一 https介紹以及實現機制
1. https協議：
在傳統的http協議中，文檔是明文傳送的，網頁涉及敏感信息是，將變得很不安全。為了保證敏感信息的安全，httpd結合加密庫openssl或openssh 產生了https 協議。這就好比兩個黑社會團伙交易，都怕出事被抓，于是在交易之前先又各自派出去的打手保證現場治安，保證對方的貨沒問題并且對面來的不是警察臥底。
基本上https協議可以理解為，在TCP/IP協議上面再加半層openssl會話協議，用于進行身份認證，加密算法協商，密鑰交換，協商數據加密使用的密碼等工作。openssl會話完成后，再繼續進行httpd會話。
由于openssl會話是發生在http會話之前，此時還不存在http首部的概念，所以基于主機名（FQDN）的虛擬主機將不適用，因此如果使用https協議，一個ip只能有一個主機。
不得不說的是，https傳輸的方式是二進制傳輸，就算傳輸的二進制流被截獲了也無法再次還原成有意義的信息，由此保證了信息安全。
2. x509.3證書格式
3. PKI；Public Key Infrastructure， 在openssl中用于實現證書簽發相關工作： 具體工作如下
端實體(申請者）
注冊機構(RC)
簽證機構(CA)–>簽證機構(CA)
證書撤消列表(CRL)發布機構
證書存取庫
4. SSL握手要完成的工作：
交換協議版本號
選擇雙方都支持的加密方式
對兩端實現身份驗正
密鑰交換
5. 客戶端驗正服務器證書時：
日期檢測：證書是否在有效期內
證書頒發者的可信度：
證書的簽名檢測：
持有者的身份檢測：
二 https的配置過程
1. 準備服務器的私鑰和證書，為了方便起見，本機將作為CA同時也作為被發證者
1） 自封為CA， 創建自簽證書
在/etc/pki/CA/private目錄下創建CA私鑰 # cd /etc/pki/CA/ # (umask 077; openssl genrsa 2048 > private/cakey.pem) Generating RSA private key, 2048 bit long modulus .......+++ ......................................+++ e is 65537 (0x10001) 創建子簽CA證書 # openssl req -new -x509 -key private/cakey.pem -days 3650 -out cacert.pem You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:SG State or Province Name (full name) []:Singapore Locality Name (eg, city) [Default City]:Singapore Organization Name (eg, company) [Default Company Ltd]:DUKE-NUS Organizational Unit Name (eg, section) []:CVMD Common Name (eg, your name or your server's hostname) []:www.playground.com Email Address []: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: 創建openssl需要的文件 # cd /etc/pki/CA # touch index.txt serial crlnumber # echo 01 > serial 為web服務器創建秘鑰 # mkdir /etc/httpd/conf/ssl # cd /etc/htpd/conf/ssl # (umask 077; openssl genrsa 1024 > httpd.key) Generating RSA private key, 1024 bit long modulus .......................................................++++++ ..........................................................................................++++++ e is 65537 (0x10001) 為web服務器創建證書簽署請求 # openssl req -new -key httpd.key -out httpd.csr You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:SG State or Province Name (full name) []:Singapore Locality Name (eg, city) [Default City]:Singapore Organization Name (eg, company) [Default Company Ltd]:DUKE-NUS Organizational Unit Name (eg, section) []:CVMD Common Name (eg, your name or your server's hostname) []:www.playground.com Email Address []: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: 用之前創建的CA子簽證書，做證書簽署 # openssl ca -in httpd.csr -out httpd.crt -days 365 Using configuration from /etc/pki/tls/openssl.cnf Check that the request matches the signature Signature ok Certificate Details: Serial Number: 1 (0x1) Validity Not Before: Oct 18 18:00:55 2014 GMT Not After : Oct 18 18:00:55 2015 GMT Subject: countryName = SG stateOrProvinceName = Singapore organizationName = DUKE-NUS organizationalUnitName = CVMD commonName = www.playground.com X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: 08:CD:C2:E2:39:D4:8E:3C:3E:6B:18:3D:54:23:7E:D8:32:55:42:7A X509v3 Authority Key Identifier: keyid:9A:30:36:6E:2C:EA:2C:DD:D8:A9:67:F7:28:41:8F:81:20:F6:75:F2 Certificate is to be certified until Oct 18 18:00:55 2015 GMT (365 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated
2. 安裝mod_ssl模塊，是的httpd支持https
# yum -y install mod_ssl # rpm -ql mod_ssl /etc/httpd/conf.d/ssl.conf /usr/lib64/httpd/modules/mod_ssl.so /var/cache/mod_ssl /var/cache/mod_ssl/scache.dir /var/cache/mod_ssl/scache.pag /var/cache/mod_ssl/scache.sem
3. 配置mod_ssl模塊配置文件，使得支持https功能
/etc/httpd/conf.d/ssl.conf 配置下面幾行 ServerName www.playground.com:443 DocumentRoot "/var/www/html" SSLCertificateFile /etc/httpd/conf/ssl/httpd.crt SSLCertificateKeyFile /etc/httpd/conf/ssl/httpd.key
4. 重啟服務，在宿主機windows中hosts中添加，服務器解析條目,并且CA安裝到windows上（cacert.pem改改為cacert.crt），嘗試瀏覽。
## windows hosts 文件中添加解析條目 192.168.233.128
使用命令行工具s_client 測試,一下結果說明驗證成功 # openssl s_client -CAfile /etc/pki/CA/cacert.pem -connect www.playground.com:443 CONNECTED(00000003) depth=1 C = SG, ST = Singapore, L = "Singapore ", O = DUKE-NUS, OU = CVMD, CN = www.playground.com verify return:1 depth=0 C = SG, ST = Singapore, O = DUKE-NUS, OU = CVMD, CN = www.playground.com verify return:1 --- Certificate chain 0 s:/C=SG/ST=Singapore/O=DUKE-NUS/OU=CVMD/CN=www.playground.com i:/C=SG/ST=Singapore/L=Singapore /O=DUKE-NUS/OU=CVMD/CN=www.playground.com --- Server certificate -----BEGIN CERTIFICATE----- MIIDRzCCAi+gAwIBAgIBATANBgkqhkiG9w0BAQUFADB1MQswCQYDVQQGEwJTRzES MBAGA1UECAwJU2luZ2Fwb3JlMRMwEQYDVQQHDApTaW5nYXBvcmUgMREwDwYDVQQK DAhEVUtFLU5VUzENMAsGA1UECwwEQ1ZNRDEbMBkGA1UEAwwSd3d3LnBsYXlncm91 bmQuY29tMB4XDTE0MTAxODE4MDA1NVoXDTE1MTAxODE4MDA1NVowYDELMAkGA1UE BhMCU0cxEjAQBgNVBAgMCVNpbmdhcG9yZTERMA8GA1UECgwIRFVLRS1OVVMxDTAL BgNVBAsMBENWTUQxGzAZBgNVBAMMEnd3dy5wbGF5Z3JvdW5kLmNvbTCBnzANBgkq hkiG9w0BAQEFAAOBjQAwgYkCgYEA6GFOKs1SpbFyI/D7yflpOIhnpj0CxP+sY39M eCszdoetwSS3YtSf0/6yEpqbn0v+kh49y4Ngm1mBPZsXnilR+YoLwS8aBN7Gq40F MwS8pvWbZ0q8DzuUQF6UiNFyHnpZaHPuSom5Ytwgl5+ouEqW/4LbSZnnbRf7nnWK 69A3o20CAwEAAaN7MHkwCQYDVR0TBAIwADAsBglghkgBhvhCAQ0EHxYdT3BlblNT TCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFAjNwuI51I48PmsYPVQj ftgyVUJ6MB8GA1UdIwQYMBaAFJowNm4s6izd2Kln9yhBj4Eg9nXyMA0GCSqGSIb3 DQEBBQUAA4IBAQCfFDO8r9UxfqBogokCYtoOlWEmuMeEZ0Phzrb52k2KgvWSOtY0 Lz5fdcpPw51PAqxPrS0Bk6vYq9vxJ/nyJjspCdUny8oqxTFEvFjYYUT1c2YwVR3k Se4bjLaK0A+neIXe+zrWfje5Zs/lvvbNhKTRus9GlyldhvausRWfuYgXX547gBZI 1uU+CUe8fJp5I165rWi9VgQFXidre6+/KUBEHWQtfSAaYC0rlOopM6MWpNsWr5KM XLPoeDWL0msH3b44dDq1KBOTtEjhtcjTCMtwnBr8yvt2PFrX5sDcxTFea25NT0Hp nDjidvHMbE5OAcpBwwGPG/NGdR0k80aGOoh9 -----END CERTIFICATE----- subject=/C=SG/ST=Singapore/O=DUKE-NUS/OU=CVMD/CN=www.playground.com issuer=/C=SG/ST=Singapore/L=Singapore /O=DUKE-NUS/OU=CVMD/CN=www.playground.com --- No client certificate CA names sent Server Temp Key: ECDH, prime256v1, 256 bits --- SSL handshake has read 1406 bytes and written 375 bytes --- New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384 Server public key is 1024 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES256-GCM-SHA384 Session-ID: E63943DDDF517B0DC893F360F707DF4695BA494E225DC452B6CCD3F2EB38F2BF Session-ID-ctx: Master-Key: 92C9392B907FCB8C939EEA296BD5260EBD877FF71E62BCBE26320FBED3E4B737F350A4D7531D5E14DB7F0153569DDBC9 Key-Arg : None Krb5 Principal: None PSK identity: None PSK identity hint: None TLS session ticket lifetime hint: 300 (seconds) TLS session ticket: 0000 - e1 ac 2f b2 0b db 8a 97-62 7a 03 f5 02 a0 b2 6e ../.....bz.....n 0010 - f3 4e d5 ec ce a1 90 09-ce 4a 58 39 e5 80 96 d5 .N.......JX9.... 0020 - 0d df 7a 92 fd 56 70 cc-2a 29 39 e3 b3 15 a1 96 ..z..Vp.*)9..... 0030 - 0c d5 0d 4d 9e 29 4c 36-9e 97 8c c6 7d bd 63 93 ...M.)L6....}.c. 0040 - 34 79 f0 d3 e9 99 4d eb-64 bd cc 8e a5 56 ab a9 4y....M.d....V.. 0050 - 9e 4c c7 79 da 4d 25 e4-1c 03 8f 2d 50 e0 e7 c2 .L.y.M%....-P... 0060 - 57 d6 b6 1c 32 b4 02 f0-9f aa f3 64 b6 36 82 c5 W...2......d.6.. 0070 - 26 e5 b7 76 fe a8 37 6f-df af 00 c2 27 01 c6 cf &..v..7o....'... 0080 - 9b 46 8c 61 9e d0 a3 e6-1f b1 fe d6 30 5b 64 81 .F.a........0[d. 0090 - 78 03 a2 f8 ba 74 79 4b-76 9e e6 52 65 09 fa 15 x....tyKv..Re... 00a0 - 6c ce b5 ed 1e 7c 2e dc-83 7f 1f 56 c6 98 01 e7 l....|.....V.... 00b0 - be 4e dd 9e b9 16 cf 7f-13 70 ed 1c 84 ed c8 b7 .N.......p...... Start Time: 1413657128 Timeout : 300 (sec) Verify return code: 0 (ok) --- GET /index.html <html> <head> <title>hello World </title> </head> <body> hello World! </body> </html> closed
原創文章，作者：以馬內利，如若轉載，請注明出處：http://www.www58058.com/4671
