开发者社区> 技术小胖子> 正文

Centos6.3下apache实现SSL虚拟主机双向认证

简介:
+关注继续查看

   很久没有更新LAMP的相关文档了,刚好最近单位做项目需要用到apache的SSL虚拟主机双向认证,刚好之前在做LAMP的时候顺带做过SSL模块加载,SO参考了google大量文档,用了半天时间搞定,这里总结出来给大家分享一下。


     该方案是为了实现apache下实现SSL虚拟主机双向认证,从而实现可信任用户才能访问具体虚拟站点,实现了数据加密以及双向可靠认证。


我的博客新站已经建好,更多新的内容即将在新站更新。。

欢迎访问     http://www.showerlee.com


LINUX操作系统:  centOS6.3 64bit(安装系统默认开发包)

APACHE:         httpd-2.4.4

SSL:            ssl.ca-0.1


180820113.jpg

解决方案:


一.关闭iptables和SELINUX

# service iptables stop

# setenforce 0

# vi /etc/sysconfig/selinux

---------------

SELINUX=disabled

---------------


二.编译安装apache


1.安装pcre依赖包

# wget http://sourceforge.net/projects/pcre/files/pcre/8.32/pcre-8.32.tar.gz/download

# tar -xzvf pcre-8.32.tar.gz

# cd pcre-8.32

# ./configure --prefix=/usr/local/pcre

# make && make install


2.apache配置:

1).下载apache与apr编译包

# wget http://archive.apache.org/dist/httpd/httpd-2.4.3-deps.tar.bz2

# wget http://archive.apache.org/dist/httpd/httpd-2.4.4.tar.bz2


2).将apache与apr编译包整合

注:httpd-2.4.3-deps.tar.bz2已集成APR,安装apache前检查pcre是否安装成功.

# tar jxvf httpd-2.4.4.tar.bz2

# tar jxvf httpd-2.4.3-deps.tar.bz2

# cp -rf httpd-2.4.3/* httpd-2.4.4


3).编译安装(加载mod_ssl模块)

# cd httpd-2.4.4

# ./configure --prefix=/usr/local/apache2 --enable-so --enable-rewrite  -enable-ssl=static -with-ssl=/usr/local/ssl -enable-mods-shared=all --with-pcre=/usr/local/pcre/bin/pcre-config

# make && make install

注:编译过程中如果报错:

----------------------------------

checking for OpenSSL version >= 0.9.7… FAILED

configure: WARNING:  OpenSSL version is too old

no

checking whether to enable mod_ssl…  configure: error: mod_ssl has been requested but can not be built due to  prerequisite failures

-----------------------------------

解决办法

# yum install openssl-devel -y

# yum update openssl -y


三.SSL单向认证配置


1.加载ssl配置文件:

# vi /usr/local/apache2/conf/httpd.conf

搜索"Include conf/extra/httpd-ssl.conf", 并将这行前面的"#"去掉


2.配置ssl:

# vi /usr/local/apache2/conf/extra/httpd-ssl.conf

搜索"shmcb:/usr/local/apache2/logs/ssl_scache(512000)",并将这行加"#"注释掉

确认以下几行配置无误:

----------------------------

Listen 443

SSLEngine on

SSLCertificateFile "/usr/local/apache2/conf/server.crt"

SSLCertificateKeyFile "/usr/local/apache2/conf/server.key"

SSLCACertificateFile "/usr/local/apache2/conf/ca.crt"

----------------------------


3.证书配置:

1).下载并解压ssl证书生成压缩包:

# cd /usr/local/apache2/conf

# wget http://www.openssl.org/contrib/ssl.ca-0.1.tar.gz

# tar zxvf ssl.ca-0.1.tar.gz

# cd ssl.ca-0.1


2).利用ssl内脚本生成根证书:

# ./new-root-ca.sh  

---------------------------------------------------

No Root CA key round. Generating one

Generating RSA private key, 1024 bit  long modulus

………………………++++++

….++++++

e is 65537 (0×10001)

Enter  pass phrase for ca.key: (输入一个密码)

Verifying – Enter pass phrase for ca.key:  (再输入一次密码)

……

Self-sign the root CA… (签署根证书)

Enter pass phrase for  ca.key: (输入刚刚设置的密码)

……..

…….. (下面开始签署)

Country Name (2 letter code)  [MY]:CN

State or Province Name (full name) [Perak]:JiangSu

Locality Name  (eg, city) [Sitiawan]:NanJing

Organization Name (eg, company) [My Directory  Sdn Bhd]:example Co.,Ltd

Organizational Unit Name (eg, section)  [Certification Services Division]:example

Common Name (eg, MD Root CA)  []:example

Email Address []:info@example.com

--------------------------------------------------

这样就生成了ca.key和ca.crt两个文件


3).生成服务端证书:

# ./new-server-cert.sh server  

注:证书名为server

----------------------------------------------------

……

……

Country Name (2 letter code) [MY]:CN

State or  Province Name (full name) [Perak]:JiangSu

Locality Name (eg, city)  [Sitiawan]:NanJing

Organization Name (eg, company) [My Directory Sdn  Bhd]:example Co.,Ltd

Organizational Unit Name (eg, section) [Secure Web  Server]:example

Common Name (eg, www.domain.com)  []:www.example.com

Email Address  []:info@example.com

-----------------------------------------------------

这样就生成了server.csr和server.key这两个文件。


4).签署服务端证书:

#  ./sign-server-cert.sh server

-------------------------------------------------

CA signing: server.csr ->  server.crt:

Using configuration from ca.config

Enter pass phrase for  ./ca.key: (输入上面设置的根证书密码)

Check that the request matches the  signature

Signature ok

The Subject’s Distinguished Name is as  follows

countryName   RINTABLE:’CN

stateOrProvinceName   RINTABLE:’JiangSu

localityName   RINTABLE:’NanJing

organizationName   RINTABLE:’example Co.,Ltd

organizationalUnitName:PRINTABLE:’example

commonName   RINTABLE:’www.example.com

emailAddress  :IA5STRING:’info@example.com

Certificate is to be certified until Jul 16  12:55:34 2005 GMT (365 days)

Sign the certificate? [y/n]:y

1 out of 1  certificate requests certified, commit? [y/n]y

Write out database with 1 new  entries

Data Base Updated

CA verifying: server.crt <-> CA  cert

server.crt: OK

-------------------------------------------

注:如果这里出现错误,最好重新来过,删除ssl.ca-0.1这个目录,从解压缩处重新开始。

下面要按照httpd-ssl.conf的设置,将证书放在适当的位置。


5).配置证书相关权限和路径:

# cd /usr/local/apache2/conf/ssl.ca-0.1

# chmod 644 server.key server.crt ca.crt

# mv server.key ..

# mv server.crt ..

# mv ca.crt ..


4.配置https实现SSL虚拟主机单向加密

1).加载虚拟主机配置文件:

# vi /usr/local/apache2/conf/httpd.conf

搜索"Include conf/extra/httpd-vhosts.conf", 并将这行前面的"#"去掉


2).让www.example.com虚拟主机实现https访问

# vi /usr/local/apache2/conf/extra/httpd-vhosts.conf

添加如下内容:

---------------------------

<VirtualHost *:443>

  DocumentRoot "/usr/local/apache2/htdocs/www.example.com/"

  ServerAlias www.example.com

  SSLEngine on

  SSLCertificateFile "/usr/local/apache2/conf/server.crt"

  SSLCertificateKeyFile "/usr/local/apache2/conf/server.key"

  SSLCACertificateFile "/usr/local/apache2/conf/ca.crt"

</VirtualHost>

----------------------------

# cd /usr/local/apache2/htdocs

# mkdir www.example.com

# cd www.example.com/

# echo "this is a test SSL web page" > index.html


3).启动服务:

# /usr/local/apache2/bin/apachectl start


4).查看SSL端口是否打开:

# lsof -i:443

---------------------------------

COMMAND    PID   USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME

httpd   125366   root    6u  IPv6 6351523      0t0  TCP *:https (LISTEN)

httpd   125885 daemon    6u  IPv6 6351523      0t0  TCP *:https (LISTEN)

httpd   125886 daemon    6u  IPv6 6351523      0t0  TCP *:https (LISTEN)

httpd   125887 daemon    6u  IPv6 6351523      0t0  TCP *:https (LISTEN)

httpd   125946 daemon    6u  IPv6 6351523      0t0  TCP *:https (LISTEN)

---------------------------------


5).浏览器输入 https://www.example.com

注:需配置本机HOST文件

如图:


140312520.png



四.SSL双向认证配置:


1.为客户端生成一个证书:

# /usr/local/apache2/conf/ssl.ca-0.1

# ./new-user-cert.sh client1

-----------------------------------------

No client1.key round. Generating one

Generating RSA private key, 1024 bit long modulus

...........++++++

...++++++

e is 65537 (0x10001)


Fill in certificate data

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Common Name (eg, John Doe) []:client1

Email Address []:info@example.com


You may now run ./sign-user-cert.sh to get it signed

-------------------------------------------


2.签署该证书:

# ./sign-user-cert.sh client1

--------------------------------------

CA signing: client1.csr -> client1.crt:

Using configuration from ca.config

Enter pass phrase for ./ca.key: (输入ca根认证密码)

Check that the request matches the signature

Signature ok

The Subject's Distinguished Name is as follows

commonName            :PRINTABLE:'client1'

emailAddress          :IA5STRING:'info@example.com'

Certificate is to be certified until Aug  8 08:41:51 2014 GMT (365 days)

Sign the certificate? [y/n]:y



1 out of 1 certificate requests certified, commit? [y/n]y

Write out database with 1 new entries

Data Base Updated

CA verifying: client1.crt <-> CA cert

client1.crt: OK

------------------------------------


3.将该客户端证书转换成浏览器可识别的.p12格式

# ./p12.sh client1

-------------------------------------

Enter Export Password: (输入ca根认证密码)

Verifying - Enter Export Password: (确认)


The certificate for client1 has been collected into a pkcs12 file.

You can download to your browser and import it.

--------------------------------------

# ll client1.p12

--------------------------------------

-rw-r--r-- 1 root root 2601 8月   8 16:44 client1.p12

--------------------------------------


4.将该p12文件分发给可信任的客户端,实现双向证书加密功能

注:此处将该文件传送到本机作为示例,实际线上可以利用程序实现证书认证下载

# sz client1.p12


5.配置https实现SSL虚拟主机双向加密

# vi /usr/local/apache2/conf/extra/httpd-vhosts.conf

添加如下内容:

----------------------------

<VirtualHost *:443>

   DocumentRoot "/usr/local/apache2/htdocs/www.example.com/"

   ServerAlias www.example.com

   SSLEngine on

   SSLCertificateFile "/usr/local/apache2/conf/server.crt"

   SSLCertificateKeyFile "/usr/local/apache2/conf/server.key"

   SSLCACertificateFile  "/usr/local/apache2/conf/ca.crt"

   SSLVerifyClient require

   SSLVerifyDepth 10

</VirtualHost>

----------------------------


6.测试结果

1).使用Chrome浏览器输入 https://www.example.com

未导入客户端证书,提示SSL连接出错

172206375.png


2).SO导入证书:

a.windows下运行该证书文件

170928998.png

b.进入证书导入向导,一路下一步即可完成操作

170931693.png

170933776.png

这里输入ca根证书密码

170934244.png

170936164.png

170939434.png

171226664.png


170943130.png


重新使用Chrome浏览器输入 https://www.example.com

提示

172728980.png

172337224.png


172114402.png


大功告成...




     本文转自 showerlee 51CTO博客,原文链接:http://blog.51cto.com/showerlee/1266712,如需转载请自行联系原作者





版权声明:本文内容由阿里云实名注册用户自发贡献,版权归原作者所有,阿里云开发者社区不拥有其著作权,亦不承担相应法律责任。具体规则请查看《阿里云开发者社区用户服务协议》和《阿里云开发者社区知识产权保护指引》。如果您发现本社区中有涉嫌抄袭的内容,填写侵权投诉表单进行举报,一经查实,本社区将立刻删除涉嫌侵权内容。

相关文章
SSL 数字证书-Apache 证书配置部署|学习笔记
快速学习 SSL 数字证书-Apache 证书配置部署
50 0
国密SSL协议之Apache集成
Apache httpd自身支持标准的SSL协议,但并不支持国密SSL协议。本文描述了Apache httpd配置的国密SSL协议(单向)的完整过程,仅供学习和参考之用。
1105 0
在 Apache 服务器上安装 SSL 证书
阿里云SSL证书服务支持下载证书安装到Apache服务器,从而使Apache服务器支持HTTPS安全访问。本文主要为大家介绍证书安装的具体操作。
1095 0
PHPStudy下Apache SSL证书安装教程
成功在沃通申请SSL证书后,会得到一个压缩包文件,解压后得到四个文件:for Apache、for IIS、for Ngnix、 for Other Server,Apache 上需要用到 for Apache解压出来的证书文件以及自主生成的私钥.key文件。
3095 0
Linux服务器---apache支持ssl
[b]Apache支持ssl[/b] 1、检测是否安装ssl模块,如果没有就安装       [root@localhost cgi-bin]#[b] rpm -qa | grep mod_ssl           //查看是否安装ssl模块[/b]       [root@localhost .
1177 0
Confluence 6 使用 Apache 和 mod_proxy 添加 SSL和其他
添加 SSL 如果你计划在你的应用中启用 SSL ,请参考 Securing your Atlassian applications with Apache using SSL 页面中的内容,并确定你在相同的连接器中选择 HTTPS。
991 0
+关注
技术小胖子
文章
问答
视频
文章排行榜
最热
最新
相关电子书
更多
Apache NiFi Crash Course Intro
立即下载
低代码开发师(初级)实战教程
立即下载
阿里巴巴DevOps 最佳实践手册
立即下载
相关镜像