让CentOS服务器支持https(安全http协议)

时间:2022-02-08 10:12:31

CentOS服务器支持https(安全http协议)

 

我们通常用“http://”这样的方式来访问网站,而此时传输的内容是可能被别人截获的,因为其内容是通过明文传输,所以在传递一些隐私、以及密码相关的信息时,    提交隐私或者重要级别比较高的密码时,都采用“https://”的方式,来将传输内容加密,从而保证用户安全和避免隐私的泄漏。

 

1.  安装mod_ssl

通过yum来在线安装mod_ssl

[root@300second ~]# yum-y install mod_ssl      在线安装mod_ssl


2.HTTP服务器上配置mod_ssl

[1] 建立服务器密钥

[root@300second~]#  cd /etc/pki/tls/certs/  进入HTTP服务器配置文件所在目录

[root@300secondcerts]#  make server.key建立服务器密钥
umask 77 ; \
               /usr/bin/openssl genrsa -des31024 > server.key
Generating RSAprivate key, 1024 bit long modulus
................++++++
......++++++
e is 65537(0x10001)
Enter pass phrase:                      在这里输入口令
Verifying - Enterpass phrase:  确认口令,再次输入

[root@300secondcerts]#  openssl rsa -in server.key -out server.key从密钥中删除密码(以避免系统启动后被询问口令)

Enter pass phrasefor server.key:输入口令writing RSA key

[2] 建立服务器公钥

[root@300secondcerts]#  make server.csr  建立服务器密钥

umask 77 ; \
                /usr/bin/openssl req -utf8 -new-key server.key -out server.csr
You are about tobe asked to enter information that will be incorporated
into yourcertificate request.
What you are aboutto enter is what is called a Distinguished Name or a DN.
There are quite afew fields but you can leave some blank
For some fieldsthere will be a default value,
If you enter '.',the field will be left blank.
-----Country Name(2 letter code) [GB]:CN输入国名
State or ProvinceName (full name) [Berkshire]:Fujian输入省名
Locality Name (eg,city) [Newbury]:Quanzhou输入城市名
Organization Name(eg, company) [My Company Ltd]:www.51cto.com输入组织名(任意)
OrganizationalUnit Name (eg, section) []: 不输入,直接回车
Common Name (eg,your name or your server's hostname) []:www.51cto.com输入通称(任意)
Email Address[]:300second@163.com   输入电子邮箱地址

Please enter thefollowing 'extra' attributes
to be sent withyour certificate requestA challenge password []: 不输入,直接回车
An optionalcompany name []:   不输入,直接回车

[3] 建立服务器证书

[root@300secondcerts]#  openssl x509 -in server.csr -outserver.pem -req -signkey server.key -days 365建立服务器证书
Signatureoksubject=/C=CN/ST=Fujian/L=Quanzhou/O=www.51cto.com/CN=www.51cto.com/emailAddress=300second@163.com
Getting Privatekey

[root@300secondcerts]#  chmod 400 server.*    修改权限为400

[4] 设置SSL

[root@300secondcerts]#  vi /etc/httpd/conf.d/ssl.conf修改SSL的设置文件

#DocumentRoot"/var/www/html"  找到这一行,将行首的“#”去掉
 ↓
DocumentRoot"/var/www/html" 变为此状态

[5] 重新启动HTTP服务,让SSL生效

[root@300secondcerts]#  /etc/rc.d/init.d/httpd restart 重新启动HTTP服务器

停止  httpd:                [ 确定 ]
启动 httpd:              [ 确定]