Wamp apache 配置 Https 双向认证全过程

深碍√TFBOYSˉ_ 2022-09-19 10:53 284阅读 0赞

1.我安装的是Wampserver 2.2.11,  d:\\wamp目录  
2.本机操作系统Win7 32位  
  
3.D:\\wamp\\bin\\apache\\Apache2.2.11\\bin  下有  openssl.exe  
4.D:\\wamp\\bin\\apache\\Apache2.2.11\\conf 下有 openssl.cnf  
5.D:\\wamp\\bin\\apache\\Apache2.2.11\\conf\\extra 下有 httpd-ssl.conf  
  
6.本机地址 192.168.111.1  
  
7.wamp apache 开启 mod\_ssl  
  
8.httpd-ssl.conf内容(去除注释后)  
Listen 443

AddType application/x-x509-ca-cert .crt

AddType application/x-pkcs7-crl    .crl

SSLPassPhraseDialog  builtin

SSLSessionCache        "shmcb:D:/wamp/bin/apache/Apache2.2.11/logs/ssl\_scache(512000)"

SSLSessionCacheTimeout  300

SSLMutex default

DocumentRoot "D:\\wamp\\www"

ServerName 192.168.111.1:443

ServerAdmin me@localhost

ErrorLog "D:/wamp/bin/apache/Apache2.2.11/logs/error.log"

TransferLog "D:/wamp/bin/apache/Apache2.2.11/logs/access.log"

SSLEngine on

SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL

SSLCertificateFile "D:/wamp/bin/apache/Apache2.2.11/bin/server.crt"

SSLCertificateKeyFile "D:/wamp/bin/apache/Apache2.2.11/bin/server.key"

SSLCertificateChainFile "D:/wamp/bin/apache/Apache2.2.11/bin/root.key"

SSLCACertificateFile "D:/wamp/bin/apache/Apache2.2.11/bin/root.crt"

SSLVerifyClient require

SSLVerifyDepth  10

SSLOptions +StdEnvVars

</FilesMatch>

SSLOptions +StdEnvVars

</Directory>

BrowserMatch ".\*MSIE.\*" \\

nokeepalive ssl-unclean-shutdown \\

downgrade-1.0 force-response-1.0

CustomLog "D:/wamp/bin/apache/Apache2.2.11/logs/ssl\_request.log" \\

"%t %h %\{SSL\_PROTOCOL\}x %\{SSL\_CIPHER\}x \\"%r\\" %b"

</VirtualHost>                                    
以上主要注意  
  a.路径问题  
  b.ServerName 这个要注意,一定是本机地址或域名,另外在命令行时,也要多次用到  
  c.如果是单向认证,34行的值修改成 none 同时把所有 client 字样的行注释掉即可(用\#)  
   
8.根证书用 root 表示 , 服务端证书 server , 客户端证书 client  
  
9.openssl.cnf 内容(去除注释后)(只贴出有可能修改过的地方)  
  dir        = ./ca        \# Where everything is kept  
certs        = $dir/certs        \# Where the issued certs are kept  
crl\_dir        = $dir/crl        \# Where the issued crl are kept  
database    = $dir/index.txt    \# database index file.  
                    \# several ctificates with same subject.  
new\_certs\_dir    = $dir/newcerts        \# default place for new certs.  
  
certificate    = $dir/cacert.pem     \# The CA certificate  
serial        = $dir/serial         \# The current serial number  
crlnumber    = $dir/crlnumber    \# the current crl number  
                    \# must be commented out to leave a V1 CRL  
crl        = $dir/crl.pem         \# The current CRL  
private\_key    = $dir/private/cakey.pem\# The private key  
RANDFILE    = $dir/private/.rand    \# private random number file  
  
以上要建立几个目录,bin/ca/, bin/ca/newcerts/,bin/ca/private/     也不知道是否都用上了,反正有这些足够了.  
还要建立几个文件  
  a. bin/ca/index.txt  一个0字节的空文件  
  b.bin/ca/serial  (注意 无后缀),内容写 2个(0-9,A-F)的字符即可,随意.  
  
10.下面说操作了,   
   进入命令行,进入 D:\\wamp\\bin\\apache\\Apache2.2.11\\bin    这个目录,反正我是在这里操作的.  
   set OPENSSL\_CONF=../conf/openssl.cnf              这是指明配置文件的  
   openssl genrsa >root.key                 生成根密钥(未加保护密码)(openssl genrsa -des3 -out root.key 1024  这个是加保护密码的命令)  我以下都没加保护密码  
   openssl genrsa >server.key       生成服务端密钥  
   openssl genrsa >client.key    生成客户端密钥

openssl req -x509 -new -key root.key >root.crt      生成自签名的根证书 (CRT即PEM格式)

openssl req -new -key server.key -out server.csr     生成服务端签名请求文件CSR

openssl req -new -key client.key -out client.csr   生成客户端签名请求文件

以上如果要求输入一些信息,注意   domain 处,必须是本机域名或IP地址 ,我是写的 192.168.111.1 (我本机IP)

使用根证书为服务端及客户端签名

openssl ca -in server.csr -cert root.crt -keyfile root.key -out server.crt

openssl ca -in client.csr -cert root.crt -keyfile root.key -out client.crt

客户端证书转换成PFX格式

openssl pkcs12 -export -clcerts -in client.crt -inkey client.key -out client.pfx

把root.crt client.pfx 复制到客户机(随便哪台电脑了)  
  双击导入  ( root 导入到 可信任的根证书签发机构,client导入到个人/您的证书)  
   
  重启服务器Apache OVER

以上可能有所遗漏,可参考我的前几篇博客,那些是我参考过的文章.  
  
  如果实在不行,QQ我:31008088

Normal 0 7.8 磅 0 2 false false false EN-US ZH-CN X-NONE /\* Style Definitions \*/ table.MsoNormalTable \{mso-style-name:普通表格; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-priority:99; mso-style-parent:""; mso-padding-alt:0cm 5.4pt 0cm 5.4pt; mso-para-margin:0cm; mso-para-margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:10.5pt; mso-bidi-font-size:11.0pt; font-family:"Calibri","sans-serif"; mso-ascii-font-family:Calibri; mso-ascii-theme-font:minor-latin; mso-hansi-font-family:Calibri; mso-hansi-theme-font:minor-latin; mso-bidi-font-family:"Times New Roman"; mso-bidi-theme-font:minor-bidi; mso-font-kerning:1.0pt;\}

阅读(451) | 评论(0) | 转发(0) |

上一篇：\[转\]Linux Apache Https 配置

下一篇：JS 文件上传 前端验证 后缀及大小