22_02基于OpenSSL的https服务配置

192.168.100.8(CA)

#cd /etc/pki/CA 
#(umask 077;openssl genrsa -out private/cakey.pem 2048) 
#vim ../tls/openssl.conf 
#openssl req -new -x509 -key private/cakey.pem -out cacert.pem 3655 
    ca.unravel.com 
dir  =/etc/pki/CA 
#mkdir certs crl newcerts 
#touch index.txt 
#echo 01 >serial 
 
192.168.100.1 
#yum install mod_ssl 
#cd /etc/httpd && mkdir ssl &&cd ssl/ 
#(umask 077;openssl genrsa 1024 > httpd.key) 
#openssl  req -new -key httpd.key -out httpd.csr 
    www.test.com 
 
192.168.100.8 
openssl ca -in /tmp/httpd.csr -out /tmp/httpd.crt -days 3650 
 
192.168.100.1 
#cd /etc/httpd/conf.d/ && cp ssl.conf ssl.conf.bak 
#vim ssl.conf 
 
<VirtualHost (www.test.com)IP:443> 
ServerName www.test.com 
DocumentRoot "/var/www/test.com" 
SSLEngine ON 
SSLCertificateFile /etc/httpd/ssl/httpd.crt 
SSLCertificateKeyFile /etc/httpd/ssl/httpd.key 
即可。 

浏览器会提示这个证书不可靠
把CA的证书安装到客户端的主机上即可，并且把名字改为cacert.crt….

#加密傳輸:
更多強烈建議閱讀官方文檔

高級別加密

赏

谢谢你请我吃糖果

支付宝