httpd

目录

1. 编译安装httpd-2.4

httpd依赖于apr-1.4+，apr-util-1.4+，[apr-icon]apr：apache portable runtime


[root@mr ~]#  yum groups mark install "Development Tools"
Last metadata expiration check: 1:13:23 ago on Thu 21 Jul 2022 04:25:25 PM CST.
Dependencies resolved.
======================================================================
 Package         Architecture   Version         Repository       Size
======================================================================
Installing Groups:
 Development Tools
                                                                     

Transaction Summary
======================================================================

Is this ok [y/N]: y
Complete!
[root@mr ~]# groupadd -r apache
[root@mr ~]#  useradd -r -g apache apache
[root@mr ~]# yum -y install openssl-devel pcre-devel expat-devel libtool
Last metadata expiration check: 1:15:04 ago on Thu 21 Jul 2022 04:25:25 PM CST.
Package pcre-devel-8.42-6.el8.x86_64 is already installed.
Package expat-devel-2.2.5-9.el8.x86_64 is already installed.
Dependencies resolved.
......
 perl-libnet-3.11-3.el8.noarch                                       
  perl-libs-4:5.26.3-421.el8.x86_64                                   
  perl-macros-4:5.26.3-421.el8.x86_64                                 
  perl-parent-1:0.237-1.el8.noarch                                    
  perl-podlators-4.11-1.el8.noarch                                    
  perl-threads-1:2.21-2.el8.x86_64                                    
  perl-threads-shared-1.58-2.el8.x86_64                               

Complete!
[root@mr ~]#  cd /usr/src/
[root@mr src]# wget https://dlcdn.apache.org//apr/apr-1.7.0.tar.gz
--2022-07-21 17:43:56--  https://dlcdn.apache.org//apr/apr-1.7.0.tar.gz
Resolving dlcdn.apache.org (dlcdn.apache.org)... 151.101.2.132, 2a04:4e42::644
Connecting to dlcdn.apache.org (dlcdn.apache.org)|151.101.2.132|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1093896 (1.0M) [application/x-gzip]
Saving to: ‘apr-1.7.0.tar.gz’

apr-1.7.0.tar.gz  100%[===========>]   1.04M  32.7KB/s    in 23s     

2022-07-21 17:44:19 (47.5 KB/s) - ‘apr-1.7.0.tar.gz’ saved [1093896/1093896]

[root@mr src]# wget https://dlcdn.apache.org//apr/apr-util-1.6.1.tar.gz
--2022-07-21 17:44:56--  https://dlcdn.apache.org//apr/apr-util-1.6.1.tar.gz
Resolving dlcdn.apache.org (dlcdn.apache.org)... 151.101.2.132, 2a04:4e42::644
Connecting to dlcdn.apache.org (dlcdn.apache.org)|151.101.2.132|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 554301 (541K) [application/x-gzip]
Saving to: ‘apr-util-1.6.1.tar.gz’

apr-util-1.6.1.ta 100%[===========>] 541.31K  25.2KB/s    in 14s     

2022-07-21 17:45:11 (37.8 KB/s) - ‘apr-util-1.6.1.tar.gz’ saved [554301/554301]

[root@mr src]# tar xf apr-1.7.0.tar.gz 
[root@mr src]# tar xf apr-util-1.6.1.tar.gz 
[root@mr src]# ls
apr-1.7.0         apr-util-1.6.1         debug
apr-1.7.0.tar.gz  apr-util-1.6.1.tar.gz  kernels
[root@mr src]# 
[root@mr src]# cd apr-1.7.0
[root@mr apr-1.7.0]# vim configure
  cfgfile=${ofile}T
    trap "$RM \"$cfgfile\"; exit 1" 1 2 15
  #  $RM "$cfgfile"（将这一行注释）

[root@mr apr-1.7.0]# ./configure --prefix=/usr/local/apr
checking build system type... x86_64-pc-linux-gnu
checking host system type... x86_64-pc-linux-gnu
checking target system type... x86_64-pc-linux-gnu
Configuring APR library
Platform: x86_64-pc-linux-gnu
checking for working mkdir -p... yes
APR Version: 1.7.0
checking for chosen layout... apr
checking for gcc... gcc
checking whether the C compiler works... yes
......
[root@mr apr-1.7.0]# make && make install
make[1]: Entering directory '/usr/src/apr-1.7.0'
/bin/sh /usr/src/apr-1.7.0/libtool --silent --mode=compile gcc -g -O2 -pthread   -DHAVE_CONFIG_H  -DLINUX -D_REENTRANT -D_GNU_SOURCE   -I./include -I/usr/src/apr-1.7.0/include/arch/unix -I./include/arch/unix -I/usr/src/apr-1.7.0/include/arch/unix -I/usr/src/apr-1.7.0/include -I/usr/src/apr-1.7.0/include/private -I/usr/src/apr-1.7.0/include/private  -o encoding/apr_encode.lo -c encoding/apr_encode.c && touch encoding/apr_encode.lo
/usr/src/apr-1.7.0/build/mkdir.sh tools
......
[root@mr apr-1.7.0]# cd /usr/src/apr-util-1.6.1
[root@mr apr-util-1.6.1]# ./configure --prefix=/usr/local/apr-util --with-apr=/usr/local/apr
checking build system type... x86_64-pc-linux-gnu
checking host system type... x86_64-pc-linux-gnu
checking target system type... x86_64-pc-linux-gnu
checking for a BSD-compatible install... /usr/bin/install -c
checking for working mkdir -p... yes
APR-util Version: 1.6.1
......
[root@mr apr-util-1.6.1]# make && make install
make[1]: Entering directory '/usr/src/apr-util-1.6.1'
/bin/sh /usr/local/apr/build-1/libtool --silent --mode=compile gcc -g -O2 -pthread   -DHAVE_CONFIG_H  -DLINUX -D_REENTRANT -D_GNU_SOURCE   -I/usr/src/apr-util-1.6.1/include -I/usr/src/apr-util-1.6.1/include/private  -I/usr/local/apr/include/apr-1    -o buckets/apr_brigade.lo -c buckets/apr_brigade.c && touch buckets/apr_brigade.lo
/bin/sh /usr/local/apr/build-1/libtool --silent --mode=compile gcc -g -O2 -pthread   -DHAVE_CONFIG_H  -DLINUX -D_REENTRANT -D_GNU_SOURCE   -I/usr/src/apr-util-1.6.1/include -I/usr/src/apr-util-1.6.1/include/private  -I/usr/local/apr/include/apr-1    -o buckets/apr_buckets.lo -c buckets/apr_buckets.c && touch buckets/apr_buckets.lo
......
[root@mr ~]# wget https://dlcdn.apache.org/httpd/httpd-2.4.54.tar.gz
--2022-07-21 17:59:52--  https://dlcdn.apache.org/httpd/httpd-2.4.54.tar.gz
Resolving dlcdn.apache.org (dlcdn.apache.org)... 151.101.2.132, 2a04:4e42::644
Connecting to dlcdn.apache.org (dlcdn.apache.org)|151.101.2.132|:443... connected.
HTTP request sent, awaiting response... 200 OK
......
[root@mr ~]# ls
anaconda-ks.cfg        httpd-2.4.54
apr-1.7.0            
apr-1.7.0.tar.gz       httpd-2.4.54.tar.gz.1
apr-util-1.6.1         wget-1.19.5-10.e18.x86_64.rpm
apr-util-1.6.1.tar.gz
[root@mr ~]# tar xf httpd-2.4.38.tar.gz
[root@mr ~]# cd httpd-2.4.54
[root@mr httpd-2.4.54]# ./configure --prefix=/usr/local/apache 

--sysconfdir=/etc/httpd24 \
--enable-so \
--enable-ssl \
--enable-cgi \
--enable-rewrite \
--with-zlib \
--with-pcre \
--with-apr=/usr/local/apr \
--with-apr-util=/usr/local/apr-util/ \
--enable-modules=most \
--enable-mpms-shared=all \
--with-mpm=prefork
[root@mr httpd-2.4.54]#make && make install
......
[PRESERVING EXISTING CGI SUBDIR: /usr/local/httpd/cgi-bin]
Installing header files
Installing build system files
Installing man pages and online manual
make[1]: Leaving directory '/root/httpd-2.4.54'
[root@mr httpd-2.4.54]#

2. httpd常用配置

切换使用MPM（编辑/etc/httpd/conf.modules.d/00-mpm.conf文件）：

//LoadModule mpm_NAME_module modules/mod_mpm_NAME.so
//NAME有三种，分别是：
prefork
event
worker

访问控制法则：

法则 功能
Require all granted 允许所有主机访问
Require all deny 拒绝所有主机访问
Require ip IPADDR 授权指定来源地址的主机访问
Require not ip IPADDR 拒绝指定来源地址的主机访问
Require host HOSTNAME 授权指定来源主机名的主机访问
Require not host HOSTNAME 拒绝指定来源主机名的主机访问
IPADDR的类型 HOSTNAME的类型
IP：192.168.1.1Network/mask：192.168.1.0/255.255.255.0Network/Length：192.168.1.0/24Net：192.168 FQDN：特定主机的全名DOMAIN：指定域内的所有主机

注意：httpd-2.4版本默认是拒绝所有主机访问的，所以安装以后必须做显示授权访问

2.1 虚拟主机

虚拟主机有三类：

  • 相同IP不同端口
  • 不同IP相同端口
  • 相同IP相同端口不同域名
[root@mr ~]# find / -name *vhosts.conf
/usr/share/doc/httpd/httpd-vhosts.conf
[root@mr ~]# cd /etc/httpd/
[root@mr httpd]# ls
conf  conf.d  conf.modules.d  logs  modules  run  state
[root@mr httpd]# cd conf.
conf.d/         conf.modules.d/ 
[root@mr httpd]# cd conf.d/
[root@mr conf.d]# ls
autoindex.conf  README  userdir.conf  welcome.conf
[root@mr conf.d]# cp /usr/share/doc/httpd/httpd-vhosts.conf .
[root@mr conf.d]# ls
autoindex.conf  httpd-vhosts.conf  README  userdir.conf  welcome.conf
[root@mr conf.d]# vim httpd-vhosts.conf（相同IP不同端口口）
<VirtualHost *:80>
    DocumentRoot "/var/www/html/zhuawawa"
    ServerName www.zhuawawa.com
    ErrorLog "/var/log/httpd/www.zhuawawa.com-error_log"    CustomLog "/var/log/httpd/zhuawawa.com-access_log" common
</VirtualHost>

Listen 81
<VirtualHost *:81>
    DocumentRoot "/var/www/html/doudizhu"
    ServerName www.doudizhu.com
    ErrorLog "/var/log/httpd/www.doudizhu.com-error_log"    CustomLog "/var/log/httpd/www.doudizhu.com-access_log" common
</VirtualHost>
[root@mr conf.d]# cd /var/www/html/
[root@mr html]# ls
index.html
[root@mr html]# mkdir zhuawawa doudizhu
[root@mr html]# ls
doudizhu  index.html  zhuawawa
[root@mr html]# 
[root@mr html]# cd doudizhu/
[root@mr doudizhu]# ls
zhuawawaji.zip  斗地主.zip
[root@mr doudizhu]# yum install -y zip*

[root@mr doudizhu]#unzip 斗地主.zip
......
inflating: HTML5 canvas移动端斗地主小游戏/img/tishi.png  
  inflating: HTML5 canvas移动端斗地主小游戏/img/yf.png  
  inflating: HTML5 canvas移动端斗地主小游戏/index.html  
  inflating: HTML5 canvas移动端斗地主小游戏/JControls.js  
  inflating: HTML5 canvas移动端斗地主小游戏/Prototype.js  
  inflating: HTML5 canvas移动端斗地主小游戏/ResourceData.js  

[root@mr doudizhu]# ls
'HTML5 canvas移动端斗地主小游戏'   zhuawawaji.zip   斗地主.zip
[root@mr doudizhu]# 
[root@mr doudizhu]# rm -rf 斗地主.zip 
[root@mr doudizhu]# ls
'HTML5 canvas移动端斗地主小游戏'   zhuawawaji.zip
[root@mr doudizhu]# mv zhuawawaji.zip ../
[root@mr doudizhu]# ls
'HTML5 canvas移动端斗地主小游戏'
[root@mr doudizhu]# mv 'HTML5 canvas移动端斗地主小游戏'/* .
[root@mr doudizhu]# ls
 DJDDZ.js                          index.html     ResourceData.js
'HTML5 canvas移动端斗地主小游戏'   JControls.js
 img                               Prototype.js
[root@mr doudizhu]# rm -rf 'HTML5 canvas移动端斗地主小游戏'/
[root@mr doudizhu]# ls
DJDDZ.js  index.html    Prototype.js
img       JControls.js  ResourceData.js
[root@mr doudizhu]# cd ..
[root@mr html]# ls
doudizhu  index.html  zhuawawa  zhuawawaji.zip
[root@mr html]# rm -rf zhuawawa
[root@mr html]# ls
doudizhu  index.html  zhuawawaji.zip
[root@mr html]# unzip zhuawawaji.zip 
......
 inflating: jQuery抓娃娃机游戏代码/index.html  
   creating: jQuery抓娃娃机游戏代码/js/
  inflating: jQuery抓娃娃机游戏代码/js/jquery.min.js  
[root@mr html]# 
[root@mr html]# ls
doudizhu  index.html  jQuery抓娃娃机游戏代码  zhuawawaji.zip
[root@mr html]# rm -rf zhuawawaji.zip 
[root@mr html]# ls
doudizhu  index.html  jQuery抓娃娃机游戏代码
[root@mr html]# mv jQuery抓娃娃机游戏代码 zhuawawa
[root@mr html]# ls
doudizhu  index.html  zhuawawa
[root@mr html]# cd zhuawawa/
[root@mr zhuawawa]# ls
images  img  index.html  js
[root@mr zhuawawa]# cd ..
[root@mr html]# ls
doudizhu  index.html  zhuawawa
[root@mr html]# httpd -t
Syntax OK
[root@mr html]# 
[root@mr html]# systemctl restart httpd
[root@mr html]# ss -antl
State      Recv-Q     Send-Q         Local Address:Port         Peer Address:Port     Process     
LISTEN     0          128                  0.0.0.0:111               0.0.0.0:*                    
LISTEN     0          128                  0.0.0.0:22                0.0.0.0:*                    
LISTEN     0          25                   0.0.0.0:514               0.0.0.0:*                    
LISTEN     0          128                     [::]:111                  [::]:*                    
LISTEN     0          128                        *:80                      *:*                    
LISTEN     0          128                        *:81                      *:*                    
LISTEN     0          128                     [::]:22                   [::]:*                    
LISTEN     0          25                      [::]:514                  [::]:*                    
[root@mr html]# 



[root@mr conf.d]# vim httpd-vhosts.conf （不同ip相同端口）
<VirtualHost 192.168.29.137:80>
    DocumentRoot "/var/www/html/zhuawawa"
    ServerName www.zhuawawa.com
    ErrorLog "/var/log/httpd/www.zhuawawa.com-error_log"
    CustomLog "/var/log/httpd/zhuawawa.com-access_log" common
</VirtualHost>

<VirtualHost 192.168.29.139:80>
    DocumentRoot "/var/www/html/doudizhu"
    ServerName www.doudizhu.com
    ErrorLog "/var/log/httpd/www.doudizhu.com-error_log"
    CustomLog "/var/log/httpd/www.doudizhu.com-access_log" common
</VirtualHost>
[root@mr conf.d]# ip addr add 192.168.29.139/24 dev ens33
[root@mr conf.d]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:0c:29:e8:e4:aa brd ff:ff:ff:ff:ff:ff
    inet 192.168.29.137/24 brd 192.168.29.255 scope global dynamic noprefixroute ens33
       valid_lft 986sec preferred_lft 986sec
    inet 192.168.29.139/24 scope global secondary ens33
       valid_lft forever preferred_lft forever
    inet6 fe80::b77d:5769:28fa:2c48/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
[root@mr conf.d]# 
[root@mr conf.d]# httpd -t
Syntax OK
[root@mr conf.d]# systemctl restart httpd




[root@mr conf.d]# vim httpd-vhosts.conf （相同ip相同端口不同域名）
<VirtualHost *:80>
    DocumentRoot "/var/www/html/zhuawawa"
    ServerName www.zhuawawa.com
    ErrorLog "/var/log/httpd/www.zhuawawa.com-error_log"
    CustomLog "/var/log/httpd/zhuawawa.com-access_log" common
</VirtualHost>

<VirtualHost *:80>
    DocumentRoot "/var/www/html/doudizhu"
    ServerName www.doudizhu.com
    ErrorLog "/var/log/httpd/www.doudizhu.com-error_log"
    CustomLog "/var/log/httpd/www.doudizhu.com-access_log" common
</VirtualHost>
[root@mr conf.d]# httpd -t
Syntax OK
[root@mr conf.d]# systemctl restart httpd

域名映射
[root@mr conf.d]# yum install -y bind-utils


2.2配置拒绝指定IP访问

[root@mr conf.d]# vim httpd-vhosts.conf 
<VirtualHost *:80>
    DocumentRoot "/var/www/html/zhuawawa"
    ServerName www.zhuawawa.com
    ErrorLog "/var/log/httpd/www.zhuawawa.com-error_log"
    CustomLog "/var/log/httpd/zhuawawa.com-access_log" common
</VirtualHost>
<Directory /var/www/html/zhuawawa>     
    <RequireAll>
        Require  ip 192.168.29.137  
         Require all granted
    </RequireAll>
</Directory>
<VirtualHost *:80>
    DocumentRoot "/var/www/html/doudizhu"
    ServerName www.doudizhu.com
    ErrorLog "/var/log/httpd/www.doudizhu.com-error_log"
    CustomLog "/var/log/httpd/www.doudizhu.com-access_log" common
</VirtualHost>
[root@mr conf.d]# httpd -t
Syntax OK
[root@mr conf.d]# systemctl restart httpd.service

ssl：

[root@mr ~]# yum install -y mod_ssl
Last metadata expiration check: 1:22:59 ago on Sun 24 Jul 2022 05:32:39 PM CST.
Dependencies resolved.
==================================================================================================
 Package      Arch        Version                                            Repository      Size
==================================================================================================
Installing:
 mod_ssl      x86_64      1:2.4.37-47.module_el8.6.0+1111+ce6f4ceb.1         appstream      137 k
Installing dependencies:
 sscg         x86_64      2.3.3-15.el8                                       appstream       49 k

Transaction Summary
==================================================================================================
Install  2 Packages

Total download size: 187 k
Installed size: 364 k
Downloading Packages:
(1/2): sscg-2.3.3-15.el8.x86_64.rpm                               464 kB/s |  49 kB     00:00    
(2/2): mod_ssl-2.4.37-47.module_el8.6.0+1111+ce6f4ceb.1.x86_64.rp 878 kB/s | 137 kB     00:00    
--------------------------------------------------------------------------------------------------
Total                                                             302 kB/s | 187 kB     00:00     
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                                          1/1 
  Installing       : sscg-2.3.3-15.el8.x86_64                                                 1/2 
  Installing       : mod_ssl-1:2.4.37-47.module_el8.6.0+1111+ce6f4ceb.1.x86_64                2/2 
  Running scriptlet: mod_ssl-1:2.4.37-47.module_el8.6.0+1111+ce6f4ceb.1.x86_64                2/2 
  Verifying        : mod_ssl-1:2.4.37-47.module_el8.6.0+1111+ce6f4ceb.1.x86_64                1/2 
  Verifying        : sscg-2.3.3-15.el8.x86_64                                                 2/2 
Installed products updated.

Installed:
  mod_ssl-1:2.4.37-47.module_el8.6.0+1111+ce6f4ceb.1.x86_64        sscg-2.3.3-15.el8.x86_64       

Complete!
[root@mr ~]# systemctl restart httpd.service 
[root@mr ~]# httpd -M |grep ssl
 ssl_module (shared)
[root@mr ~]# 
[root@mr ~]# ss -antl
State      Recv-Q     Send-Q         Local Address:Port         Peer Address:Port     Process     
LISTEN     0          128                  0.0.0.0:111               0.0.0.0:*                    
LISTEN     0          128                  0.0.0.0:22                0.0.0.0:*                    
LISTEN     0          25                   0.0.0.0:514               0.0.0.0:*                    
LISTEN     0          128                     [::]:111                  [::]:*                    
LISTEN     0          128                        *:80                      *:*                    
LISTEN     0          128                     [::]:22                   [::]:*                    
LISTEN     0          128                        *:443                     *:*                    
LISTEN     0          25                      [::]:514                  [::]:*                    
[root@mr ~]# 
[root@mr ~]# cd /etc/httpd/conf.modules.d/
[root@mr conf.modules.d]# ls
00-base.conf  00-lua.conf  00-optional.conf  00-ssl.conf      01-cgi.conf  10-proxy_h2.conf
00-dav.conf   00-mpm.conf  00-proxy.conf     00-systemd.conf  10-h2.conf   README
[root@mr conf.modules.d]# vim 00-base.conf 
LoadModule ssl_module modules/mod_ssl.so

启用模块：编辑/etc/httpd/conf.modules.d/00-base.conf文件，添加下面这行，如果已经有了但是注释了，则取消注释即可

LoadModule ssl_modulemodules/mod_ssl.so

2.3配置https步骤：

openssl实现私有CA：

[root@mr conf.modules.d]# cd /etc/pki/
[root@mr pki]# ls
ca-trust  consumer  entitlement  java  product  product-default  rpm-gpg  rsyslog  tls
[root@mr pki]# mkdir CA
[root@mr pki]# cd CA/
[root@mr CA]# pwd
/etc/pki/CA
[root@mr CA]# mkdir private
[root@mr CA]# ls
private
[root@mr CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048) 
Generating RSA private key, 2048 bit long modulus (2 primes)
...........................................................................................+++++
............+++++
e is 65537 (0x010001)
[root@mr CA]# cd private/
[root@mr private]# ls
cakey.pem
[root@mr private]# cd ..
[root@mr CA]# pwd
/etc/pki/CA
[root@mr CA]# ls
private
[root@mr CA]# openssl rsa -in private/cakey.pem -pubout
writing RSA key
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA73OqEBJwWLE493unqkRC
bVyubWZu5hAFOOMdM4k3bebqNj+ouDNfQRfSNDMDswcO56pJnH34XxPgIQ5I5dNr
I/z6ruvI6YYWrGuVpaUIsHZ/eGs5E+IXZ+O5srdYL55/ghjIDNt2q3jnYWiG8rS1
Ptr55Zo1mIq75CJrXPom8eJkNsD8uL14B+fK09H8f4HiwPvI27eObUbzLkmIBG8M
3XrLx1LTq/PimgDoU6AN4jeXM+AeSlqvYh3sMZgULH1rq+GqORWWIOha0rb+OoSF
oQDjz9IopS90DwolhPNraeHSLuoz5aUGrJ1SCR5T0c7RzZMGkL4+lcMZ7kyAq57w
0wIDAQAB
-----END PUBLIC KEY-----
[root@mr CA]#

2.3 CA配置

CA的配置文件：/etc/pki/tls/openssl.cnf

  • a) CA生成一对密钥

    • cd /etc/pki/CA
    • (umask 077;openssl genrsa -out private/cakey.pem 2048) #生成密钥，括号必须要
    • openssl rsa -in private/cakey.pem -pubout #提取公钥

  • b) CA生成自签署证书

    • openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365 #生成自签署证书
    • openssl x509 -text -in cacert.pem #读出cacert.pem证书的内容
    • mkdir certs newcerts crl
    • touch index.txt && echo 01 > serial

  • c) 客户端（例如httpd服务器）生成密钥

    • cd /etc/httpd && mkdir ssl && cd ssl
    • (umask 077;openssl genrsa -out httpd.key 2048)

  • d) 客户端生成证书签署请求

    • openssl req -new -key httpd.key -days 365 -out httpd.csr

  • f) CA签署客户端提交上来的证书

    • openssl ca -in /root/httpd.csr -out httpd.crt -days 365
[root@mr CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:hb
Locality Name (eg, city) [Default City]:wh
Organization Name (eg, company) [Default Company Ltd]:runtime
Organizational Unit Name (eg, section) []:peixun
Common Name (eg, your name or your server's hostname) []:www.zhuawawa.com
Email Address []:1@2.com
[root@mr CA]# ls
cacert.pem  private
[root@mr CA]# mkdir certs newcerts crl  
[root@mr CA]# touch index.txt && echo 01 > serial  
[root@mr CA]# ls
cacert.pem  certs  crl  index.txt  newcerts  private  serial
[root@mr CA]# cat serial 
01
[root@mr CA]# 
[root@mr CA]# cd /etc/httpd && mkdir ssl && cd ssl
[root@mr ssl]# pwd
/etc/httpd/ssl
[root@mr ssl]# (umask 077;openssl genrsa -out httpd.key 2048)
Generating RSA private key, 2048 bit long modulus (2 primes)
..............................................................+++++
.+++++
e is 65537 (0x010001)
[root@mr ssl]# ls
httpd.key
[root@mr ssl]# 
[root@mr ssl]# openssl req -new -key httpd.key -days 365 -out httpd.csr
Ignoring -days; not generating a certificate
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:hb
Locality Name (eg, city) [Default City]:wh
Organization Name (eg, company) [Default Company Ltd]:runtime
Organizational Unit Name (eg, section) []:peixun
Common Name (eg, your name or your server's hostname) []:www.zhuawawa.com
Email Address []:1@2.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@mr ssl]# ls
httpd.csr  httpd.key
[root@mr ssl]# openssl ca -in /etc/httpd/ssl/httpd.csr -out httpd.crt -days 365
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Jul 24 11:24:13 2022 GMT
            Not After : Jul 24 11:24:13 2023 GMT
        Subject:
            countryName               = cn
            stateOrProvinceName       = hb
            organizationName          = runtime
            organizationalUnitName    = peixun
            commonName                = www.zhuawawa.com
            emailAddress              = 1@2.com
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
                56:2F:3E:78:A0:72:46:BC:5E:9C:16:47:9F:2A:25:0D:CD:10:E1:04
            X509v3 Authority Key Identifier: 
                keyid:D7:C6:76:A6:43:54:3E:BD:7C:73:FE:F2:8F:E9:1A:3A:7C:F0:AC:A0

Certificate is to be certified until Jul 24 11:24:13 2023 GMT (365 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
[root@mr ssl]# ls
httpd.crt  httpd.csr  httpd.key
[root@mr ssl]# pwd
/etc/httpd/ssl
[root@mr ssl]# cd /etc/httpd/conf.d/
[root@mr conf.d]# ls
autoindex.conf  httpd-vhosts.conf  README  ssl.conf  userdir.conf  welcome.conf
[root@mr conf.d]# vim ssl.conf 
SSLCertificateFile /etc/httpd/ssl/httpd.crt  SSLCertificateKeyFile /etc/pki/tls/private/localhost.key <VirtualHost _default_:443> # General setup for the virtual host, inherited from global configuration DocumentRoot "/var/www/html/tanke" 
ServerName www.tanke.com:443
[root@mr conf.d]# httpd -t
Syntax OK
[root@mr conf.d]# systemctl restart httpd
Syntax OK
[root@mr conf.d]# ss -antl
State      Recv-Q     Send-Q         Local Address:Port         Peer Address:Port     Process     
LISTEN     0          128                  0.0.0.0:111               0.0.0.0:*                    
LISTEN     0          128                  0.0.0.0:22                0.0.0.0:*                    
LISTEN     0          25                   0.0.0.0:514               0.0.0.0:*                    
LISTEN     0          128                     [::]:443                  [::]:*                    
LISTEN     0          128                     [::]:80                   [::]:*                    
LISTEN     0          25                      [::]:514                  [::]:*                    
[root@mr conf.d]#
  • 生成证书
  • 配置httpd.conf，取消以下内容的注释
  • 在httpd-vhosts.conf中配置虚拟主机
  • 在httpd-ssl.conf中配置证书的位置
  • 检查配置文件是否有语法错误
  • 启动或重启服务
  • 设置hosts以便用域名访问(仅学习阶段，企业实际工作中无需做此步。)
posted @   溜溜威  阅读(325)  评论(0)  编辑  收藏  举报
相关博文：
· yum工具的使用
· lvs负载均衡
· 编译安装httpd
· openssl实现私有CA
· openssl实现私有CA
阅读排行：
· 全程不用写代码，我用AI程序员写了一个飞机大战
· MongoDB 8.0这个新功能碉堡了，比商业数据库还牛
· 记一次.NET内存居高不下排查解决与启示
· DeepSeek 开源周回顾「GitHub 热点速览」
· 白话解读 Dapr 1.15：你的「微服务管家」又秀新绝活了
点击右上角即可分享
微信分享提示