https
超文本傳輸安全協議（英語：Hypertext Transfer Protocol Secure，縮寫：HTTPS，也被稱為HTTP over TLS，HTTP over SSL或HTTP Secure）是一種網絡安全傳輸協議。在計算機網絡上，HTTPS經由超文本傳輸協議進行通信，但利用SSL/TLS來對數據包進行加密。HTTPS開發的主要目的，是提供對網絡服務器的身份認證，保護交換數據的隱私與完整性。這個協議由網景公司（Netscape）在1994年首次提出，隨后擴展到互聯網上。
配置步驟：
A、為服務器申請數字證書
B、配置httpd支持ssl協議以及使用的證書
C、測試基于https訪問的相應主機
建一臺私有CA
注意：最好找一臺CentOS 7版本的將私有CA，否則，CA的加密等級太低。瀏覽器報錯。如果只能在CentOS 6上面操作，編輯/etc/pki/tls/openssl.cnf中的default_md = sha1為sha256
(umask 077;openssl genrsa -out private/cakey.pem 1024 -md md5)
openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 3650
touch serial index.txt
echo 01 > serial
配置httpd支持ssl協議以及使用證書
rpm包安裝的httpd
使用rpm安裝的httpd，需要安裝mod_ssl包，可以直接安裝rpm包。安裝完成后，先申請證書：
(umask 077;openssl genrsa -out http.key 2048)
openssl req -new -key http.key -out http.csr
生成后傳給CA服務器簽發證書：
openssl ca -in /tmp/http.csr -out certs/http.crt -days 2000
簽發完成后，傳回httpd服務器。
安裝完成mod_ssl后，會生成配置文件：/etc/httpd/conf.d/ssl.conf，打開文件，配置：
...
76 # General setup for the virtual host, inherited from global configuration
77 DocumentRoot "/var/www/html" ##網頁存放位置
78 #ServerName www.example.com:443
79 ServerName www.roger.com ##主機名字
...
02 # Point SSLCertificateFile at a PEM encoded certificate. If
103 # the certificate is encrypted, then you will be prompted for a
104 # pass phrase. Note that a kill -HUP will prompt again. A new
105 # certificate can be generated using the genkey(1) command.
106 SSLCertificateFile /etc/httpd/conf/ssl/http.crt ##證書位置
107
108 # Server Private Key:
109 # If the key is not combined with the certificate, use this
110 # directive to point at the key file. Keep in mind that if
111 # you've both a RSA and a DSA private key you can configure
112 # both in parallel (to also allow the use of DSA ciphers, etc.)
113 SSLCertificateKeyFile /etc/httpd/conf/ssl/http.key ##私鑰位置
...
完成后檢查配置文件語法：
[root:ssl]# httpd -t
Syntax OK
沒有問題后重啟服務，查看端口：
[root:ssl]# ss -ntal
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 :::80 :::*
LISTEN 0 3 ::1:53 :::*
LISTEN 0 3 172.16.253.113:53 *:*
LISTEN 0 3 127.0.0.1:53 *:*
LISTEN 0 128 :::22 :::*
LISTEN 0 128 *:22 *:*
LISTEN 0 100 ::1:25 :::*
LISTEN 0 100 127.0.0.1:25 *:*
LISTEN 0 128 ::1:953 :::*
LISTEN 0 128 127.0.0.1:953 *:*
LISTEN 0 128 :::443 :::*
測試基于https訪問的相應主機
確定80端口和443端口啟動后，使用以下命令測試：
openssl s_client -connect 172.16.253.113:443 -CAfile cacert.pem
沒有報錯且出現下面的情況：
CONNECTED(00000003)
depth=0 C = CN, ST = beijing, O = roger, OU = it, CN = www.roger.com
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 C = CN, ST = beijing, O = roger, OU = it, CN = www.roger.com
verify error:num=27:certificate not trusted
verify return:1
depth=0 C = CN, ST = beijing, O = roger, OU = it, CN = www.roger.com
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
0 s:/C=CN/ST=beijing/O=roger/OU=it/CN=www.roger.com
i:/C=CN/ST=beijing/L=beijing/O=roger/OU=it/CN=www.roger.com
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIDLzCCApigAwIBAgIBATANBgkqhkiG9w0BAQsFADBmMQswCQYDVQQGEwJDTjEQ
MA4GA1UECAwHYmVpamluZzEQMA4GA1UEBwwHYmVpamluZzEOMAwGA1UECgwFcm9n
ZXIxCzAJBgNVBAsMAml0MRYwFAYDVQQDDA13d3cucm9nZXIuY29tMB4XDTE2MTIx
MzA5NDc0NloXDTI2MDkxMjA5NDc0NlowVDELMAkGA1UEBhMCQ04xEDAOBgNVBAgM
B2JlaWppbmcxDjAMBgNVBAoMBXJvZ2VyMQswCQYDVQQLDAJpdDEWMBQGA1UEAwwN
d3d3LnJvZ2VyLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALsU
EmVS/foKbeMal61vO2Yk04Phs7OpC7pxypJGExio88X3FU185xZiB02ELWNWm/wM
C3v3JB4Ss3OYluH6YCXl0AwR2aT97WYkNogntEeyaFKURl7HXxehBwlLmz9FpCe7
0r5zzQ7sZB5QYc6fAM59CrJhRjTyiMv+znfxyLph5p8JbtwZPYU3H/USZDmudP1M
odFwENHY1Ik8hCOx+J/J8TadNu+JmAtuMfEDTeZs9ESlrqv1c89Sk6pg9X9AkB8X
MEizvfebWMieOYBu+dQ817eKsnqU7J4c5I2Hzy7LKOS+2xP0zZHIU8RpGdyQMFYx
7wZ2K7O+0FQLFqZOYLsCAwEAAaN7MHkwCQYDVR0TBAIwADAsBglghkgBhvhCAQ0E
HxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFPSWw5I7
x0a3AhSro8S0bw2mqOI6MB8GA1UdIwQYMBaAFBP6ncoGlGp7iIcSXMkdNFcjLKIH
MA0GCSqGSIb3DQEBCwUAA4GBAH0LQdNyekfgvEEc32pCsOKxcAjHD8bo3RwzbDRi
CQuBDOJs49U7eSqgOhRXPcHk3oy+SCy6SMYMZQ//ayfrRG0GUM44cFhfgIpN+3Y7
xJDUxzPhT4MU9rFflPmLyyzSJ+UM3de++oHEDFcFe5+2CH1vuAXI91Q1bNgWGDEp
csxH
-----END CERTIFICATE-----
subject=/C=CN/ST=beijing/O=roger/OU=it/CN=www.roger.com
issuer=/C=CN/ST=beijing/L=beijing/O=roger/OU=it/CN=www.roger.com
---
No client certificate CA names sent
Server Temp Key: ECDH, prime256v1, 256 bits
---
SSL handshake has read 1510 bytes and written 375 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES256-GCM-SHA384
Session-ID: B10E1BDF09128850EAED0EC8511345CE31F54A93F1CECA4301209D3370A69864
Session-ID-ctx:
Master-Key: B6B08AF09022A171F8EFDA07C3397785ABF61F5C8ADED40DFBC9F5011A79F76824476819EC33DB15AE4D9178E81CD383
Key-Arg : None
Krb5 Principal: None
PSK identity: None
PSK identity hint: None
TLS session ticket lifetime hint: 300 (seconds)
TLS session ticket:
0000 - fd 27 18 4c 72 68 f6 1b-2f 3f 18 1f 63 55 4a 13 .'.Lrh../?..cUJ.
0010 - 37 ec 3b ac 26 af 28 22-66 f7 12 42 af f4 10 fd 7.;.&.("f..B....
0020 - 17 b1 9b 85 55 28 d8 69-ca 0e f4 e6 1e fa 8a d9 ....U(.i........
0030 - 04 03 5d 08 d9 e2 50 ba-19 dd 6d 0b 1e bd 95 8b ..]...P...m.....
0040 - 80 24 d6 4b 49 3d a6 2f-41 e3 b0 4f 1a 6f 42 f3 .$.KI=./A..O.oB.
0050 - 0c a1 0b e0 bc 80 c6 77-0a 8c 5c 63 52 dd cf f3 .......w..\cR...
0060 - c8 c5 81 5a 6b 5e 0a 8a-73 53 5d 0b 2e 5a c5 38 ...Zk^..sS]..Z.8
0070 - 57 60 a7 5a b8 f4 4a d7-79 8e 6a ac 58 c6 db 00 W`.Z..J.y.j.X...
0080 - 3a a1 49 ef ad 45 c1 c9-1e 4d fc 81 cb 5b ae 37 :.I..E...M...[.7
0090 - 4a 54 e7 07 7a 82 d9 37-1f 59 1e 97 52 0d 80 5b JT..z..7.Y..R..[
00a0 - 7c 03 ac 5a a0 d6 18 a4-92 81 1b 7b dc 5f eb 61 |..Z.......{._.a
00b0 - 6a 41 eb 5c d9 11 c3 3e-33 de 0a e2 c6 7a 45 d6 jA.\...>3....zE.
Start Time: 1481643204
Timeout : 300 (sec)
Verify return code: 21 (unable to verify the first certificate)
---
https配置成功。
要想用瀏覽器訪問，需要將根CA導入到瀏覽器中就可以用https訪問了。
在簽發證書時，如果不修改文件，指定加密等級，可以使用：
openssl ca -md sha512 -in /usr/local/apache2.4/conf/http.csr -out certs/http.crt -days 1200 ###簽發證書
openssl req -sha224 -new -x509 -key private/cakey.pem -out cacert.pem -days 7000 ##自簽證書原創文章，作者：王更生，如若轉載，請注明出處：http://www.www58058.com/64409
