CentOS 在 Apache 中加入 SSL 憑證讓網址變成 https
1. 取得所需的軟件
你需要為一台 SSL 加密的網頁伺服器預備數件東西。視乎你的安裝，你可能並未安裝 OpenSSL 或 mod_ssl，Apache 連接到 OpenSSL 的介面。如果你有需要，請用 yum 來安裝它們。
yum install mod_ssl openssl
yum 會告訴你它們已經安裝，或者為你安裝它們。
2. 產生一張自我簽署的憑證
我們將會利用 OpenSSL 來產生一張自我簽署的憑證。如果你在一台生產用的伺服器上做這個動作，你應該會想從一個被信賴的憑證機構取得一條金鑰，但假若你只是用在一個私人網站上或作測試之用，自我簽署的憑證已經足夠了。要建立金鑰，你必須是 root 用戶，因此你可使用 su 變為 root 用戶，或在指令前面運用 sudo
# 產生私鑰
openssl genrsa -out ca.key 2048
# 產生 CSR
openssl req -new -key ca.key -out ca.csr
# 產生自我簽署的金鑰
openssl x509 -req -days 365 -in ca.csr -signkey ca.key -out ca.crt
# 複製檔案至正確位置
cp ca.crt /etc/pki/tls/certs
cp ca.key /etc/pki/tls/private/ca.key
cp ca.csr /etc/pki/tls/private/ca.csr
[attachment:ArtWork/WikiDesign/icon-admonition-alert.png]
警告：如果你採用 SELinux，請確保你複製這些檔案而不是遷移它們。否則 Apache 將會投訴關於違漏了的憑證檔，因為它無法讀取這些擁有錯誤 SELinux 脈絡的憑證檔。
假如你遷移了這些檔案而不是複製它們，你可以用以下的指命來矯正這些檔案的 SELinux 脈絡，因為 /etc/pki/* 的正確脈絡定義已包含在 SELinux 政策裡。
restorecon -RvF /etc/pki
接著我們須要更新 Apache SSL 的設定檔
vi +/SSLCertificateFile /etc/httpd/conf.d/ssl.conf
請修改路徑至金鑰檔案的儲存位置。如果你採用上面的方法，這會是
SSLCertificateFile /etc/pki/tls/certs/ca.crt
然後在再低數行的位置為憑證金鑰檔案設定正確路徑。如果你按照上面的指引，這會是：
SSLCertificateKeyFile /etc/pki/tls/private/ca.key
儲存及離開檔案，然後重新啟動 Apache
/etc/init.d/httpd restart
假若一切正常的話，你現在應該可以透過 https 連線到你的伺服器，並看見 CentOS 的預設頁面。由於憑證是自我簽署的，瀏覽器一般會徵詢你是否接納這個憑證。
3. 設置虛擬主機
一如你為 http 在連接埠 80 上設立 VirtualHost，你亦可為 https 在連接埠 443 上作樣似的設置。一個在連接埠 80 上的網站的典型 VirtualHost 有如下樣子
NameVirtualHost *:80
ServerName anthony.com
<VirtualHost *:80>
DocumentRoot /var/www/html
</VirtualHost>
NameVirtualHost *:443
ServerName anthony.com
<VirtualHost *:443>
SSLEngine on
SSLCertificateFile /etc/pki/tls/certs/ca.crt
SSLCertificateKeyFile /etc/pki/tls/private/ca.key
DocumentRoot /var/www/html
</VirtualHost>
另外因為在安裝 mod_ssl openssl 時，在 conf.d 中會增加 ssl.conf 檔，若沒設定好會造成網頁開起很慢，因此提供下列範例檔詳細參數可因個人而自行修正
#
# This is the Apache server configuration file providing SSL support.
# It contains the configuration directives to instruct the server how to
# serve pages over an https connection. For detailing information about these
# directives see <URL:http://httpd.apache.org/docs/2.2/mod/mod_ssl.html>
#
# Do NOT simply read the instructions in here without understanding
# what they do. They're here only as hints or reminders. If you are unsure
# consult the online docs. You have been warned.
#
LoadModule ssl_module modules/mod_ssl.so
#
# When we also provide SSL we have to listen to the
# the HTTPS port in addition.
#
Listen 443
##
## SSL Global Context
##
## All SSL configuration in this context applies both to
## the main server and all SSL-enabled virtual hosts.
##
# Pass Phrase Dialog:
# Configure the pass phrase gathering process.
# The filtering dialog program (`builtin' is a internal
# terminal dialog) has to provide the pass phrase on stdout.
SSLPassPhraseDialog builtin
# Inter-Process Session Cache:
# Configure the SSL Session Cache: First the mechanism
# to use and second the expiring timeout (in seconds).
SSLSessionCache shmcb:/var/cache/mod_ssl/scache(512000)
SSLSessionCacheTimeout 300
# Semaphore:
# Configure the path to the mutual exclusion semaphore the
# SSL engine uses internally for inter-process synchronization.
SSLMutex default
# Pseudo Random Number Generator (PRNG):
# Configure one or more sources to seed the PRNG of the
# SSL library. The seed data should be of good random quality.
# WARNING! On some platforms /dev/random blocks if not enough entropy
# is available. This means you then cannot use the /dev/random device
# because it would lead to very long connection times (as long as
# it requires to make more entropy available). But usually those
# platforms additionally provide a /dev/urandom device which doesn't
# block. So, if available, use this one instead. Read the mod_ssl User
# Manual for more details.
SSLRandomSeed startup file:/dev/urandom 256
SSLRandomSeed connect builtin
#SSLRandomSeed startup file:/dev/random 512
#SSLRandomSeed connect file:/dev/random 512
#SSLRandomSeed connect file:/dev/urandom 512
#
# Use "SSLCryptoDevice" to enable any supported hardware
# accelerators. Use "openssl engine -v" to list supported
# engine names. NOTE: If you enable an accelerator and the
# server does not start, consult the error logs and ensure
# your accelerator is functioning properly.
#
SSLCryptoDevice builtin
#SSLCryptoDevice ubsec
成果如下
你需要為一台 SSL 加密的網頁伺服器預備數件東西。視乎你的安裝，你可能並未安裝 OpenSSL 或 mod_ssl，Apache 連接到 OpenSSL 的介面。如果你有需要，請用 yum 來安裝它們。
yum install mod_ssl openssl
yum 會告訴你它們已經安裝，或者為你安裝它們。
2. 產生一張自我簽署的憑證
我們將會利用 OpenSSL 來產生一張自我簽署的憑證。如果你在一台生產用的伺服器上做這個動作，你應該會想從一個被信賴的憑證機構取得一條金鑰，但假若你只是用在一個私人網站上或作測試之用，自我簽署的憑證已經足夠了。要建立金鑰，你必須是 root 用戶，因此你可使用 su 變為 root 用戶，或在指令前面運用 sudo
# 產生私鑰
openssl genrsa -out ca.key 2048
# 產生 CSR
openssl req -new -key ca.key -out ca.csr
# 產生自我簽署的金鑰
openssl x509 -req -days 365 -in ca.csr -signkey ca.key -out ca.crt
# 複製檔案至正確位置
cp ca.crt /etc/pki/tls/certs
cp ca.key /etc/pki/tls/private/ca.key
cp ca.csr /etc/pki/tls/private/ca.csr
[attachment:ArtWork/WikiDesign/icon-admonition-alert.png]
警告：如果你採用 SELinux，請確保你複製這些檔案而不是遷移它們。否則 Apache 將會投訴關於違漏了的憑證檔，因為它無法讀取這些擁有錯誤 SELinux 脈絡的憑證檔。
假如你遷移了這些檔案而不是複製它們，你可以用以下的指命來矯正這些檔案的 SELinux 脈絡，因為 /etc/pki/* 的正確脈絡定義已包含在 SELinux 政策裡。
restorecon -RvF /etc/pki
接著我們須要更新 Apache SSL 的設定檔
vi +/SSLCertificateFile /etc/httpd/conf.d/ssl.conf
請修改路徑至金鑰檔案的儲存位置。如果你採用上面的方法，這會是
SSLCertificateFile /etc/pki/tls/certs/ca.crt
然後在再低數行的位置為憑證金鑰檔案設定正確路徑。如果你按照上面的指引，這會是：
SSLCertificateKeyFile /etc/pki/tls/private/ca.key
儲存及離開檔案，然後重新啟動 Apache
/etc/init.d/httpd restart
假若一切正常的話，你現在應該可以透過 https 連線到你的伺服器，並看見 CentOS 的預設頁面。由於憑證是自我簽署的，瀏覽器一般會徵詢你是否接納這個憑證。
3. 設置虛擬主機
一如你為 http 在連接埠 80 上設立 VirtualHost，你亦可為 https 在連接埠 443 上作樣似的設置。一個在連接埠 80 上的網站的典型 VirtualHost 有如下樣子
NameVirtualHost *:80
ServerName anthony.com
<VirtualHost *:80>
DocumentRoot /var/www/html
</VirtualHost>
NameVirtualHost *:443
ServerName anthony.com
<VirtualHost *:443>
SSLEngine on
SSLCertificateFile /etc/pki/tls/certs/ca.crt
SSLCertificateKeyFile /etc/pki/tls/private/ca.key
DocumentRoot /var/www/html
</VirtualHost>
另外因為在安裝 mod_ssl openssl 時，在 conf.d 中會增加 ssl.conf 檔，若沒設定好會造成網頁開起很慢，因此提供下列範例檔詳細參數可因個人而自行修正
#
# This is the Apache server configuration file providing SSL support.
# It contains the configuration directives to instruct the server how to
# serve pages over an https connection. For detailing information about these
# directives see <URL:http://httpd.apache.org/docs/2.2/mod/mod_ssl.html>
#
# Do NOT simply read the instructions in here without understanding
# what they do. They're here only as hints or reminders. If you are unsure
# consult the online docs. You have been warned.
#
LoadModule ssl_module modules/mod_ssl.so
#
# When we also provide SSL we have to listen to the
# the HTTPS port in addition.
#
Listen 443
##
## SSL Global Context
##
## All SSL configuration in this context applies both to
## the main server and all SSL-enabled virtual hosts.
##
# Pass Phrase Dialog:
# Configure the pass phrase gathering process.
# The filtering dialog program (`builtin' is a internal
# terminal dialog) has to provide the pass phrase on stdout.
SSLPassPhraseDialog builtin
# Inter-Process Session Cache:
# Configure the SSL Session Cache: First the mechanism
# to use and second the expiring timeout (in seconds).
SSLSessionCache shmcb:/var/cache/mod_ssl/scache(512000)
SSLSessionCacheTimeout 300
# Semaphore:
# Configure the path to the mutual exclusion semaphore the
# SSL engine uses internally for inter-process synchronization.
SSLMutex default
# Pseudo Random Number Generator (PRNG):
# Configure one or more sources to seed the PRNG of the
# SSL library. The seed data should be of good random quality.
# WARNING! On some platforms /dev/random blocks if not enough entropy
# is available. This means you then cannot use the /dev/random device
# because it would lead to very long connection times (as long as
# it requires to make more entropy available). But usually those
# platforms additionally provide a /dev/urandom device which doesn't
# block. So, if available, use this one instead. Read the mod_ssl User
# Manual for more details.
SSLRandomSeed startup file:/dev/urandom 256
SSLRandomSeed connect builtin
#SSLRandomSeed startup file:/dev/random 512
#SSLRandomSeed connect file:/dev/random 512
#SSLRandomSeed connect file:/dev/urandom 512
#
# Use "SSLCryptoDevice" to enable any supported hardware
# accelerators. Use "openssl engine -v" to list supported
# engine names. NOTE: If you enable an accelerator and the
# server does not start, consult the error logs and ensure
# your accelerator is functioning properly.
#
SSLCryptoDevice builtin
#SSLCryptoDevice ubsec
成果如下
恭喜你，也擁有自己的 https 網址，但該憑證並非是第三方公正!!僅為個人測試使用XD
留言
張貼留言