详解在Ubuntu上的Apache配置SSL(https证书)的正确姿势

2023-09-04 22:49:05 63

首先看一下阿里云官方的教程：

文件说明：

1.证书文件xxxxxx.pem，包含两段内容，请不要删除任何一段内容。

2.如果是证书系统创建的CSR，还包含：证书私钥文件xxxxxxxx.key、证书公钥文件public.pem、证书链文件chain.pem。

(1)在Apache的安装目录下创建cert目录，并且将下载的全部文件拷贝到cert目录中。如果申请证书时是自己创建的CSR文件，请将对应的私钥文件放到cert目录下并且命名为xxxxxxxx.key；

(2)打开apache安装目录下conf目录中的httpd.conf文件，找到以下内容并去掉“#”：

#LoadModulessl_modulemodules/mod_ssl.so(如果找不到请确认是否编译过openssl插件)
#Includeconf/extra/httpd-ssl.conf

(3)打开apache安装目录下conf/extra/httpd-ssl.conf文件(也可能是conf.d/ssl.conf，与操作系统及安装方式有关)，在配置文件中查找以下配置语句:

#添加SSL协议支持协议，去掉不安全的协议
SSLProtocolall-SSLv2-SSLv3
#修改加密套件如下
SSLCipherSuiteHIGH:!RC4:!MD5:!aNULL:!eNULL:!NULL:!DH:!EDH:!EXP:+MEDIUM
SSLHonorCipherOrderon
#证书公钥配置
SSLCertificateFilecert/public.pem
#证书私钥配置
SSLCertificateKeyFilecert/xxxxxxx.key
#证书链配置，如果该属性开头有'#'字符，请删除掉
SSLCertificateChainFilecert/chain.pem

(4)重启Apache。

(5)通过https方式访问您的站点,测试站点证书的安装配置，如遇到证书不信任问题，请查看帮助视频。

然而这只能参考。在Ubuntu下面，我是用apt安装的Apache，但是它没有httpd.conf，只有一个apache2.conf，好吧，其实这个文件和httpd.conf差不多，它里面是这样注释的：

#Itissplitintoseveralfilesformingtheconfigurationhierarchyoutlined
#below,alllocatedinthe/etc/apache2/directory:
#
#/etc/apache2/
#|--apache2.conf
#|`--ports.conf
#|--mods-enabled
#||--*.load
#|`--*.conf
#|--conf-enabled
#|`--*.conf
#`--sites-enabled
#`--*.conf
#

这个版本的Apache把配置文件分散到了其他小文件中，结构就是上面那样子的。你要是愿意的话，也可以自己写一个httpd.conf然后include进去。

重点讲一下https的配置，第一步，你要保证你外部环境的443端口是打开的。

第二步确保你安装了ssl_module。没有就apt-getinstallopenssl，可能还需要一些依赖，但是都是小问题。

然后打开ports.conf，以下几句是不可少的：


Listen443



Listen443

接着打开mods-available，找到ssl.conf和ssl.load

ssl.load长这样：

#Depends:setenvifmimesocache_shmcb
LoadModulessl_module/usr/lib/apache2/modules/mod_ssl.so
ssl.conf长这样：


#PseudoRandomNumberGenerator(PRNG):
#ConfigureoneormoresourcestoseedthePRNGoftheSSLlibrary.
#Theseeddatashouldbeofgoodrandomquality.
#WARNING!Onsomeplatforms/dev/randomblocksifnotenoughentropy
#isavailable.Thismeansyouthencannotusethe/dev/randomdevice
#becauseitwouldleadtoverylongconnectiontimes(aslongas
#itrequirestomakemoreentropyavailable).Butusuallythose
#platformsadditionallyprovidea/dev/urandomdevicewhichdoesn't
#block.So,ifavailable,usethisoneinstead.Readthemod_sslUser
#Manualformoredetails.
#
SSLRandomSeedstartupbuiltin
SSLRandomSeedstartupfile:/dev/urandom512
SSLRandomSeedconnectbuiltin
SSLRandomSeedconnectfile:/dev/urandom512

##
##SSLGlobalContext
##
##AllSSLconfigurationinthiscontextappliesbothto
##themainserverandallSSL-enabledvirtualhosts.
##

#
#SomeMIME-typesfordownloadingCertificatesandCRLs
#
AddTypeapplication/x-x509-ca-cert.crt
AddTypeapplication/x-pkcs7-crl.crl

#PassPhraseDialog:
#Configurethepassphrasegatheringprocess.
#Thefilteringdialogprogram(`builtin'isainternal
#terminaldialog)hastoprovidethepassphraseonstdout.
SSLPassPhraseDialogexec:/usr/share/apache2/ask-for-passphrase

#Inter-ProcessSessionCache:
#ConfiguretheSSLSessionCache:Firstthemechanism
#touseandsecondtheexpiringtimeout(inseconds).
#(Themechanismdbmhasknownmemoryleaksandshouldnotbeused).
#SSLSessionCachedbm:${APACHE_RUN_DIR}/ssl_scache
SSLSessionCacheshmcb:${APACHE_RUN_DIR}/ssl_scache(512000)
SSLSessionCacheTimeout300

#Semaphore:
#Configurethepathtothemutualexclusionsemaphorethe
#SSLengineusesinternallyforinter-processsynchronization.
#(Disabledbydefault,theglobalMutexdirectiveconsolidatesbydefault
#this)
#Mutexfile:${APACHE_LOCK_DIR}/ssl_mutexssl-cache


#SSLCipherSuite:
#Listtheciphersthattheclientispermittedtonegotiate.Seethe
#ciphers(1)manpagefromtheopensslpackageforlistofallavailable
#options.
#Enableonlysecureciphers:
SSLCipherSuiteHIGH:!RC4:!MD5:!aNULL:!eNULL:!NULL:!DH:!EDH:!EXP:+MEDIUM

#SSLservercipherorderpreference:
#Useserverprioritiesforcipheralgorithmchoice.
#Clientsmaypreferlowergradeencryption.Youshouldenablethis
#optionifyouwanttoenforcestrongerencryption,andcanafford
#theCPUcost,anddidnotoverrideSSLCipherSuiteinawaythatputs
#insecureciphersfirst.
#Default:Off
SSLHonorCipherOrderon

#Theprotocolstoenable.
#Availablevalues:all,SSLv3,TLSv1,TLSv1.1,TLSv1.2
#SSLv2isnolongersupported
SSLProtocolall-SSLv2-SSLv3

#Allowinsecurerenegotiationwithclientswhichdonotyetsupportthe
#securerenegotiationprotocol.Default:Off
#SSLInsecureRenegotiationon

#Whethertoforbidnon-SNIclientstoaccessnamebasedvirtualhosts.
#Default:Off
#SSLStrictSNIVHostCheckOn



#vim:syntax=apachets=4sw=4sts=4srnoet

之后就是站点的配置了，这里使用默认的default-ssl.conf：



ServerName

################加入你自己的站点配置##########



#Availableloglevels:trace8,...,trace1,debug,info,notice,warn,
#error,crit,alert,emerg.
#Itisalsopossibletoconfiguretheloglevelforparticular
#modules,e.g.
#LogLevelinfossl:warn

ErrorLog${APACHE_LOG_DIR}/error.log
CustomLog${APACHE_LOG_DIR}/access.logcombined

#Formostconfigurationfilesfromconf-available/,whichare
#enabledordisabledatagloballevel,itispossibleto
#includealineforonlyoneparticularvirtualhost.Forexamplethe
#followinglineenablestheCGIconfigurationforthishostonly
#afterithasbeengloballydisabledwith"a2disconf".
#Includeconf-available/serve-cgi-bin.conf

#SSLEngineSwitch:
#Enable/DisableSSLforthisvirtualhost.
SSLEngineon

#Aself-signed(snakeoil)certificatecanbecreatedbyinstalling
#thessl-certpackage.See
#/usr/share/doc/apache2/README.Debian.gzformoreinfo.
#Ifbothkeyandcertificatearestoredinthesamefile,onlythe
#SSLCertificateFiledirectiveisneeded.
SSLCertificateFile/etc/apache2/cert/public.pem
SSLCertificateKeyFile/etc/apache2/cert/xxxxxxx.key

#ServerCertificateChain:
#PointSSLCertificateChainFileatafilecontainingthe
#concatenationofPEMencodedCAcertificateswhichformthe
#certificatechainfortheservercertificate.Alternatively
#thereferencedfilecanbethesameasSSLCertificateFile
#whentheCAcertificatesaredirectlyappendedtotheserver
#certificateforconvinience.
SSLCertificateChainFile/etc/apache2/cert/chain.pem

#CertificateAuthority(CA):
#SettheCAcertificateverificationpathwheretofindCA
#certificatesforclientauthenticationoralternativelyone
#hugefilecontainingallofthem(filemustbePEMencoded)
#Note:InsideSSLCACertificatePathyouneedhashsymlinks
#topointtothecertificatefiles.Usetheprovided
#Makefiletoupdatethehashsymlinksafterchanges.
#SSLCACertificatePath/etc/ssl/certs/
#SSLCACertificateFile/etc/apache2/ssl.crt/ca-bundle.crt

#CertificateRevocationLists(CRL):
#SettheCArevocationpathwheretofindCACRLsforclient
#authenticationoralternativelyonehugefilecontainingall
#ofthem(filemustbePEMencoded)
#Note:InsideSSLCARevocationPathyouneedhashsymlinks
#topointtothecertificatefiles.Usetheprovided
#Makefiletoupdatethehashsymlinksafterchanges.
#SSLCARevocationPath/etc/apache2/ssl.crl/
#SSLCARevocationFile/etc/apache2/ssl.crl/ca-bundle.crl

#ClientAuthentication(Type):
#Clientcertificateverificationtypeanddepth.Typesare
#none,optional,requireandoptional_no_ca.Depthisa
#numberwhichspecifieshowdeeplytoverifythecertificate
#issuerchainbeforedecidingthecertificateisnotvalid.
#SSLVerifyClientrequire
#SSLVerifyDepth10

#SSLEngineOptions:
#SetvariousoptionsfortheSSLengine.
#oFakeBasicAuth:
#TranslatetheclientX.509intoaBasicAuthorisation.Thismeansthat
#thestandardAuth/DBMAuthmethodscanbeusedforaccesscontrol.The
#usernameisthe`oneline'versionoftheclient'sX.509certificate.
#Notethatnopasswordisobtainedfromtheuser.Everyentryintheuser
#fileneedsthispassword:`xxj31ZMTZzkVA'.
#oExportCertData:
#Thisexportstwoadditionalenvironmentvariables:SSL_CLIENT_CERTand
#SSL_SERVER_CERT.ThesecontainthePEM-encodedcertificatesofthe
#server(alwaysexisting)andtheclient(onlyexistingwhenclient
#authenticationisused).Thiscanbeusedtoimportthecertificates
#intoCGIscripts.
#oStdEnvVars:
#ThisexportsthestandardSSL/TLSrelated`SSL_*'environmentvariables.
#Perdefaultthisexportationisswitchedoffforperformancereasons,
#becausetheextractionstepisanexpensiveoperationandisusually
#uselessforservingstaticcontent.Sooneusuallyenablesthe
#exportationforCGIandSSIrequestsonly.
#oOptRenegotiate:
#ThisenablesoptimizedSSLconnectionrenegotiationhandlingwhenSSL
#directivesareusedinper-directorycontext.
#SSLOptions+FakeBasicAuth+ExportCertData+StrictRequire

SSLOptions+StdEnvVars


SSLOptions+StdEnvVars


#SSLProtocolAdjustments:
#ThesafeanddefaultbutstillSSL/TLSstandardcompliantshutdown
#approachisthatmod_sslsendstheclosenotifyalertbutdoesn'twaitfor
#theclosenotifyalertfromclient.Whenyouneedadifferentshutdown
#approachyoucanuseoneofthefollowingvariables:
#ossl-unclean-shutdown:
#Thisforcesanuncleanshutdownwhentheconnectionisclosed,i.e.no
#SSLclosenotifyalertissendorallowedtoreceived.Thisviolates
#theSSL/TLSstandardbutisneededforsomebrain-deadbrowsers.Use
#thiswhenyoureceiveI/Oerrorsbecauseofthestandardapproachwhere
#mod_sslsendstheclosenotifyalert.
#ossl-accurate-shutdown:
#Thisforcesanaccurateshutdownwhentheconnectionisclosed,i.e.a
#SSLclosenotifyalertissendandmod_sslwaitsfortheclosenotify
#alertoftheclient.Thisis100%SSL/TLSstandardcompliant,butin
#practiceoftencauseshangingconnectionswithbrain-deadbrowsers.Use
#thisonlyforbrowserswhereyouknowthattheirSSLimplementation
#workscorrectly.
#Notice:MostproblemsofbrokenclientsarealsorelatedtotheHTTP
#keep-alivefacility,soyouusuallyadditionallywanttodisable
#keep-aliveforthoseclients,too.Usevariable"nokeepalive"forthis.
#Similarly,onehastoforcesomeclientstouseHTTP/1.0toworkaround
#theirbrokenHTTP/1.1implementation.Usevariables"downgrade-1.0"and
#"force-response-1.0"forthis.
#BrowserMatch"MSIE[2-6]"\
#nokeepalivessl-unclean-shutdown\
#downgrade-1.0force-response-1.0




#vim:syntax=apachets=4sw=4sts=4srnoet

发现了吗，这是把阿里云教程里的配置项分散到了两个配置文件里面。

然后在浏览器上使用https访问，成功。(linux可以使用wget或curl测试)

以上就是本文的全部内容，希望对大家的学习有所帮助，也希望大家多多支持毛票票。

详解在Ubuntu上的Apache配置SSL(https证书)的正确姿势

热门推荐

随机推荐