Using OpenSSL to issue Apache certificates under Linux

1 Installing OpenSSL

#yum install -y openssl

2 Entering the catalogue/etc/pki/tls/certs

#cd /etc/pki/tls/certs

3. Generate a private key file (key)

#openssl genrsa -des3 -out server.key 1024

4. To avoid the need to enter a certificate password each time the service starts, remove the certificate password

#openssl rsa -in server.key -out server.key

5. Generate a certificate with Server.key

#openssl req -new -key server.key -out server.csr#这时候会提示以下信息：Country Name (2 letter code) [XX]:CN  State or Province Name (full name) []:BeijingLocality Name (eg, city) [Default City]:BeijingOrganization Name (eg, company) [Default Company Ltd]:NoOrganizational Unit Name (eg, section) []:NewCommon Name (eg, your name or your server‘s hostname) []:NoEmail Address []:[email protected]Please enter the following ‘extra‘ attributesto be sent with your certificate requestA challenge password []:#如果直接回车An optional company name []:#这里直接回车

6. Generate the CA's key file Ca.key and root certificate ca.crt

openssl req -new -x509 -keyout ca.key -out ca.crt#提示信息和第5步骤类似。

7. Sign the SERVER.CSR certificate with the CA certificate

#为了防止报错，需要提前做一些准备工作#touch /etc/pki/CA/index.txt#echo 01 > /etc/pki/CA/serial#openssl ca -in server.csr -out server.crt -cert ca.crt -keyfile ca.key -config ../openssl.cnf#这是会提示以下信息Sign the certificate? [y/n]:y#选择y1 out of 1 certificate requests certified, commit? [y/n]y#选择y

8. This time will get ca.crt,ca.key,server.crt,server.csr,server.key.
9. Send the Ca.crt,server.crt,server.key to the Apache configuration directory. Mine is/usr/local/apache/conf/ssl/.
10. Hey Apache's vhost directory is used

#进入配置目录，#cd /usr/local/apache/conf#vi httpd.confIncludeOptional conf/vhost/*.conf #去掉注释，如果没有则新增#进入vhost目录#cd /usr/local/apache/conf/vhost#创建一个新的配置文件，名称自己定义，以.conf为后缀#vi httpd-vhost-ssl.conf<VirtualHost *:443>ServerAdmin 随便输入的邮箱地址php_admin_value open_basedir "/home/www/:/tmp/:/var/tmp/:/proc/"DocumentRoot /home/wwwServerName 域名:443ErrorLog "/home/wwwlogs/error_log"CustomLog "/home/wwwlogs/access_log" combinedSSLEngine onSSLCertificateFile /usr/local/apache/conf/ssl/server.crt#证书的路径SSLCertificateKeyFile /usr/local/apache/conf/ssl/server.key#证书的路径#SSLCertificateChainFile /usr/local/apache/conf/ssl/ca.crt#证书的路径Protocols h2 h2c http/1.1<Directory "/home/www/">    SetOutputFilter DEFLATE    Options FollowSymLinks    AllowOverride All    Order allow,deny    Allow from all    DirectoryIndex index.php index.html</Directory></VirtualHost>

Using OpenSSL to issue Apache certificates under Linux