CentOS 7 配置HTTPS加密访问SVN
上一篇文章已经介绍了如何在CentOS7环境下安装SVN并整合HTTP访问
http://www.cnblogs.com/fjping0606/p/7581093.html
那么本文则介绍如何添加HTTPS证书加密访问SVN（apache环境）
打开/opt/apache/conf/httpd.conf
将
#LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
去掉注释：
loadModule socache_shmcb_module modules/mod_socache_shmcb.so
将
#LoadModule ssl_module modules/mod_ssl.so
去掉注释：
LoadModule ssl_module modules/mod_ssl.so
将
#Include conf/extra/httpd-ssl.conf
去掉注释：
Include conf/extra/httpd-ssl.conf
保存并退出httpd.conf
打开/opt/apache/conf/extra/httpd-vhosts.conf
添加以下内容
<VirtualHost _default_:443>
DocumentRoot "/data/subversion" ##svn仓库目录
ServerName svn.test.com:443 ##上一篇文件配置的访问svn的域名
ServerAlias svn.test.com
ServerAdmin webmaster@example.com
DirectoryIndex index.html index.htm index.php default.php app.php u.php
ErrorLog logs/example_error.log
CustomLog logs/example_access.log \
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
SSLEngine on
SSLCertificateFile "/opt/apache/ssl/2_svn.test.com.crt" ##在腾讯云申请的https证书
SSLCertificateKeyFile "/opt/apache/ssl/3_svn.test.com.key"
SSLCertificateChainFile "/opt/apache/ssl/1_root_bundle.crt"
<Directory "svn.test.com">
SSLOptions +StdEnvVars
AllowOverride All
Require all granted
</Directory>
<FilesMatch "\.(shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
BrowserMatch "MSIE [2-5]" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
</VirtualHost>
保存并退出httpd-vhost.conf
如果此时尝试重启http，会报错，因为还缺少两个文件（/opt/apache/conf/extra/httpd-ssl.conf）：
/opt/apache/conf/server.crt
/opt/apache/conf/server.key
下面介绍如何生成这两个文件
由于Centos 7移除了Openssl的MD5支持，所以会在下面最后一步生成server.crt的时候报错（ ./sign-server-cert.sh server ）：
error 7 at 0 depth lookup:certificate signature failure
配置在CentOS 7上启用MD5支持
1、暂时启用，在命令行下直接执行
export NSS_HASH_ALG_SUPPORT=+MD5
export OPENSSL_ENABLE_MD5_VERIFY=1
2、通过NetworkManager启用MD5支持
vim /usr/lib/systemd/system/NetworkManager.service
追加下面内容：
[Service]
Environment="OPENSSL_ENABLE_MD5_VERIFY=1 NSS_HASH_ALG_SUPPORT=+MD5"
并重新启动守护进程
systemctl daemon-reload
systemctl restart NetworkManager.service
开始配置生成证书
wget ftp://ftp.pl.vim.org/vol/rzm4/replay.old/mirror/ftp.modssl.org/mod_ssl_contrib/ssl.ca-0.1.tar.gz
tar zxvf ssl.ca-0.1.tar.gz
cd ssl.ca-0.1
./new-root-ca.sh (生成根证书)
No Root CA key round. Generating one
Generating RSA private key, 1024 bit long modulus
...........................++++++
....++++++
e is 65537 (0x10001)
Enter pass phrase for ca.key: (输入一个密码)
Verifying - Enter pass phrase for ca.key: (再输入一次密码)
......
Self-sign the root CA... (签署根证书)
Enter pass phrase for ca.key: (输入刚刚设置的密码)
........
........ (下面开始签署)
Country Name (2 letter code) [MY]:CN
State or Province Name (full name) [Perak]:GuangDong
Locality Name (eg, city) [Sitiawan]:GuangZhou
Organization Name (eg, company) [My Directory Sdn Bhd]:leishen
Organizational Unit Name (eg, section) [Certification Services Division]:kuaiyin
Common Name (eg, MD Root CA) []:H5 CA
Email Address []:dami_cn@163.com
这样就生成了ca.key和ca.crt两个文件，下面还要为我们的服务器生成一个证书：
./new-server-cert.sh server (这个证书的名字是server)
......
......
Country Name (2 letter code) [MY]:CN
State or Province Name (full name) [Perak]:GuangDong
Locality Name (eg, city) [Sitiawan]:GuangZhou
Organization Name (eg, company) [My Directory Sdn Bhd]:leishen
Organizational Unit Name (eg, section) [Secure Web Server]:kuaiyin
Common Name (eg, www.domain.com) []:svn.test.com ##注意这个Common Name不能和上面第一个Common Name设置相同
Email Address []:dami_cn@163.com
这样就生成了server.csr和server.key这两个文件。
还需要签署一下才能使用的：
./sign-server-cert.sh server
CA signing: server.csr -> server.crt:
Using configuration from ca.config
Enter pass phrase for ./ca.key: (输入上面设置的根证书密码)
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName :PRINTABLE:'CN'
stateOrProvinceName :PRINTABLE:'GuangDong'
localityName :PRINTABLE:'GuangZhou'
organizationName :PRINTABLE:'leishen'
organizationalUnitName:PRINTABLE:'kuaiyin'
commonName :PRINTABLE:'svn.test.com'
emailAddress :IA5STRING:'dami_cn@163.com'
Certificate is to be certified until Jan 27 12:05:17 2019 GMT (365 days)
Sign the certificate? [y/n]: y
1 out of 1 certificate requests certified, commit? [y/n] y
Write out database with 1 new entries
Data Base Updated
CA verifying: server.crt <-> CA cert
server.crt: OK
(如果这里出现错误，最好重新来过，删除ssl.ca-0.1这个目录，从解压缩处重新开始。)
完成上面步骤，就生成了server.crt server.key两个文件
将这两个文件拷贝到/opt/apache/conf/
然后重启http
/opt/apache/bin/apachectl restart
完成上面所有步骤，就可以使用https访问svn域名了
https://svn.test.com/leishen/mysvn
参考文章
http://www.eit.name/catool/
http://blog.csdn.net/magicbreaker/article/details/1566742
http://www.zeali.net/entry/532
http://software-engineer.gatsbylee.com/centos7openvpn-verify-error-depth0-errorcertificate-signature-failure/
http://php.upupw.net/apache/6/6325.html 配置HTTP强制跳转到HTTPS
