ECDSA)  to the list of known  hosts. [email protected] ' s password: httpd.csr                                                                                               100%  696     0.7KB/s   00:00     [[email protected] ssl]#

172.16.20.244:

[[email protected] ca]# openssl ca -in /tmp/httpd.csr -out certs/ Web1.gump.com.crt -days 365using configuration from /etc/pki/tls/openssl.cnfcheck  that the request matches the signaturesignature okcertificate details :        serial number: 1  (0x1)          validity            not  Before: Aug 21 13:20:11 2017 GMT             Not After : Aug 21 13:20:11 2018 GMT         Subject:             countryName                = CN            stateOrProvinceName        = beijing            organizationname           = Gump Ltd             organizationalUnitName    = Ops             commonName                 = web1.gump.com             emailAddress               = [email protected]         x509v3 extensions:            x509v3  Basic constraints:&nBsp;                ca:false             Netscape Comment:                  OpenSSL  generated certificate            x509v3  subject key identifier:                  23:C2:7E:52:B5:AB:E8:A1:06:53:38:7A:39:F0:EB:E3:1C:B3:1F:76             X509v3 Authority Key Identifier:                  keyid:eb:31:34 :c3:c5:7c:e4:bb:ee:c3:7c:11:5e:f1:70:5c:88:e5:87:d8certificate is to be certified  until aug 21 13:20:11 2018 gmt  (365 days) sign the certificate? [y/n]:y1 out of 1  certificate requests certified, commit? [y/n]ywrite out database with  1 new entriesdata base updated[[email protected] ca]#

(4) Transfer the signed certificate WEB1.GUMP.COM.CRT to the HTTP server 172.16.20.242

[[email protected] ca]# scp certs/web1.gump.com.crt [email protected]:/etc/httpd /ssl/the authenticity of host  ' 172.16.20.242  (172.16.20.242) '  can ' t be  established. rsa key fingerprint is 5a:10:33:a2:bf:5b:06:82:25:01:fb:c2:74:93:34:95.are you  sure you want to continue connecting  (yes/no)?  yeswarning: permanently  added  ' 172.16.20.242 '   (RSA)  to the list of known hosts. [email protected] ' s password: web1.gump.com.crt                                                                                      100 % 3858     3.8kb/s   00:00    [[email  protected] ca]#

(5) Installing the SSL module

[email protected] ca]# Yum Install mod_ssl-y

(6) Configuring SSL Files/etc/httpd/conf.d/ssl.conf

You typically need to modify the following configuration items

Documentroot//root path, need to be consistent with root path in httpd.conf

ServerName//server name, requires the same server name as the signed certificate

Sslcertfifcatefile//certificate File storage Directory

Sslcertificatekeyfile//key File storage Directory

If you are applying to a virtual host, you also need to modify the following configuration items

<virtualhost _default_:443>

The default is the IP address of the virtual host, because SSL sessions are created based on IP addresses, so there are multiple addresses that need to fill in the default address

[email protected] ca]# Vim/etc/httpd/conf.d/ssl.confdocumentroot/www/htdocsservername Web1.gump.comsslcertificatefile/etc/httpd/ssl/web1.gump.com.crtsslcertificatekeyfile/etc/httpd/ssl/httpd.key

(7) after the configuration is completed, the HTTP configuration file needs to be reloaded to take effect, and the new SSL module is dynamically loaded without restarting the service to take effect

Test the configuration effect

# OpenSSL s_client [-connect host:port] [-cert filename] [-capath directory] [-cafile filename] target host name Server-side Certificate CA Certificate directory CA certificate file name [[email protected] ca]# OpenSSL s_client-connect 172.16.20.244:443-capath/et C/pki/ca/casert.pem

You can also use the Browser-side test directly, enter in the browser address bar: https://172.16.20.242, If you can successfully access, the configuration is Successful.

Write the more scribbled, if there are missing errors and controversies, welcome everyone's criticism and discussion, thank You.

HTTPS Simple configuration