让CentOS服务器支持https(安全http协议)
我们通常用“http://”这样的方式来访问网站,而此时传输的内容是可能被别人截获的,因为其内容是通过明文传输,所以在传递一些隐私、以及密码相关的信息时, 提交隐私或者重要级别比较高的密码时,都采用“https://”的方式,来将传输内容加密,从而保证用户安全和避免隐私的泄漏。
1. 安装mod_ssl
通过yum来在线安装mod_ssl[root@300second ~]# yum-y install mod_ssl ← 在线安装mod_ssl
2.HTTP服务器上配置mod_ssl
[1] 建立服务器密钥
[root@300second~]# cd /etc/pki/tls/certs/ ← 进入HTTP服务器配置文件所在目录
[root@300secondcerts]# make server.key← 建立服务器密钥
umask 77 ; \
/usr/bin/openssl genrsa -des31024 > server.key
Generating RSAprivate key, 1024 bit long modulus
................++++++
......++++++
e is 65537(0x10001)
Enter pass phrase: ← 在这里输入口令
Verifying - Enterpass phrase: ← 确认口令,再次输入
[root@300secondcerts]# openssl rsa -in server.key -out server.key← 从密钥中删除密码(以避免系统启动后被询问口令)
Enter pass phrasefor server.key:← 输入口令writing RSA key
[2] 建立服务器公钥
[root@300secondcerts]# make server.csr ← 建立服务器密钥
umask 77 ; \
/usr/bin/openssl req -utf8 -new-key server.key -out server.csr
You are about tobe asked to enter information that will be incorporated
into yourcertificate request.
What you are aboutto enter is what is called a Distinguished Name or a DN.
There are quite afew fields but you can leave some blank
For some fieldsthere will be a default value,
If you enter '.',the field will be left blank.
-----Country Name(2 letter code) [GB]:CN← 输入国名
State or ProvinceName (full name) [Berkshire]:Fujian←输入省名
Locality Name (eg,city) [Newbury]:Quanzhou← 输入城市名
Organization Name(eg, company) [My Company Ltd]:www.51cto.com←输入组织名(任意)
OrganizationalUnit Name (eg, section) []: ← 不输入,直接回车
Common Name (eg,your name or your server's hostname) []:www.51cto.com← 输入通称(任意)
Email Address[]:300second@163.com ← 输入电子邮箱地址
Please enter thefollowing 'extra' attributes
to be sent withyour certificate requestA challenge password []: ← 不输入,直接回车
An optionalcompany name []: ← 不输入,直接回车
[3] 建立服务器证书
[root@300secondcerts]# openssl x509 -in server.csr -outserver.pem -req -signkey server.key -days 365← 建立服务器证书
Signatureoksubject=/C=CN/ST=Fujian/L=Quanzhou/O=www.51cto.com/CN=www.51cto.com/emailAddress=300second@163.com
Getting Privatekey
[root@300secondcerts]# chmod 400 server.* ← 修改权限为400
[4] 设置SSL
[root@300secondcerts]# vi /etc/httpd/conf.d/ssl.conf← 修改SSL的设置文件
#DocumentRoot"/var/www/html" ← 找到这一行,将行首的“#”去掉
↓
DocumentRoot"/var/www/html" ← 变为此状态
[5] 重新启动HTTP服务,让SSL生效
[root@300secondcerts]# /etc/rc.d/init.d/httpd restart ← 重新启动HTTP服务器
停止 httpd: [ 确定 ]
启动 httpd: [ 确定]