Skip to content →

为Apache2配置SSL证书

本文介绍如何为 Apache2 创建自签名SSL证书,虽然自签名证书不能受第三方浏览器信任(无法验证服务器身份),但能够起到安全传输信息的作用。可以考虑使用 Let’s Encrypt 颁发大多数Web浏览器都信任的免费SSL/TLS证书,请参考链接:How To Secure Apache with Let’s Encrypt on Ubuntu 14.04

一、Ubuntu环境

以Ubuntu 14.04为例,如果没有安装 Apache ,则可通过如下命令快速安装:

[[email protected] ~]# sudo apt-get update
[[email protected] ~]# sudo apt-get install apache2

1. 启用SSL模块

SSL支持是 Ubuntu 14.04 Apache 软件包的标准配置,只需要启用即可:

[[email protected] ~]# sudo a2enmod ssl
[[email protected] ~]# sudo apachectl restart

2. 创建自签名证书

创建一个目录用于放置密钥和证书文件:

[[email protected] ~]# sudo mkdir /etc/apache2/ssl

创建私钥和证书:

[[email protected] ~]# sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/apache2/ssl/server.key -out /etc/apache2/ssl/server.crt

其中,openssl是OpenSSL提供的基本命令行工具;req指定了X.509证书签名请求(CSR)管理的子命令;-x509选项指定了创建自签名证书而不是生成证书请求;-nodes选项告诉OpenSSL不使用密码来保护密钥文件,受密码保护的密钥文件会使得Apache服务重新启动时必须输入密码;-days选项指定了证书有效期为多少天;-newkey rsa:2048选项指定了同时创建私钥,私钥为2048位的RSA密钥;-keyout选项指定了私钥输出文件路径;-out指定了证书输出文件路径。

执行上述命令会被要求回答几个问题:

Country Name (2 letter code) [AU]:US
State or Province Name (full name) [Some-State]:New York
Locality Name (eg, city) []:New York City
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Your Company
Organizational Unit Name (eg, section) []:Department of Kittens
Common Name (e.g. server FQDN or YOUR name) []:your_domain
Email Address []:your_email

其中,最重要的是Common Name,应输入要与证书关联的域名,如果没有域名,则输入服务器的公共IP地址。

3. 配置Apache使用SSL证书

文件/etc/apache2/sites-available/default-ssl.conf的默认内容如下:

<IfModule mod_ssl.c>
    <VirtualHost _default_:443>
        ServerAdmin [email protected]
        DocumentRoot /var/www/html
        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined
        SSLEngine on
        SSLCertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem
        SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key
        <FilesMatch "\.(cgi|shtml|phtml|php)$">
                        SSLOptions +StdEnvVars
        </FilesMatch>
        <Directory /usr/lib/cgi-bin>
                        SSLOptions +StdEnvVars
        </Directory>
        BrowserMatch "MSIE [2-6]" \
                        nokeepalive ssl-unclean-shutdown \
                        downgrade-1.0 force-response-1.0
        BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
    </VirtualHost>
</IfModule>

将其修改为:

<IfModule mod_ssl.c>
    <VirtualHost _default_:443>
        ServerAdmin [email protected]
        ServerName your_domain
        ServerAlias www.your_domain
        DocumentRoot /var/www/html
        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined
        SSLEngine on
        SSLCertificateFile /etc/apache2/ssl/server.crt
        SSLCertificateKeyFile /etc/apache2/ssl/server.key
        <FilesMatch "\.(cgi|shtml|phtml|php)$">
                        SSLOptions +StdEnvVars
        </FilesMatch>
        <Directory /usr/lib/cgi-bin>
                        SSLOptions +StdEnvVars
        </Directory>
        BrowserMatch "MSIE [2-6]" \
                        nokeepalive ssl-unclean-shutdown \
                        downgrade-1.0 force-response-1.0
        BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
    </VirtualHost>
</IfModule>

同时,文件/etc/apache2/ports.conf中应包含以下内容:

<IfModule ssl_module>
    Listen 443
</IfModule>

<IfModule mod_gnutls.c>
    Listen 443
</IfModule>

然后激活并重启Apache即可:

[[email protected] ~]# sudo a2ensite default-ssl.conf
[[email protected] ~]# sudo apachectl restart

也可通过以下命令重启:

[[email protected] ~]# sudo /etc/init.d/apache2 force-reload
[[email protected] ~]# sudo /etc/init.d/apache2 restart

二、Centos环境

如果没有安装 Apache ,则可通过如下命令快速安装:

[[email protected] ~]# sudo yum -y install httpd

1. 安装SSL模块

参考:https://www.cnblogs.com/ryanlamp/p/6377637.html

Centos Apache 一般不支持SSL,需要安装:

[[email protected] ~]# sudo yum -y install mod_ssl

2. 创建自签名证书

同上,将其中ssl证书存放路径改为/etc/httpd/ssl目录。

3. 配置Apache使用SSL证书

文件/etc/httpd/conf.d/ssl.conf的默认内容如下:

LoadModule ssl_module modules/mod_ssl.so
Listen 443
SSLPassPhraseDialog builtin
SSLSessionCache         shmcb:/var/cache/mod_ssl/scache(512000)
SSLSessionCacheTimeout  300
SSLMutex default
SSLRandomSeed startup file:/dev/urandom  256
SSLRandomSeed connect builtin
SSLCryptoDevice builtin
<VirtualHost _default_:443>
    #DocumentRoot "/var/www/html"
    #ServerName www.example.com:443
    ErrorLog logs/ssl_error_log
    TransferLog logs/ssl_access_log
    LogLevel warn
    SSLEngine on
    SSLProtocol all -SSLv2
    SSLCipherSuite DEFAULT:!EXP:!SSLv2:!DES:!IDEA:!SEED:+3DES
    SSLCertificateFile /etc/pki/tls/certs/localhost.crt
    SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
    <Files ~ "\.(cgi|shtml|phtml|php3?)$">
        SSLOptions +StdEnvVars
    </Files>
    <Directory "/var/www/cgi-bin">
        SSLOptions +StdEnvVars
    </Directory>
    SetEnvIf User-Agent ".*MSIE.*" \
             nokeepalive ssl-unclean-shutdown \
             downgrade-1.0 force-response-1.0
    CustomLog logs/ssl_request_log \
              "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
</VirtualHost>

将其修改为:

LoadModule ssl_module modules/mod_ssl.so
Listen 443
SSLPassPhraseDialog builtin
SSLSessionCache shmcb:/var/cache/mod_ssl/scache(512000)
SSLSessionCacheTimeout 300
SSLMutex default
SSLRandomSeed startup file:/dev/urandom 256
SSLRandomSeed connect builtin
SSLCryptoDevice builtin
<VirtualHost _default_:443>
    DocumentRoot "/var/www/html"
    ServerName your_domain
    ErrorLog logs/ssl_error_log
    TransferLog logs/ssl_access_log
    LogLevel warn
    SSLEngine on
    SSLProtocol all -SSLv2
    SSLCipherSuite DEFAULT:!EXP:!SSLv2:!DES:!IDEA:!SEED:+3DES
    SSLCertificateFile /etc/httpd/ssl/server.crt
    SSLCertificateKeyFile /etc/httpd/ssl/server.key
    <Files ~ "\.(cgi|shtml|phtml|php3?)$">
        SSLOptions +StdEnvVars
    </Files>
    <Directory "/var/www/cgi-bin">
        SSLOptions +StdEnvVars
    </Directory>
    SetEnvIf User-Agent ".*MSIE.*" \
             nokeepalive ssl-unclean-shutdown \
             downgrade-1.0 force-response-1.0
    CustomLog logs/ssl_request_log \
              "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
</VirtualHost>

确保/etc/httpd/conf/httpd.conf文件中包含Include conf.d/*.conf语句,然后重启httpd服务即可。

 

Published in 未分类