apache配置ssl

时间：2023-12-18 16:35:08
1、确认是否安装ssl模块
是否有mod_ssl.so文件
2、生成证书和密钥
linux下
步骤1：生成密钥
命令：openssl genrsa 1024 > server.key
说明：这是用128位rsa算法生成密钥，得到server.key文件
步骤2: 生成证书请求文件
命令：openssl req -new -key server.key > server.csr
说明：这是用步骤1的密钥生成证书请求文件server.csr, 这一步提很多问题，一一输入
步骤3: 生成证书
命令：openssl req -x509 -days 365 -key server.key -in server.csr > server.crt
说明：这是用步骤1,2的的密钥和证书请求生成证书server.crt，-days参数指明证书有效期，单位为    
window下
步骤1：生成密钥
命令：openssl genrsa 1024 > server.key
说明：这是用128位rsa算法生成密钥，得到server.key文件
步骤2: 生成证书请求文件
命令：openssl req -config D:\work_soft\Apache2.2\conf\openssl.cnf -new -key server.key > server.csr
说明：这是用步骤1的密钥生成证书请求文件server.csr, 这一步提很多问题，一一输入
步骤3: 生成证书
命令：openssl req -config D:\work_soft\Apache2.2\conf\openssl.cnf -x509 -days 365 -key server.key -in server.csr > server.crt
说明：这是用步骤1,2的的密钥和证书请求生成证书server.crt，-days参数指明证书有效期，单位为天
    把得到的server.key和server.crt文件拷贝到apache的对应目录
3、配置apache
　　1、修改 /etc/apache2/sites-available/default-ssl文件
　　　　将其中的证书相关配置替换为
  　　   SSLCertificateFile /etc/apache2/ssl/server.crt 
  　　   SSLCertificateKeyFile /etc/apache2/ssl/server.key 
　　2、在/etc/apache2/sites-enable/目录下为刚才的default-ssl配置文件生成软连接(如果已经有就不要了)
　　　　 $sudo ln -s ../sites-available/default-ssl 001-default-ssl
　　3、在/etc/apache2/mods-available下设置ssl.conf和ssl.load
　　　　ssl.conf
　　　　 
<IfModule mod_ssl.c>

        # Pseudo Random Number Generator (PRNG):

        # Configure one or more sources to seed the PRNG of the SSL library.

        # The seed data should be of good random quality.

        # WARNING! On some platforms /dev/random blocks if not enough entropy

        # is available. This means you then cannot use the /dev/random device

        # because it would lead to very long connection times (as long as

        # it requires to make more entropy available). But usually those

        # platforms additionally provide a /dev/urandom device which doesn't

        # block. So, if available, use this one instead. Read the mod_ssl User

        # Manual for more details.

        #

        SSLRandomSeed startup builtin

        SSLRandomSeed startup file:/dev/urandom 512

        SSLRandomSeed connect builtin

        SSLRandomSeed connect file:/dev/urandom 512

        ##

        ##  SSL Global Context

        ##

        ##  All SSL configuration in this context applies both to

        ##  the main server and all SSL-enabled virtual hosts.

        ##

        #

        #   Some MIME-types for downloading Certificates and CRLs

        #

        AddType application/x-x509-ca-cert .crt

        AddType application/x-pkcs7-crl .crl

        #   Pass Phrase Dialog:

        #   Configure the pass phrase gathering process.

        #   The filtering dialog program (`builtin' is a internal

        #   terminal dialog) has to provide the pass phrase on stdout.

        SSLPassPhraseDialog  exec:/usr/share/apache2/ask-for-passphrase

        #   Inter-Process Session Cache:

        #   Configure the SSL Session Cache: First the mechanism

        #   to use and second the expiring timeout (in seconds).

        #   (The mechanism dbm has known memory leaks and should not be used).

        #SSLSessionCache                 dbm:${APACHE_RUN_DIR}/ssl_scache

        SSLSessionCache         shmcb:${APACHE_RUN_DIR}/ssl_scache(512000)

        SSLSessionCacheTimeout  300

        #   Semaphore:

        #   Configure the path to the mutual exclusion semaphore the

        #   SSL engine uses internally for inter-process synchronization.

        #   (Disabled by default, the global Mutex directive consolidates by default

        #   this)

        #Mutex file:${APACHE_LOCK_DIR}/ssl_mutex ssl-cache

        #   SSL Cipher Suite:

        #   List the ciphers that the client is permitted to negotiate. See the

        #   ciphers(1) man page from the openssl package for list of all available

        #   options.

        #   Enable only secure ciphers:

        SSLCipherSuite HIGH:!aNULL

        # SSL server cipher order preference:

        # Use server priorities for cipher algorithm choice.

        # Clients may prefer lower grade encryption.  You should enable this

        # option if you want to enforce stronger encryption, and can afford

        # the CPU cost, and did not override SSLCipherSuite in a way that puts

        # insecure ciphers first.

        # Default: Off

        #SSLHonorCipherOrder on

        #   The protocols to enable.

        #   Available values: all, SSLv3, TLSv1, TLSv1.1, TLSv1.2

        #   SSL v2  is no longer supported

        SSLProtocol all -SSLv3

        #   Allow insecure renegotiation with clients which do not yet support the

        #   secure renegotiation protocol. Default: Off

        #SSLInsecureRenegotiation on

        #   Whether to forbid non-SNI clients to access name based virtual hosts.

        #   Default: Off

        #SSLStrictSNIVHostCheck On

</IfModule>

# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

　　ssl.load

# Depends: setenvif mime socache_shmcb

LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so

　　4、在/etc/apache2/mods-enabled下设置刚才配置文件的软连接

　　　　ln -s ../mods-available/ssl.conf ssl.conf

　　　　ln -s ../mods-available/ssl.load ssl.load
4、重启apache　
　　apachectl configtest
　　apachectl restart
报错：
　　1、SSLSessionCache: 'shmcb' session cache not supported (known names: ). Maybe you need to load the appropriate socache module (mod_socache_shmcb?)
　　　　解决方法：加载mod_sochache_shmcb
　　　　在/etc/apache2/mods-enabled下
　　　　ln -s ../mods-available/socache_shmcb.load socache_shmcb.load
　　2、"Syntax error on line 80 of c:/apache/conf/extra/httpd-ssl.conf:ErrorLog takes one argument,The filename of the error log"或者"Syntax error on line 99 of c:/apache/conf/extra/httpd-ssl.conf:SSLCertificateFile takes one argument,SSL Server Certificate file ('/path/to/file' -PEM or DER encoded)"
　　　　解决方法：文件路径加双引号

相关文章