OpenSSL配置Apache的https功能

標籤：https   ssl   

https:會話建立過程
1.用戶端和伺服器端先三向交握
2.用戶端發起請求，請求伺服器端的443連接埠。
3.雙方協商建立ssl會話
4.協商完成後，伺服器發送自己的認證給用戶端。
5.用戶端拿到認證後，查看認證是不是受信任憑證授權單位頒發的，和驗證認證是不是完整的。
6.用戶端傳遞加密後的對稱密碼給伺服器端。
串連建立完成

CA給用戶端頒發認證過程
1.建立CA
   自己產生一對密鑰
   產生自我簽署憑證
2.用戶端
    產生一對密鑰
    產生憑證發行請求，.csr
    將請求發給CA
3.CA端
     簽署此認證
     傳送給用戶端

注意：SSL僅能基於Ip地址進行，如果有多個虛擬機器主機的話，那麼只能給其中一個加密

實驗部分

查看httpd模組，確保有ssl，如果沒有就手動安裝
[[email protected] ~]# httpd -M
ssl_module
查看ssl產生的檔案
[[email protected] ~]# rpm -ql mod_ssl
/etc/httpd/conf.d/ssl.conf          #ssl主設定檔
/usr/lib/httpd/modules/mod_ssl.so   #安裝了一個ssl模組
/var/cache/mod_ssl                  #ssl緩衝目錄

建立私人憑證授權單位
產生Ca的私密金鑰
[[email protected] ~]# cd /etc/pki/CA/
[[email protected] CA]# (umask 077; openssl genrsa -out private/cakey.pem 2048)   
Generating RSA private key, 2048 bit long modulus
.....................................+++
.........................+++
e is 65537 (0x10001)
[[email protected] CA]#


使用私密金鑰生產自我簽署憑證
[[email protected] CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.‘, the field will be left blank.
-----
Country Name (2 letter code) [GB]:CN               #設定國家名稱
State or Province Name (full name) [Berkshire]:HB  #設定省份名稱
Locality Name (eg, city) [Newbury]:SJG             #設定市名稱
Organization Name (eg, company) [My Company Ltd]:BENET   #設定組織名稱
Organizational Unit Name (eg, section) []:LB       #設定部門名稱
Common Name (eg, your name or your server‘s hostname) []:www.benet.com     #設定主機名稱需要與頒發的主機名稱一直，不然會報認證不信任
Email Address []:[email protected]  #設定電子郵件地址



編輯設定檔***的存放位置
[[email protected] ~]# vim /etc/pki/tls/openssl.cnf
dir             = /etc/pki/CA


準備三個目錄,憑證發行目錄（certs），憑證撤銷（crl），剛產生的認證（newcerts）和頒發認證的序號檔案index.txt並且寫入第一個認證序號為01
[[email protected] CA]# mkdir certs crl newcerts
[[email protected] CA]# touch index.txt
[[email protected] CA]# echo 01 > serial


這個時候CA就可以用了

web伺服器配置
準備一個目錄存放認證
[[email protected] CA]# cd /etc/httpd/
[[email protected] httpd]# mkdir ssl
[[email protected] httpd]# cd ssl/


產生web的私密金鑰認證
[[email protected] ssl]# (umask 077;openssl genrsa 1024 > httpd.key)
Generating RSA private key, 1024 bit long modulus
............++++++
..........................++++++
e is 65537 (0x10001)

產生認證簽署請求
[[email protected] ssl]# openssl req -new -key httpd.key -out httpd.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.‘, the field will be left blank.
-----
Country Name (2 letter code) [GB]:CN
State or Province Name (full name) [Berkshire]:HB
Locality Name (eg, city) [Newbury]:SJZ
Organization Name (eg, company) [My Company Ltd]:BENET
Organizational Unit Name (eg, section) []:LB
Common Name (eg, your name or your server‘s hostname) []:www.benet.com  #和網站的網域名稱必須保持完全一致
Email Address []:[email protected]

Please enter the following ‘extra‘ attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:


CA伺服器簽署web伺服器的認證
[[email protected] ~]# openssl ca -in /etc/httpd/ssl/httpd.csr -out /etc/httpd/ssl/httpd.crt -days 365    
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Nov 26 10:42:56 2014 GMT
            Not After : Nov 26 10:42:56 2015 GMT
        Subject:
            countryName               = CN
            stateOrProvinceName       = HB
            organizationName          = BENET
            organizationalUnitName    = LB
            commonName                = www.benet.com
            emailAddress              = [email protected]
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            Netscape Comment:
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier:
                35:F3:EE:62:1F:64:D5:06:DB:5C:60:77:0B:19:33:C2:6A:8B:2D:B4
            X509v3 Authority Key Identifier:
                keyid:57:72:4C:91:1C:9B:F2:B0:E8:4A:E1:34:AB:03:E6:E6:31:2A:1D:C3

Certificate is to be certified until Nov 26 10:42:56 2015 GMT (365 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated


查看頒發情況
[[email protected] CA]# cat index.txt
V       151126104256Z           01      unknown /C=CN/ST=HB/O=BENET/OU=LB/CN=www.benet.com/[email protected]
查看下一個請求給的序號
[[email protected] CA]# cat serial
02


認證申請完畢

用戶端配置ssl
配置之前先備份設定檔
[[email protected] ssl]# cd /etc/httpd/conf.d/
[[email protected] conf.d]# cp ssl.conf ssl.conf.bak

編輯ssl設定檔，除了列出的需要設定，其他統統不管
<VirtualHost 192.168.0.108:443>
ServerName www.benet.com  #設定網站網域名稱
DocumentRoot "/www/benet.com"  #設定網站存放位置
ErrorLog logs/ssl_error_log   #設定網站錯誤記錄檔
TransferLog logs/ssl_access_log #設定網站訪問日誌
LogLevel warn  #設定警告層級
SSLEngine on  #是否開啟ssl功能
SSLProtocol all -SSLv2  #支援的協議為，不支援sslv2，然後支援所有
SSLCertificateFile /etc/httpd/ssl/httpd.crt #設定認證檔案位置
SSLCertificateKeyFile /etc/httpd/ssl/httpd.key #設定私密金鑰檔案位置
</VirtualHost>


編輯完成之後重新啟動httpd服務，然後查看443連接埠已經啟動了
[[email protected] conf.d]# service httpd restart
[[email protected] conf.d]# netstat -tnlp          
tcp        0      0 :::443                      :::*                        LISTEN      6436/httpd  



這時用戶端訪問www.benet.com的443連接埠還是會報錯，這時因為用戶端不信任CA頒發機構
需要將/etc/pki/CA/cacert.pem檔案複製到用戶端

並且用戶端改名為cacert.crt，然後安裝認證，並且放到根頒發機構

650) this.width=650;" src="http://s3.51cto.com/wyfs02/M00/54/10/wKiom1R200Hz0h17AAFlzMRoEqs724.jpg" style="float:none;" title="安裝認證.png" alt="wKiom1R200Hz0h17AAFlzMRoEqs724.jpg" />

這時用戶端在訪問就不會報錯了，而且訪問全部是加密的訪問了
650) this.width=650;" src="http://s3.51cto.com/wyfs02/M01/54/0F/wKioL1R20-SQFi2XAACGRxskrQo991.jpg" title="https訪問成功.png" alt="wKioL1R20-SQFi2XAACGRxskrQo991.jpg" />

本文出自 “梅花香自苦寒來” 部落格，請務必保留此出處http://wangjunkang.blog.51cto.com/8809812/1583306

OpenSSL配置Apache的https功能