測試目標：
三個虛擬主機，要求如下
vhost1： phpMyAdmin, 同時提供https服務；
vhost2: wordpress
配置過程：
一、配置vhost1
1、首先配置vhost1，先搭建私有CA
在172.16.20.242上搭建私有CA： (1) 創建私鑰，公鑰無需處理 [root@ca ~]# cd /etc/pki/CA/ [root@ca CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048) Generating RSA private key, 2048 bit long modulus .....+++ .......+++ e is 65537 (0x10001) (2) 生成自簽證書，填寫相關證書信息 [root@ca CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048) Generating RSA private key, 2048 bit long modulus .....+++ .......+++ e is 65537 (0x10001) [root@ca CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 3655 You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:CN State or Province Name (full name) []:Hubei Locality Name (eg, city) [Default City]:Hubei Organization Name (eg, company) [Default Company Ltd]:Gump Ltd Organizational Unit Name (eg, section) []:Ops Common Name (eg, your name or your server's hostname) []:ca.gump.com Email Address []:[email protected] [root@ca CA]# // 需要注意的是，證書格式必須爲pem格式 （3）創建簽署證書環境 [root@ca CA]# touch /etc/pki/CA/index.txt [root@ca CA]# touch /etc/pki/CA/serial [root@ca CA]# echo 01 > /etc/pki/CA/serial
2、在web主機上生成證書請求，併發送證書請求到CA主機
在172.16.20.244生成證書請求： （1）生成密鑰，並保存到應用此證書的服務的配置文件目錄下 [root@web ~]# mkdir /etc/httpd/ssl [root@web ~]# cd /etc/httpd/ssl [root@web ssl]# (umask 077;openssl genrsa -out httpd.key 2048) Generating RSA private key, 2048 bit long modulus ..........+++ ....................................................................+++ e is 65537 (0x10001) [root@web ssl]# ls httpd.key (2) 生成證書籤署請求，填寫相關信息需要注意的是，除了主機地址和郵箱地址，其它需要保持一致 [root@web ssl]# openssl req -new -key httpd.key -out httpd.csr You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:CN State or Province Name (full name) []:Hubei Locality Name (eg, city) [Default City]:Hubei Organization Name (eg, company) [Default Company Ltd]:Gump Ltd Organizational Unit Name (eg, section) []:Ops Common Name (eg, your name or your server's hostname) []:web.gump.com Email Address []:[email protected] Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: [root@web ssl]# ls httpd.csr httpd.key [root@web ssl]# scp httpd.csr [email protected]:/tmp/ [email protected]'s password: httpd.csr 100% 1050 1.0KB/s 00:00 [root@web ssl]#
3、簽署證書請求，將證書請求發送回web主機
（1）簽署證書請求 [root@ca CA]# openssl ca -in /tmp/httpd.csr -out /tmp/web.gump.com.crt -days 365 Using configuration from /etc/pki/tls/openssl.cnf Check that the request matches the signature Signature ok Certificate Details: Serial Number: 1 (0x1) Validity Not Before: Aug 23 10:55:56 2017 GMT Not After : Aug 23 10:55:56 2018 GMT Subject: countryName = CN stateOrProvinceName = Hubei organizationName = Gump Ltd organizationalUnitName = Ops commonName = web.gump.com emailAddress = [email protected] X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: 7A:D2:B5:60:3D:13:27:33:C4:F5:02:DC:AC:44:BB:0F:F9:32:00:71 X509v3 Authority Key Identifier: keyid:5A:9A:54:2F:9C:91:3E:D6:BE:CC:22:68:50:C6:83:EB:23:AD:AC:AF Certificate is to be certified until Aug 23 10:55:56 2018 GMT (365 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated [root@ca CA]# （2）將證書傳回請求者 [root@ca CA]# scp /tmp/web.gump.com.crt [email protected]:/etc/httpd/ssl The authenticity of host '172.16.20.244 (172.16.20.244)' can't be established. RSA key fingerprint is 5a:10:33:a2:bf:5b:06:82:25:01:fb:c2:74:93:34:95. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '172.16.20.244' (RSA) to the list of known hosts. [email protected]'s password: web.gump.com.crt 100% 4595 4.5KB/s 00:00 [root@ca CA]#
4、配置httpd支持使用ssl
（1）查看當前web主機是否已安裝mod_ssl模塊，如果沒有安裝，則必須先安裝mod_ssl模塊
（2）配置ssl配置文件
[root@web ssl]# vim /etc/httpd/conf.d/ssl.conf
修改如下選項:
<VirtuaHost 172.16.20.244:443>
// 因爲ssl會話是基於IP地址建立的，若有多個IP地址，則需指定地址，若只有一個地址，則無需修
改，保持"*"即可；
DocumentRoot "/www/htdocs"
// 此目錄爲虛擬主機vhost1的中心目錄，即網頁文件存放位置
ServerName web.gump.com:443
// 當前主機名
ErrorLog /logs/pma_error_log
// 錯誤日誌存放位置
Transferlog logs/pma_access_log
// 訪問日誌存放目錄
SSLCertificateFile /etc/httpd/ssl/web.gump.com.crt
// 服務器證書存放目錄
SSlCertificateKeyFile /etc/httpd/ssl/httpd.key
// 證書私鑰存放目錄
(3)配置phpMyadmin網頁文件
[root@localhost ~]# mkdir -pv /www/htdocs/vhosts{1,2,3}
[root@localhost ~]# unzip phpMyAdmin-4.0.10.20-all-languages.zip
[root@localhost ~]# cp phpMyAdmin-4.0.10.20-all-languages /www/htdocs/vhosts1/
[root@localhost ~]# ln -sv phpMyAdmin-4.0.10.20-all-languages pma
(4)配置httpd.conf
[root@localhost conf]# vim httpd.conf
ServerName Localhost:80
DocumentRoot "/www/htdocs"
<Directory "/www/htdocs">
// Directory 指定的目錄要和DocumentRoot一致
(5)配置虛擬主機配置文件
[root@localhost ~]# vim /etc/httpd/conf.d/httpd-vhost1.conf
<VirtualHost 172.16.20.244:80>
ServerAdmin web.gump.com
DocumentRoot "/www/htdocs"
<Directory "/www/htdocs/vhosts1/pma">
Options None
AllowOverride None
Require all granted
</Directory>
</VirtualHost>
[root@localhost ~]# systemctl reload httpd.service查看配置效果
二、配置虛擬主機2
1、配置虛擬主機2的配置文件
[root@localhost ~]# vim /etc/httpd/conf.d/httpd-vhost2.conf
<VirtualHost 172.16.20.245:80>
ServerAdmin web2.gump.com
DocumentRoot "/www/htdocs"
<Directory "/www/htdocs/vhosts2">
Options None
AllowOverride None
Require all granted
</Directory>
</VirtualHost>
2、爲虛擬主機2配置IP地址
由於是虛擬機，沒有多張網卡使用ip命令添加地址達到多IP效果
[root@localhost ~]# ip addr add 172.16.20.245/24 dev ens33
[root@localhost ~]# ip addr show dev ens33
[root@localhost ~]# ip add show dev ens33
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 00:0c:29:44:e2:e3 brd ff:ff:ff:ff:ff:ff
inet 172.16.20.244/24 brd 172.16.20.255 scope global ens33
valid_lft forever preferred_lft forever
inet 172.16.20.245/24 scope global secondary ens33
valid_lft forever preferred_lft forever
inet6 fe80::d846:2237:6188:97fe/64 scope link tentative dadfailed
valid_lft forever preferred_lft forever
inet6 fe80::a0de:8503:69c8:5595/64 scope link tentative dadfailed
valid_lft forever preferred_lft forever
inet6 fe80::9a1a:88f0:c9cf:41bd/64 scope link tentative dadfailed
valid_lft forever preferred_lft forever
3、配置虛擬主機2的網頁文件
[root@localhost ~]# unzip wordpress-4.7.4-zh_CH.zip
[root@localhost ~]# cp wordpress /www/htdocs/vhosts2/
4、配置虛擬主機2的wordpress的配置文件
[root@localhost ~]# mysql
MariaDB [(none)]> CREATE DATABASE mydb1;
MariaDB [(none)]> exit
// 連接wordpress必須要配置正確的數據庫及用戶名密碼，所以需要實現創建好數據庫
[root@localhost ~]# cd /www/htdocs/vhost2/wordpress
[root@localhost ~]# cp wp-config-sample.php wp-config.php
[root@localhost ~]# vim wp-config.php
define('DB_NAME','mydb1'); // 數據庫爲事先創建好的mydb1
define('DB_USER','root'); // 用戶名爲root
define('DB_PASSWORD',''); // root密碼默認爲空5、查看配置效果
寫的比較潦草，如有遺漏錯誤和爭議之處，歡迎大家的批評指正和討論，謝謝。