httpd

1. 编译安装httpd-2.4

httpd依赖于apr-1.4+,apr-util-1.4+,[apr-icon]apr:apache portable runtime


[root@mr ~]#  yum groups mark install "Development Tools"
Last metadata expiration check: 1:13:23 ago on Thu 21 Jul 2022 04:25:25 PM CST.
Dependencies resolved.
======================================================================
 Package         Architecture   Version         Repository       Size
======================================================================
Installing Groups:
 Development Tools
                                                                     

Transaction Summary
======================================================================

Is this ok [y/N]: y
Complete!
[root@mr ~]# groupadd -r apache
[root@mr ~]#  useradd -r -g apache apache
[root@mr ~]# yum -y install openssl-devel pcre-devel expat-devel libtool
Last metadata expiration check: 1:15:04 ago on Thu 21 Jul 2022 04:25:25 PM CST.
Package pcre-devel-8.42-6.el8.x86_64 is already installed.
Package expat-devel-2.2.5-9.el8.x86_64 is already installed.
Dependencies resolved.
......
 perl-libnet-3.11-3.el8.noarch                                       
  perl-libs-4:5.26.3-421.el8.x86_64                                   
  perl-macros-4:5.26.3-421.el8.x86_64                                 
  perl-parent-1:0.237-1.el8.noarch                                    
  perl-podlators-4.11-1.el8.noarch                                    
  perl-threads-1:2.21-2.el8.x86_64                                    
  perl-threads-shared-1.58-2.el8.x86_64                               

Complete!
[root@mr ~]#  cd /usr/src/
[root@mr src]# wget https://dlcdn.apache.org//apr/apr-1.7.0.tar.gz
--2022-07-21 17:43:56--  https://dlcdn.apache.org//apr/apr-1.7.0.tar.gz
Resolving dlcdn.apache.org (dlcdn.apache.org)... 151.101.2.132, 2a04:4e42::644
Connecting to dlcdn.apache.org (dlcdn.apache.org)|151.101.2.132|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1093896 (1.0M) [application/x-gzip]
Saving to: ‘apr-1.7.0.tar.gz’

apr-1.7.0.tar.gz  100%[===========>]   1.04M  32.7KB/s    in 23s     

2022-07-21 17:44:19 (47.5 KB/s) - ‘apr-1.7.0.tar.gz’ saved [1093896/1093896]

[root@mr src]# wget https://dlcdn.apache.org//apr/apr-util-1.6.1.tar.gz
--2022-07-21 17:44:56--  https://dlcdn.apache.org//apr/apr-util-1.6.1.tar.gz
Resolving dlcdn.apache.org (dlcdn.apache.org)... 151.101.2.132, 2a04:4e42::644
Connecting to dlcdn.apache.org (dlcdn.apache.org)|151.101.2.132|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 554301 (541K) [application/x-gzip]
Saving to: ‘apr-util-1.6.1.tar.gz’

apr-util-1.6.1.ta 100%[===========>] 541.31K  25.2KB/s    in 14s     

2022-07-21 17:45:11 (37.8 KB/s) - ‘apr-util-1.6.1.tar.gz’ saved [554301/554301]

[root@mr src]# tar xf apr-1.7.0.tar.gz 
[root@mr src]# tar xf apr-util-1.6.1.tar.gz 
[root@mr src]# ls
apr-1.7.0         apr-util-1.6.1         debug
apr-1.7.0.tar.gz  apr-util-1.6.1.tar.gz  kernels
[root@mr src]# 
[root@mr src]# cd apr-1.7.0
[root@mr apr-1.7.0]# vim configure
  cfgfile=${ofile}T
    trap "$RM \"$cfgfile\"; exit 1" 1 2 15
  #  $RM "$cfgfile"(将这一行注释)

[root@mr apr-1.7.0]# ./configure --prefix=/usr/local/apr
checking build system type... x86_64-pc-linux-gnu
checking host system type... x86_64-pc-linux-gnu
checking target system type... x86_64-pc-linux-gnu
Configuring APR library
Platform: x86_64-pc-linux-gnu
checking for working mkdir -p... yes
APR Version: 1.7.0
checking for chosen layout... apr
checking for gcc... gcc
checking whether the C compiler works... yes
......
[root@mr apr-1.7.0]# make && make install
make[1]: Entering directory '/usr/src/apr-1.7.0'
/bin/sh /usr/src/apr-1.7.0/libtool --silent --mode=compile gcc -g -O2 -pthread   -DHAVE_CONFIG_H  -DLINUX -D_REENTRANT -D_GNU_SOURCE   -I./include -I/usr/src/apr-1.7.0/include/arch/unix -I./include/arch/unix -I/usr/src/apr-1.7.0/include/arch/unix -I/usr/src/apr-1.7.0/include -I/usr/src/apr-1.7.0/include/private -I/usr/src/apr-1.7.0/include/private  -o encoding/apr_encode.lo -c encoding/apr_encode.c && touch encoding/apr_encode.lo
/usr/src/apr-1.7.0/build/mkdir.sh tools
......
[root@mr apr-1.7.0]# cd /usr/src/apr-util-1.6.1
[root@mr apr-util-1.6.1]# ./configure --prefix=/usr/local/apr-util --with-apr=/usr/local/apr
checking build system type... x86_64-pc-linux-gnu
checking host system type... x86_64-pc-linux-gnu
checking target system type... x86_64-pc-linux-gnu
checking for a BSD-compatible install... /usr/bin/install -c
checking for working mkdir -p... yes
APR-util Version: 1.6.1
......
[root@mr apr-util-1.6.1]# make && make install
make[1]: Entering directory '/usr/src/apr-util-1.6.1'
/bin/sh /usr/local/apr/build-1/libtool --silent --mode=compile gcc -g -O2 -pthread   -DHAVE_CONFIG_H  -DLINUX -D_REENTRANT -D_GNU_SOURCE   -I/usr/src/apr-util-1.6.1/include -I/usr/src/apr-util-1.6.1/include/private  -I/usr/local/apr/include/apr-1    -o buckets/apr_brigade.lo -c buckets/apr_brigade.c && touch buckets/apr_brigade.lo
/bin/sh /usr/local/apr/build-1/libtool --silent --mode=compile gcc -g -O2 -pthread   -DHAVE_CONFIG_H  -DLINUX -D_REENTRANT -D_GNU_SOURCE   -I/usr/src/apr-util-1.6.1/include -I/usr/src/apr-util-1.6.1/include/private  -I/usr/local/apr/include/apr-1    -o buckets/apr_buckets.lo -c buckets/apr_buckets.c && touch buckets/apr_buckets.lo
......
[root@mr ~]# wget https://dlcdn.apache.org/httpd/httpd-2.4.54.tar.gz
--2022-07-21 17:59:52--  https://dlcdn.apache.org/httpd/httpd-2.4.54.tar.gz
Resolving dlcdn.apache.org (dlcdn.apache.org)... 151.101.2.132, 2a04:4e42::644
Connecting to dlcdn.apache.org (dlcdn.apache.org)|151.101.2.132|:443... connected.
HTTP request sent, awaiting response... 200 OK
......
[root@mr ~]# ls
anaconda-ks.cfg        httpd-2.4.54
apr-1.7.0            
apr-1.7.0.tar.gz       httpd-2.4.54.tar.gz.1
apr-util-1.6.1         wget-1.19.5-10.e18.x86_64.rpm
apr-util-1.6.1.tar.gz
[root@mr ~]# tar xf httpd-2.4.38.tar.gz
[root@mr ~]# cd httpd-2.4.54
[root@mr httpd-2.4.54]# ./configure --prefix=/usr/local/apache 

--sysconfdir=/etc/httpd24 \
--enable-so \
--enable-ssl \
--enable-cgi \
--enable-rewrite \
--with-zlib \
--with-pcre \
--with-apr=/usr/local/apr \
--with-apr-util=/usr/local/apr-util/ \
--enable-modules=most \
--enable-mpms-shared=all \
--with-mpm=prefork
[root@mr httpd-2.4.54]#make && make install
......
[PRESERVING EXISTING CGI SUBDIR: /usr/local/httpd/cgi-bin]
Installing header files
Installing build system files
Installing man pages and online manual
make[1]: Leaving directory '/root/httpd-2.4.54'
[root@mr httpd-2.4.54]# 

2. httpd常用配置

切换使用MPM(编辑/etc/httpd/conf.modules.d/00-mpm.conf文件):

//LoadModule mpm_NAME_module modules/mod_mpm_NAME.so
//NAME有三种,分别是:
prefork
event
worker

访问控制法则:

法则 功能
Require all granted 允许所有主机访问
Require all deny 拒绝所有主机访问
Require ip IPADDR 授权指定来源地址的主机访问
Require not ip IPADDR 拒绝指定来源地址的主机访问
Require host HOSTNAME 授权指定来源主机名的主机访问
Require not host HOSTNAME 拒绝指定来源主机名的主机访问
IPADDR的类型 HOSTNAME的类型
IP:192.168.1.1Network/mask:192.168.1.0/255.255.255.0Network/Length:192.168.1.0/24Net:192.168 FQDN:特定主机的全名DOMAIN:指定域内的所有主机

注意:httpd-2.4版本默认是拒绝所有主机访问的,所以安装以后必须做显示授权访问

2.1 虚拟主机

虚拟主机有三类:

  • 相同IP不同端口
  • 不同IP相同端口
  • 相同IP相同端口不同域名
[root@mr ~]# find / -name *vhosts.conf
/usr/share/doc/httpd/httpd-vhosts.conf
[root@mr ~]# cd /etc/httpd/
[root@mr httpd]# ls
conf  conf.d  conf.modules.d  logs  modules  run  state
[root@mr httpd]# cd conf.
conf.d/         conf.modules.d/ 
[root@mr httpd]# cd conf.d/
[root@mr conf.d]# ls
autoindex.conf  README  userdir.conf  welcome.conf
[root@mr conf.d]# cp /usr/share/doc/httpd/httpd-vhosts.conf .
[root@mr conf.d]# ls
autoindex.conf  httpd-vhosts.conf  README  userdir.conf  welcome.conf
[root@mr conf.d]# vim httpd-vhosts.conf(相同IP不同端口口)
<VirtualHost *:80>
    DocumentRoot "/var/www/html/zhuawawa"
    ServerName www.zhuawawa.com
    ErrorLog "/var/log/httpd/www.zhuawawa.com-error_log"    CustomLog "/var/log/httpd/zhuawawa.com-access_log" common
</VirtualHost>

Listen 81
<VirtualHost *:81>
    DocumentRoot "/var/www/html/doudizhu"
    ServerName www.doudizhu.com
    ErrorLog "/var/log/httpd/www.doudizhu.com-error_log"    CustomLog "/var/log/httpd/www.doudizhu.com-access_log" common
</VirtualHost>
[root@mr conf.d]# cd /var/www/html/
[root@mr html]# ls
index.html
[root@mr html]# mkdir zhuawawa doudizhu
[root@mr html]# ls
doudizhu  index.html  zhuawawa
[root@mr html]# 
[root@mr html]# cd doudizhu/
[root@mr doudizhu]# ls
zhuawawaji.zip  斗地主.zip
[root@mr doudizhu]# yum install -y zip*

[root@mr doudizhu]#unzip 斗地主.zip
......
inflating: HTML5 canvas移动端斗地主小游戏/img/tishi.png  
  inflating: HTML5 canvas移动端斗地主小游戏/img/yf.png  
  inflating: HTML5 canvas移动端斗地主小游戏/index.html  
  inflating: HTML5 canvas移动端斗地主小游戏/JControls.js  
  inflating: HTML5 canvas移动端斗地主小游戏/Prototype.js  
  inflating: HTML5 canvas移动端斗地主小游戏/ResourceData.js  

[root@mr doudizhu]# ls
'HTML5 canvas移动端斗地主小游戏'   zhuawawaji.zip   斗地主.zip
[root@mr doudizhu]# 
[root@mr doudizhu]# rm -rf 斗地主.zip 
[root@mr doudizhu]# ls
'HTML5 canvas移动端斗地主小游戏'   zhuawawaji.zip
[root@mr doudizhu]# mv zhuawawaji.zip ../
[root@mr doudizhu]# ls
'HTML5 canvas移动端斗地主小游戏'
[root@mr doudizhu]# mv 'HTML5 canvas移动端斗地主小游戏'/* .
[root@mr doudizhu]# ls
 DJDDZ.js                          index.html     ResourceData.js
'HTML5 canvas移动端斗地主小游戏'   JControls.js
 img                               Prototype.js
[root@mr doudizhu]# rm -rf 'HTML5 canvas移动端斗地主小游戏'/
[root@mr doudizhu]# ls
DJDDZ.js  index.html    Prototype.js
img       JControls.js  ResourceData.js
[root@mr doudizhu]# cd ..
[root@mr html]# ls
doudizhu  index.html  zhuawawa  zhuawawaji.zip
[root@mr html]# rm -rf zhuawawa
[root@mr html]# ls
doudizhu  index.html  zhuawawaji.zip
[root@mr html]# unzip zhuawawaji.zip 
......
 inflating: jQuery抓娃娃机游戏代码/index.html  
   creating: jQuery抓娃娃机游戏代码/js/
  inflating: jQuery抓娃娃机游戏代码/js/jquery.min.js  
[root@mr html]# 
[root@mr html]# ls
doudizhu  index.html  jQuery抓娃娃机游戏代码  zhuawawaji.zip
[root@mr html]# rm -rf zhuawawaji.zip 
[root@mr html]# ls
doudizhu  index.html  jQuery抓娃娃机游戏代码
[root@mr html]# mv jQuery抓娃娃机游戏代码 zhuawawa
[root@mr html]# ls
doudizhu  index.html  zhuawawa
[root@mr html]# cd zhuawawa/
[root@mr zhuawawa]# ls
images  img  index.html  js
[root@mr zhuawawa]# cd ..
[root@mr html]# ls
doudizhu  index.html  zhuawawa
[root@mr html]# httpd -t
Syntax OK
[root@mr html]# 
[root@mr html]# systemctl restart httpd
[root@mr html]# ss -antl
State      Recv-Q     Send-Q         Local Address:Port         Peer Address:Port     Process     
LISTEN     0          128                  0.0.0.0:111               0.0.0.0:*                    
LISTEN     0          128                  0.0.0.0:22                0.0.0.0:*                    
LISTEN     0          25                   0.0.0.0:514               0.0.0.0:*                    
LISTEN     0          128                     [::]:111                  [::]:*                    
LISTEN     0          128                        *:80                      *:*                    
LISTEN     0          128                        *:81                      *:*                    
LISTEN     0          128                     [::]:22                   [::]:*                    
LISTEN     0          25                      [::]:514                  [::]:*                    
[root@mr html]# 

[root@mr conf.d]# vim httpd-vhosts.conf (不同ip相同端口)
<VirtualHost 192.168.29.137:80>
    DocumentRoot "/var/www/html/zhuawawa"
    ServerName www.zhuawawa.com
    ErrorLog "/var/log/httpd/www.zhuawawa.com-error_log"
    CustomLog "/var/log/httpd/zhuawawa.com-access_log" common
</VirtualHost>

<VirtualHost 192.168.29.139:80>
    DocumentRoot "/var/www/html/doudizhu"
    ServerName www.doudizhu.com
    ErrorLog "/var/log/httpd/www.doudizhu.com-error_log"
    CustomLog "/var/log/httpd/www.doudizhu.com-access_log" common
</VirtualHost>
[root@mr conf.d]# ip addr add 192.168.29.139/24 dev ens33
[root@mr conf.d]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:0c:29:e8:e4:aa brd ff:ff:ff:ff:ff:ff
    inet 192.168.29.137/24 brd 192.168.29.255 scope global dynamic noprefixroute ens33
       valid_lft 986sec preferred_lft 986sec
    inet 192.168.29.139/24 scope global secondary ens33
       valid_lft forever preferred_lft forever
    inet6 fe80::b77d:5769:28fa:2c48/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
[root@mr conf.d]# 
[root@mr conf.d]# httpd -t
Syntax OK
[root@mr conf.d]# systemctl restart httpd


[root@mr conf.d]# vim httpd-vhosts.conf (相同ip相同端口不同域名)
<VirtualHost *:80>
    DocumentRoot "/var/www/html/zhuawawa"
    ServerName www.zhuawawa.com
    ErrorLog "/var/log/httpd/www.zhuawawa.com-error_log"
    CustomLog "/var/log/httpd/zhuawawa.com-access_log" common
</VirtualHost>

<VirtualHost *:80>
    DocumentRoot "/var/www/html/doudizhu"
    ServerName www.doudizhu.com
    ErrorLog "/var/log/httpd/www.doudizhu.com-error_log"
    CustomLog "/var/log/httpd/www.doudizhu.com-access_log" common
</VirtualHost>
[root@mr conf.d]# httpd -t
Syntax OK
[root@mr conf.d]# systemctl restart httpd

域名映射
[root@mr conf.d]# yum install -y bind-utils


2.2配置拒绝指定IP访问

[root@mr conf.d]# vim httpd-vhosts.conf 
<VirtualHost *:80>
    DocumentRoot "/var/www/html/zhuawawa"
    ServerName www.zhuawawa.com
    ErrorLog "/var/log/httpd/www.zhuawawa.com-error_log"
    CustomLog "/var/log/httpd/zhuawawa.com-access_log" common
</VirtualHost>
<Directory /var/www/html/zhuawawa>     
    <RequireAll>
        Require  ip 192.168.29.137  
         Require all granted
    </RequireAll>
</Directory>
<VirtualHost *:80>
    DocumentRoot "/var/www/html/doudizhu"
    ServerName www.doudizhu.com
    ErrorLog "/var/log/httpd/www.doudizhu.com-error_log"
    CustomLog "/var/log/httpd/www.doudizhu.com-access_log" common
</VirtualHost>
[root@mr conf.d]# httpd -t
Syntax OK
[root@mr conf.d]# systemctl restart httpd.service 

ssl:

[root@mr ~]# yum install -y mod_ssl
Last metadata expiration check: 1:22:59 ago on Sun 24 Jul 2022 05:32:39 PM CST.
Dependencies resolved.
==================================================================================================
 Package      Arch        Version                                            Repository      Size
==================================================================================================
Installing:
 mod_ssl      x86_64      1:2.4.37-47.module_el8.6.0+1111+ce6f4ceb.1         appstream      137 k
Installing dependencies:
 sscg         x86_64      2.3.3-15.el8                                       appstream       49 k

Transaction Summary
==================================================================================================
Install  2 Packages

Total download size: 187 k
Installed size: 364 k
Downloading Packages:
(1/2): sscg-2.3.3-15.el8.x86_64.rpm                               464 kB/s |  49 kB     00:00    
(2/2): mod_ssl-2.4.37-47.module_el8.6.0+1111+ce6f4ceb.1.x86_64.rp 878 kB/s | 137 kB     00:00    
--------------------------------------------------------------------------------------------------
Total                                                             302 kB/s | 187 kB     00:00     
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                                          1/1 
  Installing       : sscg-2.3.3-15.el8.x86_64                                                 1/2 
  Installing       : mod_ssl-1:2.4.37-47.module_el8.6.0+1111+ce6f4ceb.1.x86_64                2/2 
  Running scriptlet: mod_ssl-1:2.4.37-47.module_el8.6.0+1111+ce6f4ceb.1.x86_64                2/2 
  Verifying        : mod_ssl-1:2.4.37-47.module_el8.6.0+1111+ce6f4ceb.1.x86_64                1/2 
  Verifying        : sscg-2.3.3-15.el8.x86_64                                                 2/2 
Installed products updated.

Installed:
  mod_ssl-1:2.4.37-47.module_el8.6.0+1111+ce6f4ceb.1.x86_64        sscg-2.3.3-15.el8.x86_64       

Complete!
[root@mr ~]# systemctl restart httpd.service 
[root@mr ~]# httpd -M |grep ssl
 ssl_module (shared)
[root@mr ~]# 
[root@mr ~]# ss -antl
State      Recv-Q     Send-Q         Local Address:Port         Peer Address:Port     Process     
LISTEN     0          128                  0.0.0.0:111               0.0.0.0:*                    
LISTEN     0          128                  0.0.0.0:22                0.0.0.0:*                    
LISTEN     0          25                   0.0.0.0:514               0.0.0.0:*                    
LISTEN     0          128                     [::]:111                  [::]:*                    
LISTEN     0          128                        *:80                      *:*                    
LISTEN     0          128                     [::]:22                   [::]:*                    
LISTEN     0          128                        *:443                     *:*                    
LISTEN     0          25                      [::]:514                  [::]:*                    
[root@mr ~]# 
[root@mr ~]# cd /etc/httpd/conf.modules.d/
[root@mr conf.modules.d]# ls
00-base.conf  00-lua.conf  00-optional.conf  00-ssl.conf      01-cgi.conf  10-proxy_h2.conf
00-dav.conf   00-mpm.conf  00-proxy.conf     00-systemd.conf  10-h2.conf   README
[root@mr conf.modules.d]# vim 00-base.conf 
LoadModule ssl_module modules/mod_ssl.so

启用模块:编辑/etc/httpd/conf.modules.d/00-base.conf文件,添加下面这行,如果已经有了但是注释了,则取消注释即可

LoadModule ssl_modulemodules/mod_ssl.so

2.3配置https步骤:

openssl实现私有CA:

[root@mr conf.modules.d]# cd /etc/pki/
[root@mr pki]# ls
ca-trust  consumer  entitlement  java  product  product-default  rpm-gpg  rsyslog  tls
[root@mr pki]# mkdir CA
[root@mr pki]# cd CA/
[root@mr CA]# pwd
/etc/pki/CA
[root@mr CA]# mkdir private
[root@mr CA]# ls
private
[root@mr CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048) 
Generating RSA private key, 2048 bit long modulus (2 primes)
...........................................................................................+++++
............+++++
e is 65537 (0x010001)
[root@mr CA]# cd private/
[root@mr private]# ls
cakey.pem
[root@mr private]# cd ..
[root@mr CA]# pwd
/etc/pki/CA
[root@mr CA]# ls
private
[root@mr CA]# openssl rsa -in private/cakey.pem -pubout
writing RSA key
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA73OqEBJwWLE493unqkRC
bVyubWZu5hAFOOMdM4k3bebqNj+ouDNfQRfSNDMDswcO56pJnH34XxPgIQ5I5dNr
I/z6ruvI6YYWrGuVpaUIsHZ/eGs5E+IXZ+O5srdYL55/ghjIDNt2q3jnYWiG8rS1
Ptr55Zo1mIq75CJrXPom8eJkNsD8uL14B+fK09H8f4HiwPvI27eObUbzLkmIBG8M
3XrLx1LTq/PimgDoU6AN4jeXM+AeSlqvYh3sMZgULH1rq+GqORWWIOha0rb+OoSF
oQDjz9IopS90DwolhPNraeHSLuoz5aUGrJ1SCR5T0c7RzZMGkL4+lcMZ7kyAq57w
0wIDAQAB
-----END PUBLIC KEY-----
[root@mr CA]# 

2.3 CA配置

CA的配置文件:/etc/pki/tls/openssl.cnf

  • a) CA生成一对密钥

    • cd /etc/pki/CA
    • (umask 077;openssl genrsa -out private/cakey.pem 2048) #生成密钥,括号必须要
    • openssl rsa -in private/cakey.pem -pubout #提取公钥
  • b) CA生成自签署证书

    • openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365 #生成自签署证书
    • openssl x509 -text -in cacert.pem #读出cacert.pem证书的内容
    • mkdir certs newcerts crl
    • touch index.txt && echo 01 > serial
  • c) 客户端(例如httpd服务器)生成密钥

    • cd /etc/httpd && mkdir ssl && cd ssl
    • (umask 077;openssl genrsa -out httpd.key 2048)
  • d) 客户端生成证书签署请求

    • openssl req -new -key httpd.key -days 365 -out httpd.csr
  • f) CA签署客户端提交上来的证书

    • openssl ca -in /root/httpd.csr -out httpd.crt -days 365
[root@mr CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:hb
Locality Name (eg, city) [Default City]:wh
Organization Name (eg, company) [Default Company Ltd]:runtime
Organizational Unit Name (eg, section) []:peixun
Common Name (eg, your name or your server's hostname) []:www.zhuawawa.com
Email Address []:1@2.com
[root@mr CA]# ls
cacert.pem  private
[root@mr CA]# mkdir certs newcerts crl  
[root@mr CA]# touch index.txt && echo 01 > serial  
[root@mr CA]# ls
cacert.pem  certs  crl  index.txt  newcerts  private  serial
[root@mr CA]# cat serial 
01
[root@mr CA]# 
[root@mr CA]# cd /etc/httpd && mkdir ssl && cd ssl
[root@mr ssl]# pwd
/etc/httpd/ssl
[root@mr ssl]# (umask 077;openssl genrsa -out httpd.key 2048)
Generating RSA private key, 2048 bit long modulus (2 primes)
..............................................................+++++
.+++++
e is 65537 (0x010001)
[root@mr ssl]# ls
httpd.key
[root@mr ssl]# 
[root@mr ssl]# openssl req -new -key httpd.key -days 365 -out httpd.csr
Ignoring -days; not generating a certificate
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:hb
Locality Name (eg, city) [Default City]:wh
Organization Name (eg, company) [Default Company Ltd]:runtime
Organizational Unit Name (eg, section) []:peixun
Common Name (eg, your name or your server's hostname) []:www.zhuawawa.com
Email Address []:1@2.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@mr ssl]# ls
httpd.csr  httpd.key
[root@mr ssl]# openssl ca -in /etc/httpd/ssl/httpd.csr -out httpd.crt -days 365
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Jul 24 11:24:13 2022 GMT
            Not After : Jul 24 11:24:13 2023 GMT
        Subject:
            countryName               = cn
            stateOrProvinceName       = hb
            organizationName          = runtime
            organizationalUnitName    = peixun
            commonName                = www.zhuawawa.com
            emailAddress              = 1@2.com
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
                56:2F:3E:78:A0:72:46:BC:5E:9C:16:47:9F:2A:25:0D:CD:10:E1:04
            X509v3 Authority Key Identifier: 
                keyid:D7:C6:76:A6:43:54:3E:BD:7C:73:FE:F2:8F:E9:1A:3A:7C:F0:AC:A0

Certificate is to be certified until Jul 24 11:24:13 2023 GMT (365 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
[root@mr ssl]# ls
httpd.crt  httpd.csr  httpd.key
[root@mr ssl]# pwd
/etc/httpd/ssl
[root@mr ssl]# cd /etc/httpd/conf.d/
[root@mr conf.d]# ls
autoindex.conf  httpd-vhosts.conf  README  ssl.conf  userdir.conf  welcome.conf
[root@mr conf.d]# vim ssl.conf 
SSLCertificateFile /etc/httpd/ssl/httpd.crt  SSLCertificateKeyFile /etc/pki/tls/private/localhost.key <VirtualHost _default_:443> # General setup for the virtual host, inherited from global configuration DocumentRoot "/var/www/html/tanke" 
ServerName www.tanke.com:443
[root@mr conf.d]# httpd -t
Syntax OK
[root@mr conf.d]# systemctl restart httpd
Syntax OK
[root@mr conf.d]# ss -antl
State      Recv-Q     Send-Q         Local Address:Port         Peer Address:Port     Process     
LISTEN     0          128                  0.0.0.0:111               0.0.0.0:*                    
LISTEN     0          128                  0.0.0.0:22                0.0.0.0:*                    
LISTEN     0          25                   0.0.0.0:514               0.0.0.0:*                    
LISTEN     0          128                     [::]:443                  [::]:*                    
LISTEN     0          128                     [::]:80                   [::]:*                    
LISTEN     0          25                      [::]:514                  [::]:*                    
[root@mr conf.d]# 

  • 生成证书
  • 配置httpd.conf,取消以下内容的注释
  • 在httpd-vhosts.conf中配置虚拟主机
  • 在httpd-ssl.conf中配置证书的位置
  • 检查配置文件是否有语法错误
  • 启动或重启服务
  • 设置hosts以便用域名访问(仅学习阶段,企业实际工作中无需做此步。)
posted @   溜溜威  阅读(326)  评论(0编辑  收藏  举报
相关博文:
阅读排行:
· 全程不用写代码,我用AI程序员写了一个飞机大战
· MongoDB 8.0这个新功能碉堡了,比商业数据库还牛
· 记一次.NET内存居高不下排查解决与启示
· DeepSeek 开源周回顾「GitHub 热点速览」
· 白话解读 Dapr 1.15:你的「微服务管家」又秀新绝活了
点击右上角即可分享
微信分享提示