Linux系统配置HTTP SSL

centos6配置一个基于SSL VPN的Apache服务，制作该服务的证书

 

 

安装Apache

yum -y install httpd*

 

 

 

安装mod_ssl

yum -y install mod_ssl

 

 

开启HTTP服务

service httpd start

 

 

关闭防火墙

service iptables stop

 

进入/etc/pki/tls/certs/目录下

cd /etc/pki/tls/certs/

 

 

 

生成证书

make server.crt

umask 77 ; \
        /usr/bin/openssl genrsa -aes128 2048 > server.key
Generating RSA private key, 2048 bit long modulus
...................................+++
.....+++
e is 65537 (0x10001)
Enter pass phrase:
Verifying - Enter pass phrase: //输入通行短语
umask 77 ; \
        /usr/bin/openssl req -utf8 -new -key server.key -x509 -days 365 -out ser                          ver.crt -set_serial 0
Enter pass phrase for server.key://输入server.key的密码短语
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn   //国家名称（2个字母代码）
State or Province Name (full name) []:beijing //省份（全名）
Locality Name (eg, city) [Default City]:tam //地点名称
Organization Name (eg, company) [Default Company Ltd]:xm //组织名称
Organizational Unit Name (eg, section) []:shit //组织单位名称
Common Name (eg, your name or your server's hostname) []:localhost //公用名
Email Address []:123@qq.com //电子邮箱

 

 

配置ssl.conf，第77行中将图中的两个注释去掉修改为本地IP即可

vi /etc/httpd/conf.d/ssl.conf

 

 修改 第113  ，路径要正确，第二个key由为关键

SSLCertificateFile /etc/pki/tls/certs/server.crt

SSLCertificateKeyFile /etc/pki/tls/certs/server.key

改完后保存并退出

重启httpd服务,输入制作证书时的密码service httpd restart

 

 如果报错

SSLCertificateKeyFile: file '/etc/pki/tls/certs/server.key' does not exist or is empty

报错的原因可能是因为

key不存在或者为空，不用担心，删掉key和crt 可以重新生成

cd /etc/pki/tls/certs/server.crt
rm server.key
rm server.crt
make server.crt    //重新验证

 

Openssl 验证

一切准备好后，可以看这一步，每次重启使HTTP服务器无需密码

openssl rsa -in server.key -out server.key

无需输入密码直接重启