Linux https SSL認證執行個體

前提： 必須先在Linux下安裝apache 服務 (yum install httpd)

1.查看並安裝SSL （安裝包的名字是mod_ssl）

 

[root@localhost ~]# rpm -qi motd_ssl
package motd_ssl is not installed

[root@localhost yum.repos.d]# yum install mod_ssl
Loaded plugins: rhnplugin, security
This system is not registered with RHN.
RHN support will be disabled.
Setting up Install Process
Resolving Dependencies
--> Running transaction check
---> Package mod_ssl.i386 1:2.2.3-31.el5 set to be updated
--> Finished Dependency Resolution

Dependencies Resolved

=============================================================
Package Arch Version Repository Size
===========================================================
Installing:
mod_ssl i386 1:2.2.3-31.el5 file 88 k

Transaction Summary
================================================

Install 1 Package(s)
Update 0 Package(s)
Remove 0 Package(s)

Total download size: 88 k
Is this ok [y/N]: y
Downloading Packages:
Running rpm_check_debug
Running Transaction Test
Finished Transaction Test
Transaction Test Succeeded
Running Transaction
Installing : mod_ssl 1/1

Installed:
mod_ssl.i386 1:2.2.3-31.el5

Complete!

2.手動建立密鑰和認證
[root@localhost yum.repos.d]# cd /etc/pki/tls/certs/
[root@localhost certs]# pwd
/etc/pki/tls/certs

[root@localhost certs]# make auth.key (建立一個名為auth的SSL私密金鑰）
umask 77 ;
/usr/bin/openssl genrsa -des3 1024 > auth.key
Generating RSA private key, 1024 bit long modulus
.....................................++++++
............................++++++
e is 65537 (0x10001)
Enter pass phrase:
Verifying - Enter pass phrase:

[root@localhost certs]# make auth.crt (建立一個名為auth的認證）
umask 77 ;
/usr/bin/openssl req -new -key auth.key -x509 -days 365 -out auth.crt -set_serial 0
Enter pass phrase for auth.key: (輸入剛才的私密金鑰密碼）
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ., the field will be left blank.
-----
Country Name (2 letter code) [GB]:CN (國家）
State or Province Name (full name) [Berkshire]:liaoning （地區）
Locality Name (eg, city) [Newbury]:dalian (城市）
Organization Name (eg, company) [My Company Ltd]:IBM （組織機構名）
Organizational Unit Name (eg, section) []:IBM （全名）
Common Name (eg, your name or your servers hostname) []:WWW.IBM.COM （公用名稱）
Email Address []: （郵箱）

3.修改設定檔 www.linuxidc.com
[root@localhost certs]# cp auth.key /etc/pki/tls/private/ （私密金鑰匯入）
[root@localhost certs]# vi /etc/httpd/conf.d/ssl.conf
修改112、 119行：

SSLCertificateFile /etc/pki/tls/certs/localhost.crt
====》SSLCertificateFile /etc/pki/tls/certs/auth.crt
SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
====》SSLCertificateKeyFile /etc/pki/tls/private/auth.key
4.重啟apache服務
[root@localhost certs]# service httpd restart
停止httpd: [失敗]
啟動httpd：Apache/2.2.3 mod_ssl/2.2.3 (Pass Phrase Dialog)
Some of your private key files are encrypted for security reasons.

 

In order to read them you have to provide the pass phrases.

Server localhost.localdomain:443 (RSA)
Enter pass phrase: (輸入私密金鑰密碼）

OK: Pass Phrase Dialog successful.
[確定]

[root@localhost certs]# netstat -tunal |grep 443
tcp 0 0 :::443 :::* LISTEN

（監聽外部所有連接埠 到原生443連接埠正常 說明啟動成功）

4.訪問並測試網頁 （https:// 172.18.4.88)

1.增加安全例外，查看認證 (我們發現憑證授權單位已經變成了IBM）
 2.開啟測試頁，預設網頁正常顯示

 

注意： 如果有認證設定的話，下次開機自動啟動APACHE服務時，會提示你輸入密碼。否則會一直停留在服務啟動介面。所以實驗完成後，最好將ssl.conf 修改成原來預設的localhost

以上