编译Apache服务部署静态网站
该系列文章只是本人的学习笔记，文章中的文字描述提取自《Linux鸟哥私房菜》《Linux运维之道》等书中的重点内容，部分内容是在培训Linux运维时总结的笔记，化繁为简能够在工作中快速复习掌握重点，并不代表个人立场，但转载请加出处，并注明参考文献。Apache是世界使用排名第一的Web服务器软件,它可以运行在几乎所有广泛使用的计算机平台上,由于其跨平台和安全性被广泛使用,是最流行的Web服务器端软件之一.它快速、可靠并且可通过简单的API扩充,将Perl/Python等解释器编译到服务器中.同时Apache音译为阿帕奇,是北美印第安人的一个部落,叫阿帕奇族,在美国的西南部.也是一个基金会的名称.
编译安装Apache 1.配置Yum仓库,安装Apache所依赖的包文件,以及编译器.
# wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo
# yum -y install epel-release
# yum install -y gcc openssl openssl-devel zlib zlib-devel pcre pcre-devel expat-devel libxml2-devel
2.安装Apr-1.6.3,主要为上层的应用程序提供一个可以跨越多操作系统平台使用的底层支持接口库.
# wget http://www-eu.apache.org/dist//apr/apr-1.6.3.tar.gz
# tar -xzvf apr-1.6.3.tar.gz
# cd apr-1.6.3/
# CC="gcc -m64" ./configure --prefix=/usr/local/apr
# ./configure --prefix=/usr/local/apr
# make && make install
3.安装Apr-util-1.6.1,是包含了一些常用的开发组件,这些组件与apache的关系更加密切一些,比如存储段和存储段组,加密等.
# wget http://www-eu.apache.org/dist//apr/apr-util-1.6.1.tar.gz
# tar -xzvf apr-util-1.6.1.tar.gz
# cd apr-util-1.6.1/
# ./configure --prefix=/usr/local/apr-util --with-apr=/usr/local/apr
# make && make install
4.安装Apache-2.4.33
# wget http://www-eu.apache.org/dist//httpd/httpd-2.4.33.tar.gz
# tar -xzvf httpd-2.4.33.tar.gz
# cd httpd-2.4.33/
# ./configure --prefix=/usr/local/apache2 \
--enable-rewrite \
--enable-so \
--enable-headers \
--enable-expires \
--with-mpm=worker \
--enable-modules=most \
--enable-deflate \
--enable-ssl \
--with-apr=/usr/local/apr \
--with-apr-util=/usr/local/apr-util \
--with-pcre=/usr/local/pcre
# make && make install
## 配置Apache访问控制 Apache可以基于原主机名,原IP地址,或原主机上的浏览器特征,对网站上的资源进行访问控制,它通过Allow指令允许某个主机访问服务器上的网站资源,通过Deny指令实现禁止访问,还可以给指定的页面添加密码认证.
◆基于用户名密码的认证◆ 作用：当我们打开指定网页时,会提示需要输入密码才能访问,这就是密码认证技术.
1.编辑Apache主配置文件,在相应的区域中加入以下标★语句.
# vim /usr/local/apache2/conf/httpd.conf
235 # AllowOverride controls what directives may be placed in .htaccess files.
236 # It can be "All", "None", or any combination of the keywords:
237 # AllowOverride FileInfo AuthConfig Limit
238 #
★ AllowOverride all #修改为 AllowOverride all
240 #AllowOverride 表示是否去找.htacess文件作为配置文件
241 #
242 # Controls who can get stuff from this server.
2.在要添加认证的网页文件下创建 .htaccess 文件,并覆盖写入以下内容.
# vim /usr/local/apache2/htdocs/.htaccess
authname"welcome to admin" #欢迎提示信息
authtype basic #认证类型
authuserfile /usr/local/apache2/htdocs/login.psd #认证文件存放位置
require valid-user #除认证用户其他用户不允许登陆
3.借助Apache的工具生成密码文件,此处的用户名密码就是访问网页时的号码.
# /usr/local/apache2/bin/htpasswd-c/usr/local/apache2/htdocs/login.psd LyShark#创建认证用户(覆盖)
# /usr/local/apache2/bin/htpasswd-m/usr/local/apache2/htdocs/login.psd LyShark#写入认证用户(追加)
4.重启Apache服务,并访问页面测试即可.
# /usr/local/apache2/bin/apachectl restart
◆基于IP地址的身份认证◆ 作用：当我们打开指定网页时,会判断您的IP地址是允许访问还是拒绝访问,这就是基于IP的认证技术
◆允许个别IP地址访问网页,拒绝所有◆
1.编辑Apache主配置文件,在相应的区域中加入以下标★语句，在嵌套里写入以下内容
# vim /usr/local/apache2/conf/httpd.conf
234 #
235 # AllowOverride controls what directives may be placed in .htaccess files.
236 # It can be "All", "None", or any combination of the keywords:
237 # AllowOverride FileInfo AuthConfig Limit
238 #
239 AllowOverride None
240
★ <requireall>
★ require all granted
★ require ip 192.168.1.10 #允许访问的IP地址
★ </requireall>
245
246 #
247 # Controls who can get stuff from this server.
248 #
249 #Require all granted#注释掉
250 </Directory>
2.重启Apache服务
# /usr/local/apache2/bin/apachectl restart
◆拒绝个别IP地址访问网页,允许所有◆
1.编辑Apache主配置文件,在相应的区域中加入以下标★语句，在嵌套里写入以下内容
# vim /usr/local/apache2/conf/httpd.conf
235 # AllowOverride controls what directives may be placed in .htaccess files.
236 # It can be "All", "None", or any combination of the keywords:
237 # AllowOverride FileInfo AuthConfig Limit
238 #
239 AllowOverride None
240 <requireall>
241 require all granted
242 require not ip 192.168.1.10 #拒绝访问的IP地址
243 </requireall>
244 #
245 # Controls who can get stuff from this server.
246 #
247 #Require all granted#注释掉
248 </Directory>
2.重启Apache服务
# /usr/local/apache2/bin/apachectl restart
## 配置Apache目录别名 有时候一个网页目录过深,每次输入地址过长,此时我们可以使用别名的方式来减小目录深度.
1.编辑Apache主配置文件,在配置文件行尾,追加写入以下标★语句
# vim/usr/local/apache2/conf/httpd.conf
496 # Note: The following must must be present to support
497 # starting without SSL on platforms with no /dev/random equivalent
498 # but a statically compiled-in mod_ssl.
499 #
500 <IfModule ssl_module>
501 SSLRandomSeed startup builtin
502 SSLRandomSeed connect builtin
503 </IfModule>
504
★ alias "/lyshark" "/usr/local/apache2/htdocs/a/b/c/d"#地址简化
#以上语句的含义：将访问路径由 http://IP地址/a/b/c/d 简化为 http://IP地址/lyshark
2.重启Apache服务
# /usr/local/apache2/bin/apachectl restart
## 配置Apache虚拟主机 利用虚拟主机功能,可以把一台处于运行状态的物理服务器分割成多个,虚拟服务器,出于各种考虑目前各种企业都在使用虚拟主机功能,Apache虚拟主机功能,是服务器基于用户的请求的不同Ip地址,主机域名或端口号,实现提供多个网站同时为外部提供访问服务的技术,用户取得的资源不同最后取得的页面也会不同.
◆基于IP的虚拟主机◆ 如果一台服务器有多个IP地址,而且每个IP地址与服务器上部署的每个网站对应,这样当用户请求访问不同的IP时,会访问到不同网站的页面资源,而且每个网站都有一个独立的IP地址,以下实验将实现在一台服务器上配置多个IP,搭建多个网站,每个网站使用一个IP地址.
1.在eno16777728上配置一个网卡子接口
# ifconfig eno16777728:0 192.168.1.13netmask 255.255.255.0
# ifconfig
eno16777728: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>mtu 1500
inet 192.168.1.12netmask 255.255.255.0broadcast 192.168.1.255
inet6 fe80::20c:29ff:fe1e:14e2prefixlen 64scopeid 0x20<link>
ether 00:0c:29:1e:14:e2txqueuelen 1000(Ethernet)
RX packets 40292bytes 4129804 (3.9 MiB)
RX errors 0dropped 0overruns 0frame 0
TX packets 8962bytes 1557264 (1.4 MiB)
TX errors 0dropped 0 overruns 0carrier 0collisions 0
eno16777728:0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>mtu 1500
inet 192.168.1.13netmask 255.255.255.0broadcast 192.168.1.255
ether 00:0c:29:1e:14:e2txqueuelen 1000(Ethernet)
2.编辑主配置文件,开启虚拟主机选项(取消注释),在相应的区域中取消以下标★注释
# vim /usr/local/apache2/conf/httpd.conf
475
476 # Virtual hosts
★Include conf/extra/httpd-vhosts.conf#取消本行注释,开启虚拟主机模块
478
479 # Local access to the Apache HTTP Server Manual
3.修改虚拟主机配置文件添加虚拟主机,在相应的区域中修改以下标★语句
# vim /usr/local/apache2/conf/extra/httpd-vhosts.conf
18 # VirtualHost example:
19 # Almost any Apache directive may go into a VirtualHost container.
20 # The first VirtualHost section is used for all requests that do not
21 # match a ServerName or ServerAlias in any <VirtualHost> block.
22 #
★ <VirtualHost 192.168.1.12:80>
24 ServerAdmin webmaster@dummy-host.example.com
★ DocumentRoot "/usr/local/apache2/htdocs/vhost1"
26 ServerName dummy-host.example.com
27 ServerAlias www.dummy-host.example.com
28 ErrorLog "logs/dummy-host.example.com-error_log"
29 CustomLog "logs/dummy-host.example.com-access_log" common
30 </VirtualHost>
31
★ <VirtualHost 192.168.1.13:80>
33 ServerAdmin webmaster@dummy-host2.example.com
★ DocumentRoot "/usr/local/apache2/htdocs/vhost2"
35 ServerName dummy-host2.example.com
36 ErrorLog "logs/dummy-host2.example.com-error_log"
37 CustomLog "logs/dummy-host2.example.com-access_log" common
38 </VirtualHost>
4.分别创建 vhost1 和 vhost2 目录,并放入两个index.html文件
# mkdir /usr/local/apache2/htdocs/vhost1
# mkdir /usr/local/apache2/htdocs/vhost2
# echo "vhost1 test page" > /usr/local/apache2/htdocs/vhost1/index.html
# echo "vhost2 test page" > /usr/local/apache2/htdocs/vhost2/index.html
5.重启Apache服务,测试效果,两个IP分别对应两个网站主页
# /usr/local/apache2/bin/apachectl restart
◆基于端口的虚拟主机◆ 基于端口的虚拟主机,可以让用户通过端口号,来访问服务器上的资源,在使用Apache配置虚拟网站时,基于端口的配置方式最为复杂,以下实验将实现在一台服务器上配置多个端口,搭建多个网站,每个网站使用一个端口.
1.编辑主配置文件,开启虚拟主机选项(取消注释),在相应的区域中取消以下标★注释
# vim /usr/local/apache2/conf/httpd.conf
475
476 # Virtual hosts
★Include conf/extra/httpd-vhosts.conf#取消本行注释,开启虚拟主机模块
478
479 # Local access to the Apache HTTP Server Manual
2.修改虚拟主机配置文件添加虚拟主机,在相应的区域中修改以下标★语句
# vim /usr/local/apache2/conf/extra/httpd-vhosts.conf
18 # VirtualHost example:
19 # Almost any Apache directive may go into a VirtualHost container.
20 # The first VirtualHost section is used for all requests that do not
21 # match a ServerName or ServerAlias in any <VirtualHost> block.
22 #
★ <VirtualHost 192.168.1.12:80>
24 ServerAdmin webmaster@dummy-host.example.com
★ DocumentRoot "/usr/local/apache2/htdocs/vhost1"
26 ServerName dummy-host.example.com
27 ServerAlias www.dummy-host.example.com
28 ErrorLog "logs/dummy-host.example.com-error_log"
29 CustomLog "logs/dummy-host.example.com-access_log" common
30 </VirtualHost>
31
★ <VirtualHost 192.168.1.12:8080>
33 ServerAdmin webmaster@dummy-host2.example.com
★ DocumentRoot "/usr/local/apache2/htdocs/vhost2"
35 ServerName dummy-host2.example.com
36 ErrorLog "logs/dummy-host2.example.com-error_log"
37 CustomLog "logs/dummy-host2.example.com-access_log" common
38 </VirtualHost>
3.修改Apache主配置文件,添加两个端口监听
# vim /usr/local/apache2/conf/httpd.conf
48 # Change this to Listen on specific IP addresses as shown below to
49 # prevent Apache from glomming onto all bound IP addresses.
50 #
51 #Listen 12.34.56.78:80
★ Listen 80
★ Listen 8080
4.分别创建 vhost1 和 vhost2 目录,并放入两个index.html文件
# mkdir /usr/local/apache2/htdocs/vhost1
# mkdir /usr/local/apache2/htdocs/vhost2
# echo "vhost1 test page" > /usr/local/apache2/htdocs/vhost1/index.html
# echo "vhost2 test page" > /usr/local/apache2/htdocs/vhost2/index.html
5.重启Apache服务,测试效果,两个端口分别对应两个网站主页
# usr/local/apache2/bin/apachectl restart
◆基于域名的虚拟主机◆ 当服务器无法为每一个网站分配一个独立的IP的时候,可以尝试让Apache自动识别用户请求的域名,从而根据不同的域名请求来传输不同的内容,这里我们为了验证实验要手动搭建一个DNS解析,以下实验将实现在一台服务器上多个域名,搭建多个网站,每个网站使用一个域名.
1.首先搭建DNS域名解析,模拟vhost1.com与vhost2.com两个网站域名.
# yum install -y bind bind-chroot
Loaded plugins: product-id, search-disabled-repos, subscription-manager
This system is not registered with an entitlement server. You can use subscription-manager.
Package 32:bind-9.9.4-61.el7.x86_64 already installed and latest version
Package 32:bind-chroot-9.9.4-61.el7.x86_64 already installed and latest version
Nothing to do
2.配置DNS解析,这里我们简单配置即可,有关DNS详细例子请查看其他相关文章.
# vim /etc/named.conf
12 options {
13 listen-on port 53 { any; };
14 listen-on-v6 port 53 { ::1; };
15 directory "/var/named";
16 dump-file "/var/named/data/cache_dump.db";
17 statistics-file "/var/named/data/named_stats.txt";
18 memstatistics-file "/var/named/data/named_mem_stats.txt";
19 allow-query { any; };
# vim /etc/named.rfc1912.zones
43 zone "vhost1.com" IN {
44 type master;
45 file "vhost1.com.zone";
46 allow-update { none; };
47 };
48 zone "vhost2.com" IN {
49 type master;
50 file "vhost2.com.zone";
51 allow-update { none; };
52 };
3.拷贝配置文件,并修改成以下模样,并重启Bind
# cp -a /var/named/named.localhost /var/named/vhost1.com.zone
# cp -a /var/named/named.localhost /var/named/vhost2.com.zone
# vim /var/named/vhost1.com.zone
$TTL 1D
@ IN SOAdns.vhost1.com. rname.invalid. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS dns.vhost1.com.
dns A 127.0.0.1
www A 192.168.1.10
# vim /var/named/vhost2.com.zone
$TTL 1D
@ IN SOAdns.vhost2.com. rname.invalid. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS dns.vhost2.com.
dns A 127.0.0.1
www A 192.168.1.10
# systemctl restart named
4.编辑Apache主配置文件,开启虚拟主机选项(取消注释),在相应的区域中取消以下标★注释
# vim /usr/local/apache2/conf/httpd.conf
475
476 # Virtual hosts
★Include conf/extra/httpd-vhosts.conf#取消本行注释,开启虚拟主机模块
478
479 # Local access to the Apache HTTP Server Manual
5.修改虚拟主机配置文件添加虚拟主机,在相应的区域中修改以下标★语句
# vim /usr/local/apache2/conf/extra/httpd-vhosts.conf
18 # VirtualHost example:
19 # Almost any Apache directive may go into a VirtualHost container.
20 # The first VirtualHost section is used for all requests that do not
21 # match a ServerName or ServerAlias in any <VirtualHost> block.
22 #
23 <VirtualHost *:80>
24 ServerAdmin webmaster@dummy-host.example.com
★ DocumentRoot "/usr/local/apache2/htdocs/vhost1"
★ ServerName www.vhost1.com#vhost1.com解析到vhost1目录下
27 ServerAlias www.dummy-host.example.com
28 ErrorLog "logs/dummy-host.example.com-error_log"
29 CustomLog "logs/dummy-host.example.com-access_log" common
30 </VirtualHost>
31
32 <VirtualHost *:80>
33 ServerAdmin webmaster@dummy-host2.example.com
★ DocumentRoot "/usr/local/apache2/htdocs/vhost2"
★ ServerName www.vhost2.com#vhost2.com解析到vhost2目录下
36 ErrorLog "logs/dummy-host2.example.com-error_log"
37 CustomLog "logs/dummy-host2.example.com-access_log" common
38 </VirtualHost>
6.分别创建 vhost1 和 vhost2 目录,并放入两个index.html文件
# mkdir /usr/local/apache2/htdocs/vhost1
# mkdir /usr/local/apache2/htdocs/vhost2
# echo "vhost1 test page" > /usr/local/apache2/htdocs/vhost1/index.html
# echo "vhost2 test page" > /usr/local/apache2/htdocs/vhost2/index.html
7.重启Apache服务,测试效果,两个域名分别对应两个网站主页
# /usr/local/apache2/bin/apachectl restart
## 配置Apache个人主页 如果想为每个系统独立的用户建立一个网站,通常情况先是基于虚拟主机的功能来部署多个网站,但是这样工作量实在太大,还好Apache为我们提供了个人主页功能,以下实验将实现给予不同的用户一个单独的网页空间,实现每个人可以有自己的空间,类似QQ空间.
1.编辑主配置文件,开启个人主页选项(取消注释),在相应的区域中取消以下标★注释.
# vim /usr/local/apache2/conf/httpd.conf
149 #LoadModule speling_module modules/mod_speling.so
★LoadModule userdir_module modules/mod_userdir.so#取消注释(约在150行)
151 LoadModule alias_module modules/mod_alias.so
.....
470 # User home directories
★Include conf/extra/httpd-userdir.conf#取消注释(约在471行)
472
473 # Real-time info on requests and configuration
# cat /usr/local/apache2/conf/extra/httpd-userdir.conf
2.创建用户并设置密码.
# useradd lyshark
# echo "123123" |passwd --stdin lyshark
Changing password for user lyshark.
passwd: all authentication tokens updated successfully.
3.进入lyshark用户家目录,创建相应文件,并赋予权限.
# mkdir -p /home/lyshark/public_html#在用户家目录创建public_html
# echo "this is lyshark web" > /home/lyshark/public_html/index.html#创建测试页
# chmod 755 /home/lyshark/public_html/index.html#赋予执行权限
# chmod 755 /home/lyshark#赋予执行权限
4.重启Apache服务,并进入浏览器输入以下格式进行验证.
# /usr/local/apache2/bin/apachectl restart
# elinks http://127.0.0.1/~lyshark
## 启用Apache地址跳转 在有些以后我们需要跳转一些页面,比如说今天搞活动我们要把以前的页面替换掉让其暂时跳转到活动页面上来,恰巧Apache提供这样的域名跳转的配置服务,下面实验将实现当用户访问 vhost1.com 时会自动跳转到 vhost2.com 网站上来.
1.首先搭建DNS域名解析,模拟vhost1.com与vhost2.com两个网站域名.
# yum install -y bind bind-chroot
Loaded plugins: product-id, search-disabled-repos, subscription-manager
This system is not registered with an entitlement server. You can use subscription-manager.
Package 32:bind-9.9.4-61.el7.x86_64 already installed and latest version
Package 32:bind-chroot-9.9.4-61.el7.x86_64 already installed and latest version
Nothing to do
2.配置DNS解析,这里我们简单配置即可,有关DNS详细例子请查看其他相关文章.
# vim /etc/named.conf
12 options {
13 listen-on port 53 { any; };
14 listen-on-v6 port 53 { ::1; };
15 directory "/var/named";
16 dump-file "/var/named/data/cache_dump.db";
17 statistics-file "/var/named/data/named_stats.txt";
18 memstatistics-file "/var/named/data/named_mem_stats.txt";
19 allow-query { any; };
# vim /etc/named.rfc1912.zones
43 zone "vhost1.com" IN {
44 type master;
45 file "vhost1.com.zone";
46 allow-update { none; };
47 };
48 zone "vhost2.com" IN {
49 type master;
50 file "vhost2.com.zone";
51 allow-update { none; };
52 };
3.拷贝配置文件,并修改成以下模样,并重启Bind
# cp -a /var/named/named.localhost /var/named/vhost1.com.zone
# cp -a /var/named/named.localhost /var/named/vhost2.com.zone
# vim /var/named/vhost1.com.zone
$TTL 1D
@ IN SOAdns.vhost1.com. rname.invalid. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS dns.vhost1.com.
dns A 127.0.0.1
www A 192.168.1.10
# vim /var/named/vhost2.com.zone
$TTL 1D
@ IN SOAdns.vhost2.com. rname.invalid. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS dns.vhost2.com.
dns A 127.0.0.1
www A 192.168.1.10
# systemctl restart named
4.编辑主配置文件开启相应功能(取消注释)
# vim /usr/local/apache2/conf/httpd.conf
145 LoadModule vhost_alias_module modules/mod_vhost_alias.so#开启虚拟主机(约在145行)
152 LoadModule rewrite_module modules/mod_rewrite.so #开启网页重写(约在152行)
.....
476 # Virtual hosts
477 Include conf/extra/httpd-vhosts.conf#开启虚拟主机(约在477行)
5.改写虚拟主机配置文件,在相应的区域中取消以下标★注释
# vim /usr/local/apache2/conf/extra/httpd-vhosts.conf
18 # VirtualHost example:
19 # Almost any Apache directive may go into a VirtualHost container.
20 # The first VirtualHost section is used for all requests that do not
21 # match a ServerName or ServerAlias in any <VirtualHost> block.
22 #
23 <VirtualHost *:80>
★ DocumentRoot "/usr/local/apache2/htdocs/vhost1"#vhost1网页存放位置
★ ServerName www.vhost1.com#域名vhost1.com
26 </VirtualHost>
27
★ <Directory "/usr/local/apache2/htdocs/vhost1">#vhost1页面的路径
★ Options indexes followsymlinks
★ Allowoverride all
★ Require all granted
★ </Directory>
33
34 <VirtualHost *:80>
★ DocumentRoot "/usr/local/apache2/htdocs/vhost2"#vhost2网页存放位置
★ ServerName www.vhost2.com#域名vhost2.com
37 </VirtualHost>
6.分别创建网页文件存储位置,和测试页
# mkdir -p /usr/local/apache2/htdocs/vhost1
# mkdir -p /usr/local/apache2/htdocs/vhost2
# echo "vhost1 server" > /usr/local/apache2/htdocs/vhost1/index.html
# echo "vhost2 server" > /usr/local/apache2/htdocs/vhost2/index.html
7.在要跳转的网页目录下创建 .htaccess 文件 (本例中应在vhost1目录下创建),覆盖写入以下内容即可
# vim /usr/local/apache2/htdocs/vhost1/.htaccess
rewriteengine on#开启跳转功能
rewritecond %{HTTP_HOST} www.vhost1.com#将www.vhost1.com
rewriterule .* http://www.vhost2.com#跳转到www.vhost2.com
8.重启Apache服务,重新加载配置,现在访问 vhost1.com 会跳转到 vhost2.com 目录下
# /usr/local/apache2/bin/apachectl restart
## 启用https SSL加密传输 在生产环境中,我们需要让我们的网站更加的安全,多数情况下我们会开启https的加密认证,来保证数据传输的安全性,下面实验将实现启动SSL证书,也就是https认证,端口为443.
1.建立服务器私钥,过程中需要输入密码
# openssl genrsa -des3 -out server.key 1024
----------------------------------------------------------------------------
注释：
Genrsa –des3#加密类型
-outserver.key#输出文件
-1024#加密长度
----------------------------------------------------------------------------
2.建立证书,生成的csr文件交给CA签名后形成服务端自己的证书
# openssl req -new -key server.key -out server.csr
----------------------------------------------------------------------------
注释：
req -new #新建证书
-key server.key#私钥文件
-out server.csr#输出文件
注：依次输入：国家 省 市 组织 机构 全称 EMAIL 是否要改变密码 是否改名称
----------------------------------------------------------------------------
3.转化成证书,这一步由证书CA机构来做的,这里只是实验.
# openssl x509 -req -days 365 -sha256 -in server.csr -signkey server.key -out servernew.crt
4.配置服务器让其支持https
# cp -a servernew.crt /usr/local/apache2/conf/server.crt#将证书复制到conf目录下
# cp -a server.key /usr/local/apache2/conf/server.key#私钥也要放入conf目录下
5.编辑主配置文件开启相应功能(取消注释)
# vim /usr/local/apache2/conf/httpd.conf
133 LoadModule ssl_module modules/mod_ssl.so#开启ssl功能(约在133行)
493 # Secure (SSL/TLS) connections
494 Include conf/extra/httpd-ssl.conf#开启ssl模板,搜索SSLRandomSeed(约在494行)
6.配置SSL模板文件
# vim /usr/local/apache2/conf/extra/httpd-ssl.conf
88 # Inter-Process Session Cache:
89 # Configure the SSL Session Cache: First the mechanism
90 # to use and second the expiring timeout (in seconds).
91 #SSLSessionCache "dbm:/usr/local/apache2/logs/ssl_scache"#注释掉
92 #SSLSessionCache "shmcb:/usr/local/apache2/logs/ssl_scache(512000)"#注释掉
93 #SSLSessionCacheTimeout300#注释掉
7.重启Apache服务,输入密码
# /usr/local/apache2/bin/apachectl restart
8.访问网站,这里注意要加上443端口,否则无法访问
# https://127.0.0.1:443/index.html
页:
[1]