RHEL6.3下配置简单Apache https

在默认情况下，Apache允许客户端进行匿名访问，但Apache也可以实现基于加密的认证访问。这里做一个DEMO的实现过程详解。

一、安装相应支持模块
首先在/etc/httpd/conf.d下查看有没有ssl.conf文件，如果没有需要安装mod_ssl加密支持模块。

 

[root@localhost Desktop]# cd /etc/httpd/conf.d

[root@localhost conf.d]# ls

mod_dnssd.conf  README  welcome.conf

使用YUM源来安装

[root@localhost rhel6]# yum -y install mod_ssl

Loaded plugins: product-id, refresh-packagekit, security, subscription-manager

Updating certificate-based repositories.

Unable to read consumer identity

RHEL                                                     | 4.0 kB     00:00 ... 

Setting up Install Process

Resolving Dependencies

--> Running transaction check

---> Package mod_ssl.i686 1:2.2.15-15.el6_2.1 will be installed

--> Finished Dependency Resolution

Dependencies Resolved

================================================================================

 Package         Arch         Version                        Repository    Size

================================================================================

Installing:

 mod_ssl         i686         1:2.2.15-15.el6_2.1            RHEL          88 k

Transaction Summary

================================================================================

Install       1 Package(s)

Total download size: 88 k

Installed size: 181 k

Downloading Packages:

Running rpm_check_debug

Running Transaction Test

Transaction Test Succeeded

Running Transaction

  Installing : 1:mod_ssl-2.2.15-15.el6_2.1.i686                             1/1 

Installed products updated.

  Verifying  : 1:mod_ssl-2.2.15-15.el6_2.1.i686                             1/1 

Installed:

  mod_ssl.i686 1:2.2.15-15.el6_2.1                                           

Complete!

 

[root@localhost conf.d]# ls

mod_dnssd.conf  README  ssl.conf  welcome.conf

二、加密配置
在ssl.conf文件中有这么两句,指出了证书和私钥的存放路径

SSLCertificateFile /etc/pki/tls/certs/localhost.crt

 

SSLCertificateKeyFile /etc/pki/tls/private/localhost.key

 

三、证书生成

 

 

[root@localhost conf.d]# cd /etc/pki/tls/certs

[root@localhost certs]# ls

ca-bundle.crt  ca-bundle.trust.crt  localhost.crt  make-dummy-cert  Makefile

先删除原有的localhost.crt证书文件，再有make命令生成一个测试用的证书文件

[root@localhost certs]# rm -rf localhost.crt 

[root@localhost certs]# make testcert

umask 77 ; \

/usr/bin/openssl req -utf8 -new -key /etc/pki/tls/private/localhost.key -x509 -days 365 -out /etc/pki/tls/certs/localhost.crt -set_serial 0

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [US]:CN

State or Province Name (full name) []:

Locality Name (eg, city) [Default City]:Beijing

Organization Name (eg, company) [Default Company Ltd]:Tianli

Organizational Unit Name (eg, section) []:RedHat

Common Name (eg, your name or your server's hostname) []:test1.demo.com

Email Address []:

[root@localhost certs]# 

 

四、测试验证

 

 

[root@localhost certs]# cd /var/www/html

[root@localhost html]# ls

[root@localhost html]# touch index.html

[root@localhost html]# echo "welcomt to beijing" > index.html

[root@localhost html]# cat index.html

welcome to beijing

 

[root@localhost html]# service httpd restart

Stopping httpd:                                            [  OK  ]

Starting httpd:                                            [  OK  ]

[root@localhost html]# links -dump http://test1.demo.com

   welcome to beijing
使用http显示页面正常

[root@localhost html]# links -dump https://test1.demo.com

ELinks: SSL error
使用https显示页面则出现SSL error

下面使用浏览器看一下效果

[root@localhost html]# firefox

在地址栏中输入https://test1.demo.com

在如上页面中，点击I Understand the Risks选项

 

 

点击Add Exception

点击View 可以查看这张自颁发的证书信息。

点击Confirm Security Exception,然后浏览器将显示页面内容。