OpenSSL-based HTTPS service configuration

1, Installation Mod_ssl

2. Create a CA on another machine

Cd/etc/pki/ca

(Umask 077; OpenSSL genrsa-out Private/cakey.pem 2048)

3, the permission to generate the file is 600

4. Vim. /tls/openssl.cnf

5. Find [Req_distinguished_name ]

6. Change the default city to CN

7. Change the default province name Stateorprovincename_default to Hebei

8, the city name Localityname_default changed to Zhengzhou

9, the organization name 0.organizationname_default changed to mageedu

10, department name Organizationalunitname_default =tech

11, generated from the visa book: OpenSSL req-new-x509-key private/cakey.pem-out cacert.pem-days 3655

12. Set the hostname ca.mageedu.com

13, stand in the CA directory vim. /tls/openssl.cnf

14. Edit to find dir =/etc/pki/ca

15, stand on the CA mkdir certs CRL Newcerts

16. Touch Index.txt

17. Echo > Serial

18, back to the server side:

19, cd/etc/httpd/httpd/

20, mkdir SSL;;;CD SSL

21, (Umask 077; OpenSSL genrsa 1024x768 > Httpd.key)

22. OpenSSL Req-new-key httpd.key-out HTTPD.CSR

23, with the information on the CA must be consistent

24, host name: see you to that virtual host with our virtual host defined in the vim/etc/httpd/conf.d/v ...

25. Send the certificate request to the CA station on the SSL directory SCP HTTPD.CSR 192.168.9.250:/tmp

26, go to 9.250 on the server OpenSSL ca-in/tmp/httpd.csr-out/tmp/httpd.crt-days 3650

27, Cd/etc/pki/ca;;;;;cat serial found to be 02

28, we go back to the server, SCP to 9.250 to take an integer

SCP 192.168.9.250:/TMP/HTTPD.CRT./

29, go 9.250 on delete tmp under RM httpd.c*

30, configure the server side: CD/ETC/HTTPD/CON.D;;;  Vim ssl.conf;;; CP ssl.conf ssl.conf.org

31. Go to edit <virtualhost 192.168.9.247:443> below to edit the host name servername hello.magedu.com

32, edit DocumentRoot "/www/magedu.com"

33. Edit Sslcertificatefile/etc/httpd/ssl/httpd.crt to edit the certificate file issued by the CA

34. Edit Sslcertificatekeyfile/etc/httpd/ssl/httpd,key Define private key File Save

35. Httpd-t Restart

36, because there is no regular CA authorization, so we have to modify the host file locally so that he can identify hello.magedu.com

37. Enter https://hello.magedu.com in the address bar

38. Found untrusted certificate We need to go back to 9.250 on/etc/pki/ca/download Cacert.pem to physical host

39, change CACERT.PEM to CACERT.CRT dual machine can install certificate import browser. Put to a trusted certification authority

40, remember that an address can only establish an SSL host

OpenSSL-based HTTPS service configuration