1，安装openssl
tar zxvf openssl-1.0.0a.tar.gz
cd openssl-1.0.0a
./config --prefix=/usr/local/openssl
make && make install
2,安装apache
tar zxvf httpd-2.2.16.tar.gz
cd httpd-2.2.16
./configure --prefix=/usr/local/apache --enable-ssl --enable-rewrite --enable-so --with-ssl=/usr/local/openssl
make && make install
如果你是yum install ,apt-get,pacman这样的软件管理工具进行安装的话，上面的二步可以省掉。
3，创建主证书
在/usr/local/apache/conf/下面建个目录ssl
3.1，mkdir ssl
3.2，cp /openssl的安装目录/ssl/misc/CA.sh /usr/local/apache/conf/ssl/
3.3 用CA.sh来创建证书
1. [root@BlackGhost ssl]# ./CA.sh -newca //建立主证书
2. CA certificate filename (or enter to create)
3.
4. Making CA certificate ...
5. Generating a 1024 bit RSA private key
6. ............++++++
7. ......++++++
8. writing new private key to './demoCA/private/./cakey.pem'
9. Enter PEM pass phrase:
10. Verifying - Enter PEM pass phrase:
11. Verify failure
12. Enter PEM pass phrase:
13. Verifying - Enter PEM pass phrase:
14. -----
15. You are about to be asked to enter information that will be incorporated
16. into your certificate request.
17. What you are about to enter is what is called a Distinguished Name or a DN.
18. There are quite a few fields but you can leave some blank
19. For some fields there will be a default value,
20. If you enter '.', the field will be left blank.
21. -----
22. Country Name (2 letter code) [AU]:cn
23. State or Province Name (full name) [Some-State]:cn
24. Locality Name (eg, city) []:cn
25. Organization Name (eg, company) [Internet Widgits Pty Ltd]:cn
26. Organizational Unit Name (eg, section) []:cn
27. Common Name (eg, YOUR name) []:localhost
28. Email Address []:xtaying@gmail.com
29.
30. Please enter the following 'extra' attributes
31. to be sent with your certificate request
32. A challenge password []:******************
33. An optional company name []:
34. Using configuration from /etc/ssl/openssl.cnf
35. Enter pass phrase for ./demoCA/private/./cakey.pem: //填的是上面的PEM密码
36. Check that the request matches the signature
37. Signature ok
38. Certificate Details:
39. Serial Number:
40. 89:11:9f:a6:ca:03:63:ab
41. Validity
42. Not Before: Aug 7 12:35:28 2010 GMT
43. Not After : Aug 6 12:35:28 2013 GMT
44. Subject:
45. countryName = cn
46. stateOrProvinceName = cn
47. organizationName = cn
48. organizationalUnitName = cn
49. commonName = localhost
50. emailAddress = xtaying@gmail.com
51. X509v3 extensions:
52. X509v3 Subject Key Identifier:
53. 26:09:F3:D5:26:13:00:1F:3E:CC:86:1D:E4:EE:37:06:65:15:4E:76
54. X509v3 Authority Key Identifier:
55. keyid:26:09:F3:D5:26:13:00:1F:3E:CC:86:1D:E4:EE:37:06:65:15:4E:76
56. DirName:/C=cn/ST=cn/O=cn/OU=cn/CN=localhost/emailAddress=xtaying@gmail.com
57. serial:89:11:9F:A6:CA:03:63:AB
58.
59. X509v3 Basic Constraints:
60. CA:TRUE
61. Certificate is to be certified until Aug 6 12:35:28 2013 GMT (1095 days)
62.
63. Write out database with 1 new entries
64. Data Base Updated
[root@BlackGhost ssl]# ./CA.sh -newca //建立主证书
CA certificate filename (or enter to create)
Making CA certificate ...
Generating a 1024 bit RSA private key
............++++++
......++++++
writing new private key to './demoCA/private/./cakey.pem'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
Verify failure
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:cn
State or Province Name (full name) [Some-State]:cn
Locality Name (eg, city) []:cn
Organization Name (eg, company) [Internet Widgits Pty Ltd]:cn
Organizational Unit Name (eg, section) []:cn
Common Name (eg, YOUR name) []:localhost
Email Address []:xtaying@gmail.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:******************
An optional company name []:
Using configuration from /etc/ssl/openssl.cnf
Enter pass phrase for ./demoCA/private/./cakey.pem: //填的是上面的PEM密码
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number:
89:11:9f:a6:ca:03:63:ab
Validity
Not Before: Aug 7 12:35:28 2010 GMT
Not After : Aug 6 12:35:28 2013 GMT
Subject:
countryName = cn
stateOrProvinceName = cn
organizationName = cn
organizationalUnitName = cn
commonName = localhost
emailAddress = xtaying@gmail.com
X509v3 extensions:
X509v3 Subject Key Identifier:
26:09:F3:D5:26:13:00:1F:3E:CC:86:1D:E4:EE:37:06:65:15:4E:76
X509v3 Authority Key Identifier:
keyid:26:09:F3:D5:26:13:00:1F:3E:CC:86:1D:E4:EE:37:06:65:15:4E:76
DirName:/C=cn/ST=cn/O=cn/OU=cn/CN=localhost/emailAddress=xtaying@gmail.com
serial:89:11:9F:A6:CA:03:63:AB
X509v3 Basic Constraints:
CA:TRUE
Certificate is to be certified until Aug 6 12:35:28 2013 GMT (1095 days)
Write out database with 1 new entries
Data Base Updated
安装成功的话，会在ssl目录下面产生一个文件夹demoCA
4 生成服务器私钥和服务器证书
1. [root@BlackGhost ssl]# openssl genrsa -des3 -out server.key 1024 //产生服务器私钥
2. Generating RSA private key, 1024 bit long modulus
3. .....................++++++
4. .........++++++
5. e is 65537 (0x10001)
6. Enter pass phrase for server.key:
7. Verifying - Enter pass phrase for server.key:
8. [root@BlackGhost ssl]# openssl req -new -key server.key -out server.csr //生成服务器证书
9. Enter pass phrase for server.key:
10. You are about to be asked to enter information that will be incorporated
11. into your certificate request.
12. What you are about to enter is what is called a Distinguished Name or a DN.
13. There are quite a few fields but you can leave some blank
14. For some fields there will be a default value,
15. If you enter '.', the field will be left blank.
16. -----
17. Country Name (2 letter code) [AU]:cn
18. State or Province Name (full name) [Some-State]:cn
19. Locality Name (eg, city) []:cn
20. Organization Name (eg, company) [Internet Widgits Pty Ltd]:cn
21. Organizational Unit Name (eg, section) []:cn
22. Common Name (eg, YOUR name) []:localhost //要填全域名
23. Email Address []:xtaying@gmail.com
24.
25. Please enter the following 'extra' attributes
26. to be sent with your certificate request
27. A challenge password []:*****************
28. An optional company name []:
[root@BlackGhost ssl]# openssl genrsa -des3 -out server.key 1024 //产生服务器私钥
Generating RSA private key, 1024 bit long modulus
.....................++++++
.........++++++
e is 65537 (0x10001)
Enter pass phrase for server.key:
Verifying - Enter pass phrase for server.key:
[root@BlackGhost ssl]# openssl req -new -key server.key -out server.csr //生成服务器证书
Enter pass phrase for server.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:cn
State or Province Name (full name) [Some-State]:cn
Locality Name (eg, city) []:cn
Organization Name (eg, company) [Internet Widgits Pty Ltd]:cn
Organizational Unit Name (eg, section) []:cn
Common Name (eg, YOUR name) []:localhost //要填全域名
Email Address []:xtaying@gmail.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:*****************
An optional company name []:
4.1 对产生的服务器证书进行签证
cp server.csr newseq.pem
1. [root@BlackGhost ssl]# ./CA.sh -sign //为服务器证书签名
2. Using configuration from /etc/ssl/openssl.cnf
3. Enter pass phrase for ./demoCA/private/cakey.pem:
4. Check that the request matches the signature
5. Signature ok
6. Certificate Details:
7. Serial Number:
8. 89:11:9f:a6:ca:03:63:ac
9. Validity
10. Not Before: Aug 7 12:39:41 2010 GMT
11. Not After : Aug 7 12:39:41 2011 GMT
12. Subject:
13. countryName = cn
14. stateOrProvinceName = cn
15. localityName = cn
16. organizationName = cn
17. organizationalUnitName = cn
18. commonName = localhost
19. emailAddress = xtaying@gmail.com
20. X509v3 extensions:
21. X509v3 Basic Constraints:
22. CA:FALSE
23. Netscape Comment:
24. OpenSSL Generated Certificate
25. X509v3 Subject Key Identifier:
26. FE:20:56:04:8E:B6:BE:3E:3A:E1:DA:A6:4A:3A:E1:16:93:1D:3F:81
27. X509v3 Authority Key Identifier:
28. keyid:26:09:F3:D5:26:13:00:1F:3E:CC:86:1D:E4:EE:37:06:65:15:4E:76
29.
30. Certificate is to be certified until Aug 7 12:39:41 2011 GMT (365 days)
31. Sign the certificate? [y/n]:y
32.
33. 1 out of 1 certificate requests certified, commit? [y/n]y
34. Write out database with 1 new entries
35. Data Base Updated
36. Certificate:
37. Data:
38. Version: 3 (0x2)
39. Serial Number:
40. 89:11:9f:a6:ca:03:63:ac
41. Signature Algorithm: sha1WithRSAEncryption
42. Issuer: C=cn, ST=cn, O=cn, OU=cn, CN=localhost/emailAddress=xtaying@gmail.com
43. Validity
44. Not Before: Aug 7 12:39:41 2010 GMT
45. Not After : Aug 7 12:39:41 2011 GMT
46. Subject: C=cn, ST=cn, L=cn, O=cn, OU=cn, CN=localhost/emailAddress=xtaying@gmail.com
47. Subject Public Key Info:
48. Public Key Algorithm: rsaEncryption
49. Public-Key: (1024 bit)
50. Modulus:
51. 00:ce:d5:a8:df:d1:e7:ee:92:d1:d1:78:20:a9:6d:
52. 0a:1b:f6:09:dd:13:29:ef:72:1d:17:54:dd:1c:8d:
53. 28:27:69:fe:70:3b:fa:2b:a3:45:40:80:ea:0e:5b:
54. a7:bd:40:d0:cd:bc:2c:74:03:8b:f7:6c:5e:1f:09:
55. 5d:c6:8a:05:ea:b8:72:fc:79:8b:62:62:38:0b:42:
56. 28:7e:0d:fc:e7:bb:b0:87:66:6a:b2:35:92:91:b9:
57. 78:9c:b6:76:01:0b:2a:74:df:5f:a1:8b:31:61:90:
58. 93:f9:20:db:46:59:12:2e:9b:59:c0:32:4e:92:14:
59. a1:7e:52:7b:cc:02:5e:e2:45
60. Exponent: 65537 (0x10001)
61. X509v3 extensions:
62. X509v3 Basic Constraints:
63. CA:FALSE
64. Netscape Comment:
65. OpenSSL Generated Certificate
66. X509v3 Subject Key Identifier:
67. FE:20:56:04:8E:B6:BE:3E:3A:E1:DA:A6:4A:3A:E1:16:93:1D:3F:81
68. X509v3 Authority Key Identifier:
69. keyid:26:09:F3:D5:26:13:00:1F:3E:CC:86:1D:E4:EE:37:06:65:15:4E:76
70.
71. Signature Algorithm: sha1WithRSAEncryption
72. 09:a0:16:43:a2:93:11:a7:ab:f5:17:b7:36:35:84:9f:3b:37:
73. 32:33:3f:93:63:b0:4c:bb:d1:b4:9b:4f:37:78:62:f4:ac:ff:
74. 28:b0:63:71:2e:9a:7c:f4:40:2e:b1:5f:ae:49:e7:e2:6f:de:
75. cf:30:cc:9a:08:26:26:24:c5:00:03:32:20:48:41:b1:29:8f:
76. 5d:3d:2a:78:54:0e:a8:76:07:6c:7f:23:42:75:c2:fb:83:1d:
77. 70:44:5e:8c:90:cf:b4:23:b7:23:5b:06:05:32:58:e3:af:1c:
78. be:1d:50:7b:fd:37:66:ba:9c:ec:bb:af:ee:b6:04:f7:c5:2e:
79. 59:22
80. -----BEGIN CERTIFICATE-----
81. MIIC2jCCAkOgAwIBAgIJAIkRn6bKA2OsMA0GCSqGSIb3DQEBBQUAMGoxCzAJBgNV
82. BAYTAmNuMQswCQYDVQQIEwJjbjELMAkGA1UEChMCY24xCzAJBgNVBAsTAmNuMRIw
83. EAYDVQQDEwlsb2NhbGhvc3QxIDAeBgkqhkiG9w0BCQEWEXh0YXlpbmdAZ21haWwu
84. Y29tMB4XDTEwMDgwNzEyMzk0MVoXDTExMDgwNzEyMzk0MVowdzELMAkGA1UEBhMC
85. Y24xCzAJBgNVBAgMAmNuMQswCQYDVQQHDAJjbjELMAkGA1UECgwCY24xCzAJBgNV
86. BAsMAmNuMRIwEAYDVQQDDAlsb2NhbGhvc3QxIDAeBgkqhkiG9w0BCQEWEXh0YXlp
87. bmdAZ21haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDO1ajf0efu
88. ktHReCCpbQob9gndEynvch0XVN0cjSgnaf5wO/oro0VAgOoOW6e9QNDNvCx0A4v3
89. bF4fCV3GigXquHL8eYtiYjgLQih+Dfznu7CHZmqyNZKRuXictnYBCyp031+hizFh
90. kJP5INtGWRIum1nAMk6SFKF+UnvMAl7iRQIDAQABo3sweTAJBgNVHRMEAjAAMCwG
91. CWCGSAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNV
92. HQ4EFgQU/iBWBI62vj464dqmSjrhFpMdP4EwHwYDVR0jBBgwFoAUJgnz1SYTAB8+
93. zIYd5O43BmUVTnYwDQYJKoZIhvcNAQEFBQADgYEACaAWQ6KTEaer9Re3NjWEnzs3
94. MjM/k2OwTLvRtJtPN3hi9Kz/KLBjcS6afPRALrFfrknn4m/ezzDMmggmJiTFAAMy
95. IEhBsSmPXT0qeFQOqHYHbH8jQnXC+4MdcERejJDPtCO3I1sGBTJY468cvh1Qe/03
96. Zrqc7Luv7rYE98UuWSI=
97. -----END CERTIFICATE-----
98. Signed certificate is in newcert.pem
[root@BlackGhost ssl]# ./CA.sh -sign //为服务器证书签名
Using configuration from /etc/ssl/openssl.cnf
Enter pass phrase for ./demoCA/private/cakey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number:
89:11:9f:a6:ca:03:63:ac
Validity
Not Before: Aug 7 12:39:41 2010 GMT
Not After : Aug 7 12:39:41 2011 GMT
Subject:
countryName = cn
stateOrProvinceName = cn
localityName = cn
organizationName = cn
organizationalUnitName = cn
commonName = localhost
emailAddress = xtaying@gmail.com
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
FE:20:56:04:8E:B6:BE:3E:3A:E1:DA:A6:4A:3A:E1:16:93:1D:3F:81
X509v3 Authority Key Identifier:
keyid:26:09:F3:D5:26:13:00:1F:3E:CC:86:1D:E4:EE:37:06:65:15:4E:76
Certificate is to be certified until Aug 7 12:39:41 2011 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
89:11:9f:a6:ca:03:63:ac
Signature Algorithm: sha1WithRSAEncryption
Issuer: C=cn, ST=cn, O=cn, OU=cn, CN=localhost/emailAddress=xtaying@gmail.com
Validity
Not Before: Aug 7 12:39:41 2010 GMT
Not After : Aug 7 12:39:41 2011 GMT
Subject: C=cn, ST=cn, L=cn, O=cn, OU=cn, CN=localhost/emailAddress=xtaying@gmail.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (1024 bit)
Modulus:
00:ce:d5:a8:df:d1:e7:ee:92:d1:d1:78:20:a9:6d:
0a:1b:f6:09:dd:13:29:ef:72:1d:17:54:dd:1c:8d:
28:27:69:fe:70:3b:fa:2b:a3:45:40:80:ea:0e:5b:
a7:bd:40:d0:cd:bc:2c:74:03:8b:f7:6c:5e:1f:09:
5d:c6:8a:05:ea:b8:72:fc:79:8b:62:62:38:0b:42:
28:7e:0d:fc:e7:bb:b0:87:66:6a:b2:35:92:91:b9:
78:9c:b6:76:01:0b:2a:74:df:5f:a1:8b:31:61:90:
93:f9:20:db:46:59:12:2e:9b:59:c0:32:4e:92:14:
a1:7e:52:7b:cc:02:5e:e2:45
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
FE:20:56:04:8E:B6:BE:3E:3A:E1:DA:A6:4A:3A:E1:16:93:1D:3F:81
X509v3 Authority Key Identifier:
keyid:26:09:F3:D5:26:13:00:1F:3E:CC:86:1D:E4:EE:37:06:65:15:4E:76
Signature Algorithm: sha1WithRSAEncryption
09:a0:16:43:a2:93:11:a7:ab:f5:17:b7:36:35:84:9f:3b:37:
32:33:3f:93:63:b0:4c:bb:d1:b4:9b:4f:37:78:62:f4:ac:ff:
28:b0:63:71:2e:9a:7c:f4:40:2e:b1:5f:ae:49:e7:e2:6f:de:
cf:30:cc:9a:08:26:26:24:c5:00:03:32:20:48:41:b1:29:8f:
5d:3d:2a:78:54:0e:a8:76:07:6c:7f:23:42:75:c2:fb:83:1d:
70:44:5e:8c:90:cf:b4:23:b7:23:5b:06:05:32:58:e3:af:1c:
be:1d:50:7b:fd:37:66:ba:9c:ec:bb:af:ee:b6:04:f7:c5:2e:
59:22
-----BEGIN CERTIFICATE-----
MIIC2jCCAkOgAwIBAgIJAIkRn6bKA2OsMA0GCSqGSIb3DQEBBQUAMGoxCzAJBgNV
BAYTAmNuMQswCQYDVQQIEwJjbjELMAkGA1UEChMCY24xCzAJBgNVBAsTAmNuMRIw
EAYDVQQDEwlsb2NhbGhvc3QxIDAeBgkqhkiG9w0BCQEWEXh0YXlpbmdAZ21haWwu
Y29tMB4XDTEwMDgwNzEyMzk0MVoXDTExMDgwNzEyMzk0MVowdzELMAkGA1UEBhMC
Y24xCzAJBgNVBAgMAmNuMQswCQYDVQQHDAJjbjELMAkGA1UECgwCY24xCzAJBgNV
BAsMAmNuMRIwEAYDVQQDDAlsb2NhbGhvc3QxIDAeBgkqhkiG9w0BCQEWEXh0YXlp
bmdAZ21haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDO1ajf0efu
ktHReCCpbQob9gndEynvch0XVN0cjSgnaf5wO/oro0VAgOoOW6e9QNDNvCx0A4v3
bF4fCV3GigXquHL8eYtiYjgLQih+Dfznu7CHZmqyNZKRuXictnYBCyp031+hizFh
kJP5INtGWRIum1nAMk6SFKF+UnvMAl7iRQIDAQABo3sweTAJBgNVHRMEAjAAMCwG
CWCGSAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNV
HQ4EFgQU/iBWBI62vj464dqmSjrhFpMdP4EwHwYDVR0jBBgwFoAUJgnz1SYTAB8+
zIYd5O43BmUVTnYwDQYJKoZIhvcNAQEFBQADgYEACaAWQ6KTEaer9Re3NjWEnzs3
MjM/k2OwTLvRtJtPN3hi9Kz/KLBjcS6afPRALrFfrknn4m/ezzDMmggmJiTFAAMy
IEhBsSmPXT0qeFQOqHYHbH8jQnXC+4MdcERejJDPtCO3I1sGBTJY468cvh1Qe/03
Zrqc7Luv7rYE98UuWSI=
-----END CERTIFICATE-----
Signed certificate is in newcert.pem
cp newcert.pem server.crt
5,产生客户端证书
生成客户私钥：
openssl genrsa -des3 -out client.key 1024
生成客户证书
openssl req -new -key client.key -out client.csr
签证：
openssl ca -in client.csr -out client.crt
转换成pkcs12格式，为客户端安装所用
openssl pkcs12 -export -clcerts -in client.crt -inkey client.key -out client.pfx
这一步根安装服务器的证书差不多，不同的是签证，最后安装的时候，client.pfx的密码要记住，在客户端安装的时候要用到的。
[root@BlackGhost ssl]# openssl pkcs12 -export -clcerts -in client.crt -inkey client.key -out client.pfx
Enter pass phrase for client.key:
Enter Export Password:
Verifying - Enter Export Password:
客户端和服务器端都可以使用服务器端证书，所以这一步不做也行。
6，集中所以证书和私私钥到一起
#cp demoCA/cacert.pem cacert.pem
同时复制一份证书，更名为ca.crt
#cp cacert.pem ca.crt
7，apache配置
vi /usr/local/apache/conf/extra/ssl.conf
1. ssl开启
2. SSLEngine on
3.
4. 指定服务器证书位置
5. SSLCertificateFile /usr/local/apache/conf/ssl/server.crt
6.
7. 指定服务器证书key位置
8. SSLCertificateKeyFile /usr/local/apache/conf/ssl/server.key
9.
10. 证书目录
11. SSLCACertificatePath /usr/local/apache/conf/ssl
12.
13. 根证书位置
14. SSLCACertificateFile /usr/local/apache/conf/ssl/cacert.pem
15.
16. 要求客户拥有证书
17. SSLVerifyClient require
18. SSLVerifyDepth 1
19. SSLOptions +StdEnvVars
20.
21. 记录log
22. CustomLog "/usr/local/apache/logs/ssl_request_log" \
23. "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
ssl开启
SSLEngine on
指定服务器证书位置
SSLCertificateFile /usr/local/apache/conf/ssl/server.crt
指定服务器证书key位置
SSLCertificateKeyFile /usr/local/apache/conf/ssl/server.key
证书目录
SSLCACertificatePath /usr/local/apache/conf/ssl
根证书位置
SSLCACertificateFile /usr/local/apache/conf/ssl/cacert.pem
要求客户拥有证书
SSLVerifyClient require
SSLVerifyDepth 1
SSLOptions +StdEnvVars
记录log
CustomLog "/usr/local/apache/logs/ssl_request_log" \
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
vi /usr/local/apache/conf/extra/httpd_vhosts.conf
1. listen 443 https
2. NameVirtualHost *:443
3.
