Apache和Nginx开启Https

叁歲伎倆 2022-09-29 04:10 180阅读 0赞

**1.安装openssl**

\[root@c6 ~\]\# yum install -y openssl openssl-devel

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_   yum安装方式

http://www.openssl.org/source/   \#下载openssl

\[root@Web\_server src\]\# tar xf openssl-1.0.1s.tar.gz

\[root@Web\_server src\]\# cd openssl-1.0.1s

\[root@Web\_server openssl-1.0.1s\]\# ./config

\[root@Web\_server openssl-1.0.1s\]\# make && make install

\------------------------------------源码安装方式

**安装apache**

\[root@Web\_server src\]\# wget http://mirrors.cnnic.cn/apache/httpd/httpd-2.2.31.tar.gz

\[root@Web\_server src\]\# tar xvf httpd-2.2.31.tar.gz

\[root@Web\_server src\]\#cd httpd-2.2.31

\[root@Web\_server httpd-2.2.31\]\#./configure --prefix=/usr/local/apache2 --with-included-apr --enable-so --enable-deflate=shared --enable-expires=shared --enable-rewrite=shared --with-pcre --enable-ssl=shared \--with-ssl=/usr/local/ssl     \#此处选择动态模式，\--enable-ssl=static --with-ssl=/usr/local/ssl选择静态

\------------------------------------添加扩展模块方式

\[root@Web\_server openssl-1.0.1s\]\# cd /usr/local/src/httpd-2.2.31/modules/ssl   \#务必进入httpd源码目录

\[root@Web\_server ssl\]\# /usr/local/apache2/bin/apxs  -i -c -a -D HAVE\_OPENSSL=1 -I

/usr/lib/openssl/engines/lib -lcrypto -lssl -ldl \*.c

错误一、error "Unrecognized SSL Toolkit!、declaration for parameter 'XXXXXX' but no such parameter

解决：添加-D HAVE\_OPENSSL=1

错误二、undefined symbol: ssl\_cmd\_SSLMutex

解决：apxs编译追加模块成功，但是apache启动失败。出现这个错误后，我把运行apxs时指定mod\_ssl.c改成\*.c 。和添加mod\_deflate不一样，ssl中包含多个源代码文件

错误三、undefined symbol: X509\_INFO\_free

解决：由于静态连接了 openssl的库造成的(默认），解决办法是添加-lcrypto -lssl -ldl参数

2.创建证书

■ 创建私钥

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

\[root@Web\_server modules\]\# cd /usr/local/ssl/bin/

\[root@Web\_server bin\]\# openssl genrsa -out server.key 2048

\[root@Web\_server bin\]\# cp server.key  /usr/local/apache2/conf/ssl.key

■ 生成证书请求（CSR）文件

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

\[root@Web\_server bin\]\# openssl req -new -key server.key -out certreq.csr

Country Name (2 letter code) \[XX\]:cn                 \#所在国家的ISO标准代号，中国为CN

State or Province Name (full name) \[\]:zj            \#单位所在地省/自治区/直辖市

Locality Name (eg, city) \[Default City\]:zs            \#单位所在地的市/县/区

Organization Name (eg, company) \[Default Company Ltd\]:dx      \#单位/机构/企业合法的名称

Organizational Unit Name (eg, section) \[\]:zwy                \#部门名称

Common Name (eg, your name or your server's hostname) \[\]:zwy    \#此项必须与访问提供SSL服务的服务器时所应用的域名完全匹配

Email Address \[\]:       \#邮件地址，不必输入，直接回车跳过

"extra"attributes                        \#以下信息不必输入，回车跳过直到命令执行完毕

\[root@c6 conf\]\#  cp server.key server.key.ori

\[root@c6 conf\]\# openssl rsa -in server.key.ori -out server.key

writing RSA key

\[root@c6 conf\]\#  openssl x509 -req -days 365 -in certreq.csr -signkey server.key -out server.crt

Signature ok

subject=/C=CN/ST=ZJ/L=ZS/O=DX/OU=ZWY/CN=ZWY/emailAddress=szk5043@foxmail.com

Getting Private key

3. Apache配置

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

\[root@Web\_server ~\]\# vim /usr/local/apache2/conf/httpd.conf

**Include conf/extra/httpd-ssl.conf**

\#取消前面注释

\[root@Web\_server ~\]\#  vim /usr/local/apache2/conf/extra/httpd-vhosts.conf

RewriteEngine on

RewriteCond %\{SERVER\_PORT\} !^443$

RewriteRule ^/?(.\*)$ https://%\{SERVER\_NAME\}/$1 \[L,R\]

\#在需要开启的虚拟主机配置文件中，加上http自动重定向为https

\[root@Web\_server ~\]\#  mv /usr/local/apache2/conf/extra/httpd-ssl.conf

/usr/local/apache2/conf/extra/httpd-ssl.conf.bak    \#备份默认配置文件

\[root@Web\_server ~\]\#  > /usr/local/apache2/conf/extra/httpd-ssl.conf

\[root@c6 ~\]\# vim /usr/local/apache2/conf/extra/httpd-ssl.conf

LoadModule ssl\_module modules/mod\_ssl.so

Listen 443

SSLPassPhraseDialog  builtin

SSLSessionCache         shmcb:/var/cache/mod\_ssl/scache(512000)

SSLSessionCacheTimeout  300

SSLMutex default

SSLRandomSeed startup file:/dev/urandom  256

SSLRandomSeed connect builtin

\#SSLCryptoDevice builtin

SSLProtocol all -SSLv2 -SSLv3

SSLHonorCipherOrder on

SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW:!RC4:

DocumentRoot "/data/www"

ServerName www.szk.com:443

ErrorLog "logs/dummy-host.example.com-error\_log"

CustomLog "logs/dummy-host.example.com-access\_log" common

SSLEngine on

SSLCertificateFile /usr/local/apache2/conf/server.crt

SSLCertificateKeyFile /usr/local/apache2/conf/server.key

\#SSLCertificateChainFile /usr/local/apache/conf/ssl.crt/intermediatebundle.crt

</IfModule>

</VirtualHost>

错误：curl: (35) error:140770FC:SSL routines:SSL23\_GET\_SERVER\_HELLO:unknown protocol

解决：把443的VirtualHost 放到80的VirtualHost 前面；80 部分 NameVirtualHost \*443部分NameVirtualHost \*:443

1.SSL模块

nginx的https协议需要ssl模块的支持，我们在**编译nginx时使用–with-http\_ssl\_module参数加入SSL模块。**还需要服务器私钥，服务器证书，如果是公司对外环境，这个证书需要购买第三方的权威证书，否则用户体验得不到保障

2.检查Nginx的SSL模块是否安装

\[root@c6 ~\]\# /usr/local/nginx/sbin/nginx -V

nginx version: nginx/1.6.2

built by gcc 4.4.7 20120313 (Red Hat 4.4.7-17) (GCC)

TLS SNI support enabled

configure arguments: --prefix=/usr/local/nginx --with-pcre \--with-http\_ssl\_module --with-http\_stub\_status\_module

3.准备私钥和证书

3.1创建服务器私钥

\[root@c6 ~\]\# cd /usr/local/nginx/conf/

\[root@c6 conf\]\# mkdir key

\[root@c6 conf\]\# cd key

\[root@c6 key\]\# openssl genrsa -des3 -out server.key 1024

Generating RSA private key, 1024 bit long modulus

..................++++++

..............++++++

e is 65537 (0x10001)

Enter pass phrase for server.key:        \#\#输入一个密码

Verifying - Enter pass phrase for server.key:      \#再次输入

3.2签发证书

\[root@c6 key\]\# openssl req -new -key server.key -out server.csr

Enter pass phrase for server.key:

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

\-----

Country Name (2 letter code) \[XX\]:CN

State or Province Name (full name) \[\]:SH

Locality Name (eg, city) \[Default City\]:SH

Organization Name (eg, company) \[Default Company Ltd\]:YJS

Organizational Unit Name (eg, section) \[\]:SA

Common Name (eg, your name or your server's hostname) \[\]:Web

Email Address \[\]:szk5043@foxmail.com

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password \[\]:root

An optional company name \[\]:root

3.3 删除服务器私钥口令

\[root@c6 key\]\# cp server.key server.key.ori

\[root@c6 key\]\# openssl rsa -in server.key.ori -out server.key

Enter pass phrase for server.key.ori:

writing RSA key

3.4生成使用签名请求证书和私钥生成自签证书

\[root@c6 key\]\# openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

Signature ok

subject=/C=CN/ST=SH/L=SH/O=YJS/OU=SA/CN=Web/emailAddress=szk5043@foxmail.com

Getting Private key

3.5开启Nginx SSL

\[root@c6 ~\]\# vim /usr/local/nginx/conf/vhosts/szk.conf

server \{

server\_name www.szk.com;

listen   80;

rewrite ^(.\*) https://$server\_name$1 permanent;

server  \{

listen 443;

server\_name www.szk.com;

index index.html index.htm index.php;

root /data/www;

ssl on;

ssl\_certificate key/server.crt;

ssl\_certificate\_key key/server.key;

location ~ \\.php$ \{

include fastcgi\_params;

\#fastcgi\_pass unix:/tmp/php-fcgi.sock;

fastcgi\_pass 127.0.0.1:9000;

fastcgi\_index index.php;

fastcgi\_param SCRIPT\_FILENAME /data/www$fastcgi\_script\_name;

\#把80端口的访问自动跳转到433端口

\[root@c6 ~\]\# /etc/init.d/nginx  restart

Stopping Nginx:                                            \[   OK   \]

Starting Nginx:                                            \[  OK  \]

\[root@c6 ~\]\# netstat -tnlup | grep nginx

tcp        0      0 0.0.0.0:80                  0.0.0.0:\*                   LISTEN      1504/nginx

tcp        0      0 0.0.0.0:443                 0.0.0.0:\*                   LISTEN      1504/nginx

4.测试

默认情况下ssl模块并未被安装，如果要使用该模块则需要在编译时指定–with-http\_ssl\_module参数，安装模块依赖于OpenSSL库和一些引用文件，通常这些文件并不在同一个软件包中。通常这个文件名类似libssl-dev。

可以通过以下步骤生成一个简单的证书：

首先，进入你想创建证书和私钥的目录，例如：

cd /usr/local/nginx/conf

创建服务器私钥，命令会让你输入一个口令：

openssl genrsa -des3 -out server.key 1024

创建签名请求的证书（CSR）：

openssl req -new -key server.key -out server.csr

在加载SSL支持的Nginx并使用上述私钥时除去必须的口令：

cp server.key server.key.org

openssl rsa -in server.key.org -out server.key

配置nginx

最后标记证书使用上述私钥和CSR：

openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

修改Nginx配置文件，让其包含新标记的证书和私钥：

server \{

server\_name YOUR\_DOMAINNAME\_HERE;

listen 443;

ssl on;

ssl\_certificate /usr/local/nginx/conf/server.crt;

ssl\_certificate\_key /usr/local/nginx/conf/server.key;

重启nginx。

这样就可以通过以下方式访问：

https://YOUR\_DOMAINNAME\_HERE

另外还可以加入如下代码实现80端口重定向到443

server \{

listen 80;

server\_name ww.centos.bz;

rewrite ^(.\*) https://$server\_name$1 permanent;

(1) 生成私钥；

\# (umask 077; openssl genrsa -out /etc/pki/CA/private/cakey.pem 4096)

(2) 生成自签证书；

\# openssl req -new -x509 -key /etc/pki/CA/private/cakey.pem -out /etc/pki/CA/cacert.pem -days 365

\-new：生成新证书签署请求；

\-x509：生成自签格式证书，专用于创建私有CA时；

\-key：生成请求时用到的私有文件路径；

\-out：生成的请求文件路径；如果自签操作将直接生成签署过的证书；

\-days：证书的有效时长，单位是day；

(3) 为CA提供所需的目录及文件；

\# mkdir  -pv  /etc/pki/CA/\{certs,crl,newcerts\}

\# touch  /etc/pki/CA/\{serial,index.txt\}

\# echo  01 > /etc/pki/CA/serial

此主机即是一台CA了。

(4)用到证书的主机(httpd主机)生成私钥；

\# mkdir  /etc/httpd/ssl

\# cd  /etc/httpd/ssl

\# (umask  077; openssl  genrsa -out  /etc/httpd/ssl/httpd.key  2048)

(5) 生成证书签署请求

\# openssl  req  -new  -key  /etc/httpd/ssl/httpd.key  -out /etc/httpd/ssl/httpd.csr  -days  365

(6) 在CA主机上签署证书；

\# openssl ca  -in  /etc/httpd/ssl/httpd.csr  -out  /etc/pki/CA/certs/httpd.crt  -days  365

Using configuration from /etc/pki/tls/openssl.cnf

Check that the request matches the signature

Signature ok

Certificate Details:

Serial Number: 1(0x2)

Validity

Not Before: Apr 10 15:45:54 2016 GMT

Not After : Apr 10 15:45:54 2017 GMT

Subject:

countryName               = CN

stateOrProvinceName       = beijing

organizationName          = ops

organizationalUnitName    = ops

commonName                = ops.com

emailAddress              = admin@ops.com

X509v3 extensions:

X509v3 Basic Constraints:

CA:FALSE

Netscape Comment:

OpenSSL Generated Certificate

X509v3 Subject Key Identifier:

08:A3:DD:98:D3:E0:42:58:5E:B7:24:43:6C:3D:B1:D8:02:34:16:46

X509v3 Authority Key Identifier:

keyid:75:63:44:2C:46:80:2F:84:CE:EF:C6:F1:F2:E7:75:2E:EF:17:37:C2

Certificate is to be certified until Apr 10 15:45:54 2017 GMT (365 days)

Sign the certificate? \[y/n\]:y

1 out of 1 certificate requests certified, commit? \[y/n\]y

Write out database with 1 new entries

Data Base Updated

(7)查看证书中的信息：

\# openssl  x509  -in /etc/pki/CA/certs/httpd.crt  -noout  -serial  -subject

Apache和Nginx开启Https

发表评论取消回复

还没有评论，来说两句吧...

相关阅读

相关 Apache和Nginx开启Https

相关 nginx 开启 gzip压缩、https记忆

相关 Nginx 和 Apache 对比

相关 nginx配置http和https共存

相关 Nginx和Apache对比

相关【docker】开启gitlab + nginx + https之旅

相关 nginx代理http和https配置

相关 Nginx/Apache 和Apache Tomcat 的区别

相关 apache开启expires

相关 CA认证过程及apache和nginx实现https的方法