httpd
1. 编译安装httpd-2.4
httpd依赖于apr-1.4+,apr-util-1.4+,[apr-icon]apr:apache portable runtime
[root@mr ~]# yum groups mark install "Development Tools"
Last metadata expiration check: 1:13:23 ago on Thu 21 Jul 2022 04:25:25 PM CST.
Dependencies resolved.
======================================================================
Package Architecture Version Repository Size
======================================================================
Installing Groups:
Development Tools
Transaction Summary
======================================================================
Is this ok [y/N]: y
Complete!
[root@mr ~]# groupadd -r apache
[root@mr ~]# useradd -r -g apache apache
[root@mr ~]# yum -y install openssl-devel pcre-devel expat-devel libtool
Last metadata expiration check: 1:15:04 ago on Thu 21 Jul 2022 04:25:25 PM CST.
Package pcre-devel-8.42-6.el8.x86_64 is already installed.
Package expat-devel-2.2.5-9.el8.x86_64 is already installed.
Dependencies resolved.
......
perl-libnet-3.11-3.el8.noarch
perl-libs-4:5.26.3-421.el8.x86_64
perl-macros-4:5.26.3-421.el8.x86_64
perl-parent-1:0.237-1.el8.noarch
perl-podlators-4.11-1.el8.noarch
perl-threads-1:2.21-2.el8.x86_64
perl-threads-shared-1.58-2.el8.x86_64
Complete!
[root@mr ~]# cd /usr/src/
[root@mr src]# wget https://dlcdn.apache.org//apr/apr-1.7.0.tar.gz
--2022-07-21 17:43:56-- https://dlcdn.apache.org//apr/apr-1.7.0.tar.gz
Resolving dlcdn.apache.org (dlcdn.apache.org)... 151.101.2.132, 2a04:4e42::644
Connecting to dlcdn.apache.org (dlcdn.apache.org)|151.101.2.132|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1093896 (1.0M) [application/x-gzip]
Saving to: ‘apr-1.7.0.tar.gz’
apr-1.7.0.tar.gz 100%[===========>] 1.04M 32.7KB/s in 23s
2022-07-21 17:44:19 (47.5 KB/s) - ‘apr-1.7.0.tar.gz’ saved [1093896/1093896]
[root@mr src]# wget https://dlcdn.apache.org//apr/apr-util-1.6.1.tar.gz
--2022-07-21 17:44:56-- https://dlcdn.apache.org//apr/apr-util-1.6.1.tar.gz
Resolving dlcdn.apache.org (dlcdn.apache.org)... 151.101.2.132, 2a04:4e42::644
Connecting to dlcdn.apache.org (dlcdn.apache.org)|151.101.2.132|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 554301 (541K) [application/x-gzip]
Saving to: ‘apr-util-1.6.1.tar.gz’
apr-util-1.6.1.ta 100%[===========>] 541.31K 25.2KB/s in 14s
2022-07-21 17:45:11 (37.8 KB/s) - ‘apr-util-1.6.1.tar.gz’ saved [554301/554301]
[root@mr src]# tar xf apr-1.7.0.tar.gz
[root@mr src]# tar xf apr-util-1.6.1.tar.gz
[root@mr src]# ls
apr-1.7.0 apr-util-1.6.1 debug
apr-1.7.0.tar.gz apr-util-1.6.1.tar.gz kernels
[root@mr src]#
[root@mr src]# cd apr-1.7.0
[root@mr apr-1.7.0]# vim configure
cfgfile=${ofile}T
trap "$RM \"$cfgfile\"; exit 1" 1 2 15
# $RM "$cfgfile"(将这一行注释)
[root@mr apr-1.7.0]# ./configure --prefix=/usr/local/apr
checking build system type... x86_64-pc-linux-gnu
checking host system type... x86_64-pc-linux-gnu
checking target system type... x86_64-pc-linux-gnu
Configuring APR library
Platform: x86_64-pc-linux-gnu
checking for working mkdir -p... yes
APR Version: 1.7.0
checking for chosen layout... apr
checking for gcc... gcc
checking whether the C compiler works... yes
......
[root@mr apr-1.7.0]# make && make install
make[1]: Entering directory '/usr/src/apr-1.7.0'
/bin/sh /usr/src/apr-1.7.0/libtool --silent --mode=compile gcc -g -O2 -pthread -DHAVE_CONFIG_H -DLINUX -D_REENTRANT -D_GNU_SOURCE -I./include -I/usr/src/apr-1.7.0/include/arch/unix -I./include/arch/unix -I/usr/src/apr-1.7.0/include/arch/unix -I/usr/src/apr-1.7.0/include -I/usr/src/apr-1.7.0/include/private -I/usr/src/apr-1.7.0/include/private -o encoding/apr_encode.lo -c encoding/apr_encode.c && touch encoding/apr_encode.lo
/usr/src/apr-1.7.0/build/mkdir.sh tools
......
[root@mr apr-1.7.0]# cd /usr/src/apr-util-1.6.1
[root@mr apr-util-1.6.1]# ./configure --prefix=/usr/local/apr-util --with-apr=/usr/local/apr
checking build system type... x86_64-pc-linux-gnu
checking host system type... x86_64-pc-linux-gnu
checking target system type... x86_64-pc-linux-gnu
checking for a BSD-compatible install... /usr/bin/install -c
checking for working mkdir -p... yes
APR-util Version: 1.6.1
......
[root@mr apr-util-1.6.1]# make && make install
make[1]: Entering directory '/usr/src/apr-util-1.6.1'
/bin/sh /usr/local/apr/build-1/libtool --silent --mode=compile gcc -g -O2 -pthread -DHAVE_CONFIG_H -DLINUX -D_REENTRANT -D_GNU_SOURCE -I/usr/src/apr-util-1.6.1/include -I/usr/src/apr-util-1.6.1/include/private -I/usr/local/apr/include/apr-1 -o buckets/apr_brigade.lo -c buckets/apr_brigade.c && touch buckets/apr_brigade.lo
/bin/sh /usr/local/apr/build-1/libtool --silent --mode=compile gcc -g -O2 -pthread -DHAVE_CONFIG_H -DLINUX -D_REENTRANT -D_GNU_SOURCE -I/usr/src/apr-util-1.6.1/include -I/usr/src/apr-util-1.6.1/include/private -I/usr/local/apr/include/apr-1 -o buckets/apr_buckets.lo -c buckets/apr_buckets.c && touch buckets/apr_buckets.lo
......
[root@mr ~]# wget https://dlcdn.apache.org/httpd/httpd-2.4.54.tar.gz
--2022-07-21 17:59:52-- https://dlcdn.apache.org/httpd/httpd-2.4.54.tar.gz
Resolving dlcdn.apache.org (dlcdn.apache.org)... 151.101.2.132, 2a04:4e42::644
Connecting to dlcdn.apache.org (dlcdn.apache.org)|151.101.2.132|:443... connected.
HTTP request sent, awaiting response... 200 OK
......
[root@mr ~]# ls
anaconda-ks.cfg httpd-2.4.54
apr-1.7.0
apr-1.7.0.tar.gz httpd-2.4.54.tar.gz.1
apr-util-1.6.1 wget-1.19.5-10.e18.x86_64.rpm
apr-util-1.6.1.tar.gz
[root@mr ~]# tar xf httpd-2.4.38.tar.gz
[root@mr ~]# cd httpd-2.4.54
[root@mr httpd-2.4.54]# ./configure --prefix=/usr/local/apache
--sysconfdir=/etc/httpd24 \
--enable-so \
--enable-ssl \
--enable-cgi \
--enable-rewrite \
--with-zlib \
--with-pcre \
--with-apr=/usr/local/apr \
--with-apr-util=/usr/local/apr-util/ \
--enable-modules=most \
--enable-mpms-shared=all \
--with-mpm=prefork
[root@mr httpd-2.4.54]#make && make install
......
[PRESERVING EXISTING CGI SUBDIR: /usr/local/httpd/cgi-bin]
Installing header files
Installing build system files
Installing man pages and online manual
make[1]: Leaving directory '/root/httpd-2.4.54'
[root@mr httpd-2.4.54]#
2. httpd常用配置
切换使用MPM(编辑/etc/httpd/conf.modules.d/00-mpm.conf文件):
//LoadModule mpm_NAME_module modules/mod_mpm_NAME.so
//NAME有三种,分别是:
prefork
event
worker
访问控制法则:
法则 | 功能 |
---|---|
Require all granted | 允许所有主机访问 |
Require all deny | 拒绝所有主机访问 |
Require ip IPADDR | 授权指定来源地址的主机访问 |
Require not ip IPADDR | 拒绝指定来源地址的主机访问 |
Require host HOSTNAME | 授权指定来源主机名的主机访问 |
Require not host HOSTNAME | 拒绝指定来源主机名的主机访问 |
IPADDR的类型 | HOSTNAME的类型 |
---|---|
IP:192.168.1.1Network/mask:192.168.1.0/255.255.255.0Network/Length:192.168.1.0/24Net:192.168 | FQDN:特定主机的全名DOMAIN:指定域内的所有主机 |
注意:httpd-2.4版本默认是拒绝所有主机访问的,所以安装以后必须做显示授权访问
2.1 虚拟主机
虚拟主机有三类:
- 相同IP不同端口
- 不同IP相同端口
- 相同IP相同端口不同域名
[root@mr ~]# find / -name *vhosts.conf
/usr/share/doc/httpd/httpd-vhosts.conf
[root@mr ~]# cd /etc/httpd/
[root@mr httpd]# ls
conf conf.d conf.modules.d logs modules run state
[root@mr httpd]# cd conf.
conf.d/ conf.modules.d/
[root@mr httpd]# cd conf.d/
[root@mr conf.d]# ls
autoindex.conf README userdir.conf welcome.conf
[root@mr conf.d]# cp /usr/share/doc/httpd/httpd-vhosts.conf .
[root@mr conf.d]# ls
autoindex.conf httpd-vhosts.conf README userdir.conf welcome.conf
[root@mr conf.d]# vim httpd-vhosts.conf(相同IP不同端口口)
<VirtualHost *:80>
DocumentRoot "/var/www/html/zhuawawa"
ServerName www.zhuawawa.com
ErrorLog "/var/log/httpd/www.zhuawawa.com-error_log" CustomLog "/var/log/httpd/zhuawawa.com-access_log" common
</VirtualHost>
Listen 81
<VirtualHost *:81>
DocumentRoot "/var/www/html/doudizhu"
ServerName www.doudizhu.com
ErrorLog "/var/log/httpd/www.doudizhu.com-error_log" CustomLog "/var/log/httpd/www.doudizhu.com-access_log" common
</VirtualHost>
[root@mr conf.d]# cd /var/www/html/
[root@mr html]# ls
index.html
[root@mr html]# mkdir zhuawawa doudizhu
[root@mr html]# ls
doudizhu index.html zhuawawa
[root@mr html]#
[root@mr html]# cd doudizhu/
[root@mr doudizhu]# ls
zhuawawaji.zip 斗地主.zip
[root@mr doudizhu]# yum install -y zip*
[root@mr doudizhu]#unzip 斗地主.zip
......
inflating: HTML5 canvas移动端斗地主小游戏/img/tishi.png
inflating: HTML5 canvas移动端斗地主小游戏/img/yf.png
inflating: HTML5 canvas移动端斗地主小游戏/index.html
inflating: HTML5 canvas移动端斗地主小游戏/JControls.js
inflating: HTML5 canvas移动端斗地主小游戏/Prototype.js
inflating: HTML5 canvas移动端斗地主小游戏/ResourceData.js
[root@mr doudizhu]# ls
'HTML5 canvas移动端斗地主小游戏' zhuawawaji.zip 斗地主.zip
[root@mr doudizhu]#
[root@mr doudizhu]# rm -rf 斗地主.zip
[root@mr doudizhu]# ls
'HTML5 canvas移动端斗地主小游戏' zhuawawaji.zip
[root@mr doudizhu]# mv zhuawawaji.zip ../
[root@mr doudizhu]# ls
'HTML5 canvas移动端斗地主小游戏'
[root@mr doudizhu]# mv 'HTML5 canvas移动端斗地主小游戏'/* .
[root@mr doudizhu]# ls
DJDDZ.js index.html ResourceData.js
'HTML5 canvas移动端斗地主小游戏' JControls.js
img Prototype.js
[root@mr doudizhu]# rm -rf 'HTML5 canvas移动端斗地主小游戏'/
[root@mr doudizhu]# ls
DJDDZ.js index.html Prototype.js
img JControls.js ResourceData.js
[root@mr doudizhu]# cd ..
[root@mr html]# ls
doudizhu index.html zhuawawa zhuawawaji.zip
[root@mr html]# rm -rf zhuawawa
[root@mr html]# ls
doudizhu index.html zhuawawaji.zip
[root@mr html]# unzip zhuawawaji.zip
......
inflating: jQuery抓娃娃机游戏代码/index.html
creating: jQuery抓娃娃机游戏代码/js/
inflating: jQuery抓娃娃机游戏代码/js/jquery.min.js
[root@mr html]#
[root@mr html]# ls
doudizhu index.html jQuery抓娃娃机游戏代码 zhuawawaji.zip
[root@mr html]# rm -rf zhuawawaji.zip
[root@mr html]# ls
doudizhu index.html jQuery抓娃娃机游戏代码
[root@mr html]# mv jQuery抓娃娃机游戏代码 zhuawawa
[root@mr html]# ls
doudizhu index.html zhuawawa
[root@mr html]# cd zhuawawa/
[root@mr zhuawawa]# ls
images img index.html js
[root@mr zhuawawa]# cd ..
[root@mr html]# ls
doudizhu index.html zhuawawa
[root@mr html]# httpd -t
Syntax OK
[root@mr html]#
[root@mr html]# systemctl restart httpd
[root@mr html]# ss -antl
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 128 0.0.0.0:111 0.0.0.0:*
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 25 0.0.0.0:514 0.0.0.0:*
LISTEN 0 128 [::]:111 [::]:*
LISTEN 0 128 *:80 *:*
LISTEN 0 128 *:81 *:*
LISTEN 0 128 [::]:22 [::]:*
LISTEN 0 25 [::]:514 [::]:*
[root@mr html]#
[root@mr conf.d]# vim httpd-vhosts.conf (不同ip相同端口)
<VirtualHost 192.168.29.137:80>
DocumentRoot "/var/www/html/zhuawawa"
ServerName www.zhuawawa.com
ErrorLog "/var/log/httpd/www.zhuawawa.com-error_log"
CustomLog "/var/log/httpd/zhuawawa.com-access_log" common
</VirtualHost>
<VirtualHost 192.168.29.139:80>
DocumentRoot "/var/www/html/doudizhu"
ServerName www.doudizhu.com
ErrorLog "/var/log/httpd/www.doudizhu.com-error_log"
CustomLog "/var/log/httpd/www.doudizhu.com-access_log" common
</VirtualHost>
[root@mr conf.d]# ip addr add 192.168.29.139/24 dev ens33
[root@mr conf.d]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 00:0c:29:e8:e4:aa brd ff:ff:ff:ff:ff:ff
inet 192.168.29.137/24 brd 192.168.29.255 scope global dynamic noprefixroute ens33
valid_lft 986sec preferred_lft 986sec
inet 192.168.29.139/24 scope global secondary ens33
valid_lft forever preferred_lft forever
inet6 fe80::b77d:5769:28fa:2c48/64 scope link noprefixroute
valid_lft forever preferred_lft forever
[root@mr conf.d]#
[root@mr conf.d]# httpd -t
Syntax OK
[root@mr conf.d]# systemctl restart httpd
[root@mr conf.d]# vim httpd-vhosts.conf (相同ip相同端口不同域名)
<VirtualHost *:80>
DocumentRoot "/var/www/html/zhuawawa"
ServerName www.zhuawawa.com
ErrorLog "/var/log/httpd/www.zhuawawa.com-error_log"
CustomLog "/var/log/httpd/zhuawawa.com-access_log" common
</VirtualHost>
<VirtualHost *:80>
DocumentRoot "/var/www/html/doudizhu"
ServerName www.doudizhu.com
ErrorLog "/var/log/httpd/www.doudizhu.com-error_log"
CustomLog "/var/log/httpd/www.doudizhu.com-access_log" common
</VirtualHost>
[root@mr conf.d]# httpd -t
Syntax OK
[root@mr conf.d]# systemctl restart httpd
域名映射
[root@mr conf.d]# yum install -y bind-utils
2.2配置拒绝指定IP访问
[root@mr conf.d]# vim httpd-vhosts.conf
<VirtualHost *:80>
DocumentRoot "/var/www/html/zhuawawa"
ServerName www.zhuawawa.com
ErrorLog "/var/log/httpd/www.zhuawawa.com-error_log"
CustomLog "/var/log/httpd/zhuawawa.com-access_log" common
</VirtualHost>
<Directory /var/www/html/zhuawawa>
<RequireAll>
Require ip 192.168.29.137
Require all granted
</RequireAll>
</Directory>
<VirtualHost *:80>
DocumentRoot "/var/www/html/doudizhu"
ServerName www.doudizhu.com
ErrorLog "/var/log/httpd/www.doudizhu.com-error_log"
CustomLog "/var/log/httpd/www.doudizhu.com-access_log" common
</VirtualHost>
[root@mr conf.d]# httpd -t
Syntax OK
[root@mr conf.d]# systemctl restart httpd.service
ssl:
[root@mr ~]# yum install -y mod_ssl
Last metadata expiration check: 1:22:59 ago on Sun 24 Jul 2022 05:32:39 PM CST.
Dependencies resolved.
==================================================================================================
Package Arch Version Repository Size
==================================================================================================
Installing:
mod_ssl x86_64 1:2.4.37-47.module_el8.6.0+1111+ce6f4ceb.1 appstream 137 k
Installing dependencies:
sscg x86_64 2.3.3-15.el8 appstream 49 k
Transaction Summary
==================================================================================================
Install 2 Packages
Total download size: 187 k
Installed size: 364 k
Downloading Packages:
(1/2): sscg-2.3.3-15.el8.x86_64.rpm 464 kB/s | 49 kB 00:00
(2/2): mod_ssl-2.4.37-47.module_el8.6.0+1111+ce6f4ceb.1.x86_64.rp 878 kB/s | 137 kB 00:00
--------------------------------------------------------------------------------------------------
Total 302 kB/s | 187 kB 00:00
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
Preparing : 1/1
Installing : sscg-2.3.3-15.el8.x86_64 1/2
Installing : mod_ssl-1:2.4.37-47.module_el8.6.0+1111+ce6f4ceb.1.x86_64 2/2
Running scriptlet: mod_ssl-1:2.4.37-47.module_el8.6.0+1111+ce6f4ceb.1.x86_64 2/2
Verifying : mod_ssl-1:2.4.37-47.module_el8.6.0+1111+ce6f4ceb.1.x86_64 1/2
Verifying : sscg-2.3.3-15.el8.x86_64 2/2
Installed products updated.
Installed:
mod_ssl-1:2.4.37-47.module_el8.6.0+1111+ce6f4ceb.1.x86_64 sscg-2.3.3-15.el8.x86_64
Complete!
[root@mr ~]# systemctl restart httpd.service
[root@mr ~]# httpd -M |grep ssl
ssl_module (shared)
[root@mr ~]#
[root@mr ~]# ss -antl
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 128 0.0.0.0:111 0.0.0.0:*
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 25 0.0.0.0:514 0.0.0.0:*
LISTEN 0 128 [::]:111 [::]:*
LISTEN 0 128 *:80 *:*
LISTEN 0 128 [::]:22 [::]:*
LISTEN 0 128 *:443 *:*
LISTEN 0 25 [::]:514 [::]:*
[root@mr ~]#
[root@mr ~]# cd /etc/httpd/conf.modules.d/
[root@mr conf.modules.d]# ls
00-base.conf 00-lua.conf 00-optional.conf 00-ssl.conf 01-cgi.conf 10-proxy_h2.conf
00-dav.conf 00-mpm.conf 00-proxy.conf 00-systemd.conf 10-h2.conf README
[root@mr conf.modules.d]# vim 00-base.conf
LoadModule ssl_module modules/mod_ssl.so
启用模块:编辑/etc/httpd/conf.modules.d/00-base.conf文件,添加下面这行,如果已经有了但是注释了,则取消注释即可
LoadModule ssl_modulemodules/mod_ssl.so
2.3配置https步骤:
openssl实现私有CA:
[root@mr conf.modules.d]# cd /etc/pki/
[root@mr pki]# ls
ca-trust consumer entitlement java product product-default rpm-gpg rsyslog tls
[root@mr pki]# mkdir CA
[root@mr pki]# cd CA/
[root@mr CA]# pwd
/etc/pki/CA
[root@mr CA]# mkdir private
[root@mr CA]# ls
private
[root@mr CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048)
Generating RSA private key, 2048 bit long modulus (2 primes)
...........................................................................................+++++
............+++++
e is 65537 (0x010001)
[root@mr CA]# cd private/
[root@mr private]# ls
cakey.pem
[root@mr private]# cd ..
[root@mr CA]# pwd
/etc/pki/CA
[root@mr CA]# ls
private
[root@mr CA]# openssl rsa -in private/cakey.pem -pubout
writing RSA key
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA73OqEBJwWLE493unqkRC
bVyubWZu5hAFOOMdM4k3bebqNj+ouDNfQRfSNDMDswcO56pJnH34XxPgIQ5I5dNr
I/z6ruvI6YYWrGuVpaUIsHZ/eGs5E+IXZ+O5srdYL55/ghjIDNt2q3jnYWiG8rS1
Ptr55Zo1mIq75CJrXPom8eJkNsD8uL14B+fK09H8f4HiwPvI27eObUbzLkmIBG8M
3XrLx1LTq/PimgDoU6AN4jeXM+AeSlqvYh3sMZgULH1rq+GqORWWIOha0rb+OoSF
oQDjz9IopS90DwolhPNraeHSLuoz5aUGrJ1SCR5T0c7RzZMGkL4+lcMZ7kyAq57w
0wIDAQAB
-----END PUBLIC KEY-----
[root@mr CA]#
2.3 CA配置
CA的配置文件:/etc/pki/tls/openssl.cnf
-
a) CA生成一对密钥
- cd /etc/pki/CA
- (umask 077;openssl genrsa -out private/cakey.pem 2048) #生成密钥,括号必须要
- openssl rsa -in private/cakey.pem -pubout #提取公钥
-
b) CA生成自签署证书
- openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365 #生成自签署证书
- openssl x509 -text -in cacert.pem #读出cacert.pem证书的内容
- mkdir certs newcerts crl
- touch index.txt && echo 01 > serial
-
c) 客户端(例如httpd服务器)生成密钥
- cd /etc/httpd && mkdir ssl && cd ssl
- (umask 077;openssl genrsa -out httpd.key 2048)
-
d) 客户端生成证书签署请求
- openssl req -new -key httpd.key -days 365 -out httpd.csr
-
f) CA签署客户端提交上来的证书
- openssl ca -in /root/httpd.csr -out httpd.crt -days 365
[root@mr CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:hb
Locality Name (eg, city) [Default City]:wh
Organization Name (eg, company) [Default Company Ltd]:runtime
Organizational Unit Name (eg, section) []:peixun
Common Name (eg, your name or your server's hostname) []:www.zhuawawa.com
Email Address []:1@2.com
[root@mr CA]# ls
cacert.pem private
[root@mr CA]# mkdir certs newcerts crl
[root@mr CA]# touch index.txt && echo 01 > serial
[root@mr CA]# ls
cacert.pem certs crl index.txt newcerts private serial
[root@mr CA]# cat serial
01
[root@mr CA]#
[root@mr CA]# cd /etc/httpd && mkdir ssl && cd ssl
[root@mr ssl]# pwd
/etc/httpd/ssl
[root@mr ssl]# (umask 077;openssl genrsa -out httpd.key 2048)
Generating RSA private key, 2048 bit long modulus (2 primes)
..............................................................+++++
.+++++
e is 65537 (0x010001)
[root@mr ssl]# ls
httpd.key
[root@mr ssl]#
[root@mr ssl]# openssl req -new -key httpd.key -days 365 -out httpd.csr
Ignoring -days; not generating a certificate
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:hb
Locality Name (eg, city) [Default City]:wh
Organization Name (eg, company) [Default Company Ltd]:runtime
Organizational Unit Name (eg, section) []:peixun
Common Name (eg, your name or your server's hostname) []:www.zhuawawa.com
Email Address []:1@2.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@mr ssl]# ls
httpd.csr httpd.key
[root@mr ssl]# openssl ca -in /etc/httpd/ssl/httpd.csr -out httpd.crt -days 365
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Jul 24 11:24:13 2022 GMT
Not After : Jul 24 11:24:13 2023 GMT
Subject:
countryName = cn
stateOrProvinceName = hb
organizationName = runtime
organizationalUnitName = peixun
commonName = www.zhuawawa.com
emailAddress = 1@2.com
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
56:2F:3E:78:A0:72:46:BC:5E:9C:16:47:9F:2A:25:0D:CD:10:E1:04
X509v3 Authority Key Identifier:
keyid:D7:C6:76:A6:43:54:3E:BD:7C:73:FE:F2:8F:E9:1A:3A:7C:F0:AC:A0
Certificate is to be certified until Jul 24 11:24:13 2023 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
[root@mr ssl]# ls
httpd.crt httpd.csr httpd.key
[root@mr ssl]# pwd
/etc/httpd/ssl
[root@mr ssl]# cd /etc/httpd/conf.d/
[root@mr conf.d]# ls
autoindex.conf httpd-vhosts.conf README ssl.conf userdir.conf welcome.conf
[root@mr conf.d]# vim ssl.conf
SSLCertificateFile /etc/httpd/ssl/httpd.crt SSLCertificateKeyFile /etc/pki/tls/private/localhost.key <VirtualHost _default_:443> # General setup for the virtual host, inherited from global configuration DocumentRoot "/var/www/html/tanke"
ServerName www.tanke.com:443
[root@mr conf.d]# httpd -t
Syntax OK
[root@mr conf.d]# systemctl restart httpd
Syntax OK
[root@mr conf.d]# ss -antl
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 128 0.0.0.0:111 0.0.0.0:*
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 25 0.0.0.0:514 0.0.0.0:*
LISTEN 0 128 [::]:443 [::]:*
LISTEN 0 128 [::]:80 [::]:*
LISTEN 0 25 [::]:514 [::]:*
[root@mr conf.d]#
- 生成证书
- 配置httpd.conf,取消以下内容的注释
- 在httpd-vhosts.conf中配置虚拟主机
- 在httpd-ssl.conf中配置证书的位置
- 检查配置文件是否有语法错误
- 启动或重启服务
- 设置hosts以便用域名访问(仅学习阶段,企业实际工作中无需做此步。)
【推荐】国内首个AI IDE,深度理解中文开发场景,立即下载体验Trae
【推荐】编程新体验,更懂你的AI,立即体验豆包MarsCode编程助手
【推荐】抖音旗下AI助手豆包,你的智能百科全书,全免费不限次数
【推荐】轻量又高性能的 SSH 工具 IShell:AI 加持,快人一步
· 全程不用写代码,我用AI程序员写了一个飞机大战
· MongoDB 8.0这个新功能碉堡了,比商业数据库还牛
· 记一次.NET内存居高不下排查解决与启示
· DeepSeek 开源周回顾「GitHub 热点速览」
· 白话解读 Dapr 1.15:你的「微服务管家」又秀新绝活了