Linux下使用Openssl頒發Apache證書

1安裝openssl

#yum install -y openssl

2進入目錄/etc/pki/tls/certs

#cd /etc/pki/tls/certs

3.生成私鑰文件(key)

#openssl genrsa -des3 -out server.key 1024

4.爲了避免每次服務啓動都需要輸入證書密碼，刪除證書密碼

#openssl rsa -in server.key -out server.key

5.用server.key生成證書

#openssl req -new -key server.key -out server.csr
#這時候會提示以下信息：
Country Name (2 letter code) [XX]:CN  
State or Province Name (full name) []:Beijing
Locality Name (eg, city) [Default City]:Beijing
Organization Name (eg, company) [Default Company Ltd]:No
Organizational Unit Name (eg, section) []:New
Common Name (eg, your name or your server's hostname) []:No
Email Address []:[email protected]
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:#如果直接回車
An optional company name []:#這裏直接回車

6.生成CA的key文件ca.key和根證書ca.crt

openssl req -new -x509 -keyout ca.key -out ca.crt
#提示信息和第5步驟類似。

7.用CA證書爲server.csr證書籤名

#爲了防止報錯，需要提前做一些準備工作
#touch /etc/pki/CA/index.txt
#echo 01 > /etc/pki/CA/serial
#openssl ca -in server.csr -out server.crt -cert ca.crt -keyfile ca.key -config ../openssl.cnf
#這是會提示以下信息
Sign the certificate? [y/n]:y#選擇y
1 out of 1 certificate requests certified, commit? [y/n]y#選擇y

8.這時候會得到ca.crt，ca.key，server.crt，server.csr，server.key。
9.將ca.crt，server.crt，server.key發送到apache配置目錄。我的是/usr/local/apache/conf/ssl/
10.哎apache的vhost目錄裏使用

#進入配置目錄，
#cd /usr/local/apache/conf
#vi httpd.conf
IncludeOptional conf/vhost/*.conf #去掉註釋，如果沒有則新增

#進入vhost目錄
#cd /usr/local/apache/conf/vhost
#創建一個新的配置文件，名稱自己定義，以.conf爲後綴
#vi httpd-vhost-ssl.conf
<VirtualHost *:443>
ServerAdmin 隨便輸入的郵箱地址
php_admin_value open_basedir "/home/www/:/tmp/:/var/tmp/:/proc/"
DocumentRoot /home/www
ServerName 域名:443
ErrorLog "/home/wwwlogs/error_log"
CustomLog "/home/wwwlogs/access_log" combined
SSLEngine on
SSLCertificateFile /usr/local/apache/conf/ssl/server.crt#證書的路徑
SSLCertificateKeyFile /usr/local/apache/conf/ssl/server.key#證書的路徑
#SSLCertificateChainFile /usr/local/apache/conf/ssl/ca.crt#證書的路徑
Protocols h2 h2c http/1.1
<Directory "/home/www/">
    SetOutputFilter DEFLATE
    Options FollowSymLinks
    AllowOverride All
    Order allow,deny
    Allow from all
    DirectoryIndex index.php index.html
</Directory>
</VirtualHost>