中间人攻击（三）HTTPS实战应用
HTTPD + Openssl = HTTPS
请自行安装好web服务器和Openssl工具
A. 配置CA服务器（CA对自己进行证书自签名，用脚本生成）
配置CA(IP:192.168.122.188)，生成CA自己的公钥，私钥
[root@CA ~]# vim /etc/pki/tls/openssl.cnf
dir = /etc/CA --> Where everything is kept 第45行
basicConstraints=CA:TRUE --> 自签署的证书可以使用 第178行
[root@CA ~]# vim /etc/pki/tls/misc/CA
CATOP=/etc/CA -->第42行
[root@CA ~]# /etc/pki/tls/misc/CA -newca
CA certificate filename (or enter to create)
--> 这里我们是创建，直接enter键就好
Making CA certificate ...
Generating a 1024 bit RSA private key
.............++++++
...........++++++
writing new private key to '../../CA/private/./cakey.pem' --> 私钥
Enter PEM pass phrase:123456 --> 保护CA私钥的密码
Verifying - Enter PEM pass phrase:123456
-----
You are about to be asked to enter information that will be incorporated into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:CN --> 身份信息
State or Province Name (full name) [Berkshire]:BEIJING
Locality Name (eg, city) [Newbury]:XC
Organization Name (eg, company) [My Company Ltd]:CompanyName
Organizational Unit Name (eg, section) []:IT
Common Name (eg, your name or your server's hostname) []:CA.marmotc.com
Email Address []:[email protected]
Please enter the following 'extra' attributes to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for /etc/CA/private/./cakey.pem:123456 --> 使用私钥自签名
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 0 (0x0)
Validity
Not Before: Oct 31 07:13:44 2013 GMT
Not After : Oct 30 07:13:44 2016 GMT
Subject:
countryName = CN
stateOrProvinceName = BEIJING
organizationName = CompanyName
organizationalUnitName = IT
commonName = CA.marmotc.com
emailAddress = [email protected]
X509v3 extensions:
X509v3 Basic Constraints:
CA:TRUE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
B0:32:40:FA:D6:7D:10:CC:54:3C:8A:14:DE:25:6D:38:43:B1:02:B2
X509v3 Authority Key Identifier:
keyid:B0:32:40:FA:D6:7D:10:CC:54:3C:8A:14:DE:25:6D:38:43:B1:02:B2
Certificate is to be certified until Oct 30 07:13:44 2016 GMT (1095 days)
Write out database with 1 new entries
Data Base Updated
[root@CA ~]# ls /etc/CA/private/cakey.pem --> CA私钥
[root@CA ~]# ls /etc/CA/cacert.pem --> CA证书
[root@CA ~]# ls /etc/CA/careq.pem --> CA证书请求
B. 配置web服务器
===============================================================
B.1 web 生成自己的私钥
[root@www ~]# openssl genrsa -des3 -out /etc/httpd/conf.d/server.key
--> 使用des3保护私钥
Generating RSA private key, 512 bit long modulus
.........++++++++++++
......................++++++++++++
e is 65537 (0x10001)
Enter pass phrase for /etc/httpd/conf.d/server.key:123456
Verifying - Enter pass phrase for /etc/httpd/conf.d/server.key:123456
B.2 生成证书请求（使用身份标识＋公钥）
[root@www ~]# openssl req -new -key /etc/httpd/conf.d/server.key -out /tmp/server.csr
Enter pass phrase for /etc/httpd/conf.d/server.key:123456
You are about to be asked to enter information that will be incorporated into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
-------------------------------------------------------------------------------
这部分信息要与CA一致 !!!
Country Name (2 letter code) [GB]:CN
State or Province Name (full name) [Berkshire]:BEIJING
Locality Name (eg, city) [Newbury]:XC
Organization Name (eg, company) [My Company Ltd]:CompanyName
Organizational Unit Name (eg, section) []:IT
-------------------------------------------------------------------------------
Common Name (eg, your name or your server's hostname) []:www.marmotc.com
Email Address []:[email protected]
Please enter the following 'extra' attributes to be sent with your certificate request
A challenge password []:
An optional company name []:
B.3 将证书请求发送给CA
[root@www ~]# scp /tmp/server.csr CA.uplooking.com:/tmp/
C. CA服务器对证书请求进行数字签名
=============================================================================
[root@CA ~]# openssl ca -keyfile /etc/CA/private/cakey.pem -cert /etc/CA/cacert.pem -in /tmp/server.csr -out /tmp/server.crt
/etc/CA/private/cakey.pem （这是ca的私钥）
/tmp/server.csr （httpserver的证书请求文件）
/etc/CA/cacert.pem (ca的证书)
/tmp/server.crt （生成的httpserver的证书的名字）
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for /etc/CA/private/cakey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Oct 31 07:13:44 2013 GMT
Not After : Oct 30 07:13:44 2016 GMT
Subject:
countryName = CN
stateOrProvinceName = BEIJING
organizationName = CompanyName
organizationalUnitName = IT
commonName = www.marmotc.com
emailAddress = [email protected]
X509v3 extensions:
X509v3 Basic Constraints:
CA:TRUE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
D0:6E:C7:7D:FC:BE:0D:62:CA:B9:A2:E0:2A:9A:27:32:39:0B:91:F8
X509v3 Authority Key Identifier:
keyid:B0:32:40:FA:D6:7D:10:CC:54:3C:8A:14:DE:25:6D:38:43:B1:02:B2
Certificate is to be certified until Oct 30 07:13:44 2014 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
C.1 将签名后的数字证书颁发给web
[root@CA ~]# scp /tmp/server.crt www.marmotc.com:/etc/httpd/conf.d/
D. 配置web支持ssl实现https
==========================================================
[root@www ~]# yum install httpd mod_ssl
[root@www ~]# vim /etc/httpd/conf.d/ssl.conf
SSLCertificateFile /etc/httpd/conf.d/server.crt
SSLCertificateKeyFile /etc/httpd/conf.d/server.key
[root@www ~]# netstat -tunpl | grep 443
tcp 0 0 :::443 :::* LISTEN 2000/httpd
E. Client下载CA证书并导入到浏览器，然后访问www服务器
===============================================================================
client需要下载CA证书并导入浏览器，使用https访问web，浏览器验证web数字证书是否由CA颁发 打开firefox，编辑------>首选项----->高级----> 加密----->查看证书---->导入