来一发让CentOS办事器撑持https（宁静http协定）

只看该作者 · 发表于 2015-1-14 20:32:09

马上注册，结交更多好友，享用更多功能，让你轻松玩转社区。

您需要登录才可以下载或查看，没有帐号？立即注册

x

如果您觉得本篇CentOSLinux教程讲得好，请记得点击右边漂浮的分享程序，把好文章分享给你的小伙伴们！我们一般用“http://”如许的体例来会见网站，而此时传输的内容是大概被他人截获的，由于其内容是经由过程明文传输，以是在传送一些隐私、和暗码相干的信息时，就显得十分的不宁静。在一些对照正式的网站、和一些银行相干的网站中，一些必要提交隐私大概主要级别对照高的暗码时，都接纳“https://”的体例，来将传输内容加密，从而包管用户宁静和制止隐私的泄露。

明天在这里，我就经由过程mod_ssl来使我们的办事器也撑持https。（情况：centos5.5）

1、装置mod_ssl

经由过程yum来在线装置mod_ssl

[root@300second~]#yum-yinstallmod_ssl←在线装置mod_ssl

Loadedplugins:fastestmirror
Loadingmirrorspeedsfromcachedhostfile
*base:data.nicehosting.co.kr
*extras:data.nicehosting.co.kr
*updates:data.nicehosting.co.kr
addons|951B00:00
addons/primary|202B00:00
http://data.nicehosting.co.kr/os/CentOS/5.7/os/i386/repodata/repomd.xml:[Errno14]HTTPError403:Forbidden
Tryingothermirror.
base|1.1kB00:00
base/primary|961kB00:40
base2705/2705
http://data.nicehosting.co.kr/os/CentOS/5.7/extras/i386/repodata/repomd.xml:[Errno14]HTTPError403:Forbidden
Tryingothermirror.
extras|2.1kB00:00
extras/primary_db|156kB00:06
http://data.nicehosting.co.kr/os/CentOS/5.7/updates/i386/repodata/repomd.xml:[Errno14]HTTPError403:Forbidden
Tryingothermirror.
updates|1.9kB00:00
updates/primary_db|290kB00:12
SettingupInstallProcess
ResolvingDependencies
-->Runningtransactioncheck
--->Packagemod_ssl.i3861:2.2.3-53.el5.centos.3settobeupdated
-->ProcessingDependency:httpd=2.2.3-53.el5.centos.3forpackage:mod_ssl
-->ProcessingDependency:libdistcache.so.1forpackage:mod_ssl
-->ProcessingDependency:libnal.so.1forpackage:mod_ssl
-->Runningtransactioncheck
--->Packagedistcache.i3860:1.4.5-14.1settobeupdated
--->Packagehttpd.i3860:2.2.3-53.el5.centos.3settobeupdated
-->FinishedDependencyResolution
DependenciesResolved
================================================================================
PackageArchVersionRepositorySize
================================================================================
Installing:
mod_ssli3861:2.2.3-53.el5.centos.3updates93k
Installingfordependencies:
distcachei3861.4.5-14.1base119k
Updatingfordependencies:
httpdi3862.2.3-53.el5.centos.3updates1.2M
TransactionSummary
================================================================================
Install2Package(s)
Upgrade1Package(s)
Totaldownloadsize:1.4M
DownloadingPackages:
(1/3):mod_ssl-2.2.3-53.el5.centos.3.i386.rpm|93kB00:03
(2/3):distcache-1.4.5-14.1.i386.rpm|119kB00:05
(3/3):httpd-2.2.3-53.el5.centos.3.i386.rpm|1.2MB00:53
--------------------------------------------------------------------------------
Total23kB/s|1.4MB01:02
warning:rpmts_HdrFromFdno:HeaderV3DSAsignature:NOKEY,keyIDe8562897
updates/gpgkey|1.5kB00:00
ImportingGPGkey0xE8562897"CentOS-5Key(CentOS5OfficialSigningKey)<centos-5-key@centos.org>"from/etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-5
Runningrpm_check_debug
RunningTransactionTest
FinishedTransactionTest
TransactionTestSucceeded
RunningTransaction
Installing:distcache1/4
Updating:httpd2/4
Installing:mod_ssl3/4
Cleanup:httpd4/4
Installed:
mod_ssl.i3861:2.2.3-53.el5.centos.3
DependencyInstalled:
distcache.i3860:1.4.5-14.1
DependencyUpdated:
httpd.i3860:2.2.3-53.el5.centos.3
Complete!

2、HTTP办事器上设置mod_ssl

[1]创建办事器密钥

[root@300second~]#cd/etc/pki/tls/certs/　←进进HTTP办事器设置文件地点目次

[root@300secondcerts]#makeserver.key　←创建办事器密钥
umask77;
/usr/bin/opensslgenrsa-des31024>server.key
GeneratingRSAprivatekey,1024bitlongmodulus
................++++++
......++++++
eis65537(0x10001)
Enterpassphrase:　←在这里输出口令
Verifying-Enterpassphrase:　←确认口令，再次输出

[root@300secondcerts]#opensslrsa-inserver.key-outserver.key　←从密钥中删除暗码（以免体系启动后被扣问口令）

Enterpassphraseforserver.key:　←输出口令
writingRSAkey

[2]创建办事器公钥

[root@300secondcerts]#makeserver.csr　←创建办事器密钥

umask77;
/usr/bin/opensslreq-utf8-new-keyserver.key-outserver.csr
Youareabouttobeaskedtoenterinformationthatwillbeincorporated
intoyourcertificaterequest.
WhatyouareabouttoenteriswhatiscalledaDistinguishedNameoraDN.
Therearequiteafewfieldsbutyoucanleavesomeblank
Forsomefieldstherewillbeadefaultvalue,
Ifyouenter.,thefieldwillbeleftblank.
-----
CountryName(2lettercode)[GB]:CN　←输出国名
StateorProvinceName(fullname)[Berkshire]:Fujian　←输出省名
LocalityName(eg,city)[Newbury]:Quanzhou　←输出乡村名
OrganizationName(eg,company)[MyCompanyLtd]:www.51cto.com　←输出构造名（恣意）
OrganizationalUnitName(eg,section)[]:　←不输出，间接回车
CommonName(eg,yournameoryourservershostname)[]:www.51cto.com　←输出通称（恣意）
EmailAddress[]:300second@163.com　←输出电子邮箱地点

Pleaseenterthefollowingextraattributes
tobesentwithyourcertificaterequest
Achallengepassword[]:　←不输出，间接回车
Anoptionalcompanyname[]:　←不输出，间接回车

[3]创建办事器证书

[root@300secondcerts]#opensslx509-inserver.csr-outserver.pem-req-signkeyserver.key-days365　←创建办事器证书

Signatureok
subject=/C=CN/ST=Fujian/L=Quanzhou/O=www.51cto.com/CN=www.51cto.com/emailAddress=300second@163.com
GettingPrivatekey

[root@300secondcerts]#chmod400server.*←修正权限为400

[4]设置SSL

[root@300secondcerts]#vi/etc/httpd/conf.d/ssl.conf　←修正SSL的设置文件

#DocumentRoot"/var/www/html"　←找到这一行，将行首的“#”往失落
　↓
DocumentRoot"/var/www/html"　←变成此形态

[5]从头启动HTTP办事，让SSL失效

[root@300secondcerts]#/etc/rc.d/init.d/httpdrestart　←从头启动HTTP办事器

中断httpd:　　　　　　　　　　　　　[断定]
启动httpd:　　　　　　　　　　　　　　[断定]

3、测试SSL

翻开扫瞄器，在地点栏输出“https://办事器IP地点”大概“https://你的域名”后，假如呈现提醒装置办事器宁静证书的窗口（以下所示），申明办事器已撑持SSL。