在Linux+Apache+OpenSSL中配置SSL安全证书认证是不难的，我的另一篇工作随记中曾提到
[url]http://www.host01.com/article/server/00070002/0621409075193649.htm[/url]中有所有步骤，不过其中的一些描述有点复杂，并且依赖关系也没有这些严格。这里给出一个傻瓜式步骤，供自己和有心人复用。
首先确保你的Linux有OpenSSL（ls -l /usr/bin/openssl），如果没有请从
[url]http://openssl.org/[/url]下载。
mkdir demoCA
cp /usr/share/ssl/openssl.cnf ./demoCA
vi ./demoCA/openssl.cnf and edit the dir configuration of CA_default from ./demoCA to .
mkdir demoCA/certs
mkdir demoCA/crl
mkdir demoCA/newcerts
mkdir demoCA/private
echo "01" > demoCA/serial
touch demoCA/index.txt
cd demoCA
cp /usr/share/ssl/openssl.cnf ./demoCA
vi ./demoCA/openssl.cnf and edit the dir configuration of CA_default from ./demoCA to .
mkdir demoCA/certs
mkdir demoCA/crl
mkdir demoCA/newcerts
mkdir demoCA/private
echo "01" > demoCA/serial
touch demoCA/index.txt
cd demoCA
openssl req -new -x509 -keyout ./private/cakey.pem -out ./cacert.pem -days 3650（password input twice, 该密码多次用到，HTTPD启动也须用到, 10年有效期）
Country Name (2 letter code) [GB]:US
State or Province Name (full name) [Berkshire]:CA
Locality Name (eg, city) [Newbury]:San Clara
Organization Name (eg, company) [My Company Ltd]:Cisco
Organizational Unit Name (eg, section) []:WebEx
Common Name (eg, your name or your server's hostname) []:ServerDNSName(最好跟你SERVER名字一样）
Email Address []:
Country Name (2 letter code) [GB]:US
State or Province Name (full name) [Berkshire]:CA
Locality Name (eg, city) [Newbury]:San Clara
Organization Name (eg, company) [My Company Ltd]:Cisco
Organizational Unit Name (eg, section) []:WebEx
Common Name (eg, your name or your server's hostname) []:ServerDNSName(最好跟你SERVER名字一样）
Email Address []:
openssl genrsa -des3 -out server.key 1024
openssl req -new -key server.key -out server.csr
Country Name (2 letter code) [GB]:US
State or Province Name (full name) [Berkshire]:CA
Locality Name (eg, city) [Newbury]:San Clara
Organization Name (eg, company) [My Company Ltd]:Cisco
Organizational Unit Name (eg, section) []:WebEx
Common Name (eg, your name or your server's hostname) []:ServerDNSName
Country Name (2 letter code) [GB]:US
State or Province Name (full name) [Berkshire]:CA
Locality Name (eg, city) [Newbury]:San Clara
Organization Name (eg, company) [My Company Ltd]:Cisco
Organizational Unit Name (eg, section) []:WebEx
Common Name (eg, your name or your server's hostname) []:ServerDNSName
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:Cisco-WebEx Communication Inc.
to be sent with your certificate request
A challenge password []:
An optional company name []:Cisco-WebEx Communication Inc.
mv server.csr newreq.pem
openssl ca -config ./openssl.cnf -policy policy_anything -out newcert.pem -infiles newreq.pem
openssl ca -config ./openssl.cnf -policy policy_anything -out newcert.pem -infiles newreq.pem
mv newcert.pem server.crt
vi /etc/httpd/conf.d/ssl.conf并改变以下四行并确保没被注释。
SSLCertificateFile /etc/httpd/conf.d/demoCA/server.crt
SSLCertificateKeyFile /etc/httpd/conf.d/demoCA/server.key
SSLCACertificatePath /etc/httpd/conf.d/demoCA
SSLCACertificateFile /etc/httpd/conf.d/demoCA/cacert.pem
#SSLVerifyClient require
#SSLVerifyDepth 10
#SSLVerifyClient none(by default)
SSLCertificateFile /etc/httpd/conf.d/demoCA/server.crt
SSLCertificateKeyFile /etc/httpd/conf.d/demoCA/server.key
SSLCACertificatePath /etc/httpd/conf.d/demoCA
SSLCACertificateFile /etc/httpd/conf.d/demoCA/cacert.pem
#SSLVerifyClient require
#SSLVerifyDepth 10
#SSLVerifyClient none(by default)
其中上述第五、六行是为client强制需要安装安全证书的设置。如果需要则需按
[url]http://www.host01.com/article/server/00070002/0621409075193649.htm[/url]文章后段所述步骤签发client证书。这里不再赘述。
如果需要第三方签你的根证书，需把你的cacert.pem证书交与第三方认证机构进行签证。
与
[url]http://www.host01.com/article/server/00070002/0621409075193649.htm[/url]颇多重叠，只是为了简单起已，给自己提一个醒。
本文转自 dannyy1026 51CTO博客，原文链接:
http://blog.51cto.com/dannyyuan/39088
