httpd密钥认证详细配置

标签：corporate   errorlog   修改   usr   serve   内容   生成密钥   following   生成   

#CA生成自签署证书
[root@localhost CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.‘, the field will be left blank.
**----**
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HuBei
Locality Name (eg, city) [Default City]:WuHan
Organization Name (eg, company) [Default Company Ltd]:runtime.example.com
Organizational Unit Name (eg, section) []:runtime.example.com
Common Name (eg, your name or your server‘s hostname) []:runtime.example.com
Email Address []:1@2.com
[root@localhost CA]# openssl x509 -text -in cacert.pem
内容省略....
[root@localhost CA]# mkdir certs newcerts crl
[root@localhost CA]# touch index.txt && echo 01 > serial
[root@localhost CA]# ls
cacert.pem  certs  crl  index.txt  newcerts  private  serial
[root@localhost CA]# cat serial
01

#服务端生成密钥
[root@whb ~]# cd /etc/httpd24 && mkdir ssl && cd ssl
[root@whb ssl]# (umask 077;openssl genrsa -out httpd.key 2048)
Generating RSA private key, 2048 bit long modulus
........................................................................+++
.....................................................................................+++
e is 65537 (0x10001)
[root@whb ssl]# 

#服务端生成证书签署请求
[root@whb ssl]# openssl req -new -key httpd.key -days 365 -out httpd.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.‘, the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HuBei
Locality Name (eg, city) [Default City]:WuHan
Organization Name (eg, company) [Default Company Ltd]:runtime.example.com
Organizational Unit Name (eg, section) []:runtime.example.com
Common Name (eg, your name or your server‘s hostname) []:runtime.example.com
Email Address []:1@2.com

Please enter the following ‘extra‘ attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
#服务端把证书签署请求文件发送给CD
服务端：
[root@whb ssl]# scp httpd.csr root@192.168.86.137:/root
root@192.168.86.137‘s password: 
httpd.csr                                                                 100% 1082    26.4KB/s   00:00    
[root@whb ssl]# 
客户端：
[root@localhost CA]# cd
[root@localhost ~]# ls
1     3.sh             apr-1.6.5.tar.gz        cai.sh        httpd-2.4.38.tar.bz2  program.sh
1.sh  anaconda-ks.cfg  apr-util-1.6.1          db-backup.sh  httpd.csr             shu.sh
2.sh  apr-1.6.5        apr-util-1.6.1.tar.bz2  httpd-2.4.38  mkuser.sh             whb
[root@localhost ~]# openssl ca -in /root/httpd.csr -out httpd.crt -days 365
[root@localhost ~]# ls
1     3.sh             apr-1.6.5.tar.gz        cai.sh        httpd-2.4.38.tar.bz2  mkuser.sh   whb
1.sh  anaconda-ks.cfg  apr-util-1.6.1          db-backup.sh  httpd.crt             program.sh
2.sh  apr-1.6.5        apr-util-1.6.1.tar.bz2  httpd-2.4.38  httpd.csr             shu.sh

#签署服务端提交上来的证书
[root@localhost ~]# openssl ca -in /root/httpd.csr -out httpd.crt -days 365
[root@localhost ~]# ls
1     3.sh             apr-1.6.5.tar.gz        cai.sh        httpd-2.4.38.tar.bz2  mkuser.sh   whb
1.sh  anaconda-ks.cfg  apr-util-1.6.1          db-backup.sh  httpd.crt             program.sh
2.sh  apr-1.6.5        apr-util-1.6.1.tar.bz2  httpd-2.4.38  httpd.csr             shu.sh

#把签署好的证书httpd.crt发给服务端
客户端：
[root@localhost ~]# scp httpd.crt root@192.168.86.138:/root/
httpd.crt                                                                 100% 4718   193.2KB/s   00:00    
[root@localhost ~]# 
服务端：
[root@whb ~]# ls
1  2  3  anaconda-ks.cfg  httpd-2.4.38  httpd-2.4.38.tar.bz2  httpd.crt  httpd.csr  lol  upload
[root@whb ~]# mv httpd.crt /etc/httpd24/ssl/
[root@whb ~]# cd /etc/httpd24/ssl
[root@whb ssl]# ls
httpd.crt  httpd.csr  httpd.key
[root@whb ssl]# 

#ssl配置：
[root@100 ~]# vim /etc/httpd24/extra/httpd-ssl.conf 
/DocumentRoot   //搜索
修改为以下内容：
DocumentRoot "/usr/local/apache/htdocs/runtime"
ServerName runtime.example.com:443
ServerAdmin you@example.com
ErrorLog "/usr/local/apache/logs/runtime.example.com-error_log"
TransferLog "/usr/local/apache/logs/runtime.example.com-access_log"
紧接着将
 SSLCertificateFile "/etc/httpd24/server.crt"  改为 SSLCertificateFile "/etc/httpd24/ssl/httpd.crt"
SSLCertificateKeyFile "/etc/httpd24/server.key"  改为   SSLCertificateKeyFile "/etc/httpd24/ssl/httpd.key"
#检查是否有语法错误
[root@whb ~]# cd /etc/httpd24
[root@100 httpd24]# apachectl restart

httpd密钥认证详细配置

标签：corporate   errorlog   修改   usr   serve   内容   生成密钥   following   生成   

原文地址：https://blog.51cto.com/14763231/2483864