FreeBSD 10.1环境下apache2.4配置ssl实现https

环境：

FreeBSD 10.1 x86 64

Apache2.4

openssl 1.0

 

01 安装openssl（Linux 发行版自行安装）

先搜索一下

#pkg search openssl

openssl-1.0.2j_1,1             SSL and crypto library
openssl-devel-1.1.0c           SSL and crypto library (1.1.x)

这里我选择安装1.0

#pkg install openssl

安装以后的目录：/usr/local/openssl

配置文件

#cp /usr/local/openssl/openssl.cnf.sample /usr/local/openssl/openssl.cnf

 

02 生成key

 
Generating a 2048 bit RSA private key
..................+++
.............................................................+++
writing new private key to 'cert.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, YOUR name) []:
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:#openssl req -new -nodes -out req.pem -keyout cert.key -sha256 -newkey rsa:2048CNCNBeijingBeijingBeijingBeijingMinsecMinsecAdministratorAdministratorcol.minsec.cnroot@minsec.cn

 

03 生成RSA key

 
0 semi-random bytes loaded
Generating RSA private key, 2048 bit long modulus
.............................................+++
.................................................................................................................+++
e is 65537 (0x10001)#openssl genrsa -rand -genkey -out cert.key 2048

 

04 生成crt

 
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:
Email Address []:#openssl req -new -x509 -days 365 -key cert.key -out cert.crt -sha256CNCNBeijingBeijingBeijingBeijingMinsecMinsecAdministratorAdministratorcol.minsec.cnroot@minsec.cn

 

当前目录下生成 cert.key 和 cert.crt 文件

#cp ./cert.key /etc/ssl/col.key

#cp ./cert.crt /etc/ssl/col.crt

为了安全修改一下权限

#chmod 700 /etc/ssl/col.key /etc/ssl/col.crt

 

05 修改http.conf

启用模块

LoadModule ssl_module libexec/apache24/mod_ssl.so

LoadModule socache_shmcb_module libexec/apache24/mod_socache_shmcb.so

启用配置

Include etc/apache24/extra/httpd-ssl.conf

修改extra/httpd-ssl.conf文件

SSLCertificateFile "/etc/ssl/col.crt" #修改成crt文件位置

SSLCertificateKeyFile "/etc/ssl/col.crt" #修改成key文件位置

 

06 修改虚拟主机

添加443端口支持

<VirtualHost *:443>
    ServerAdmin root@minsec.cn
    DocumentRoot "/data/wwwroot"
    ServerName col.minsec.cn
    ServerAlias col.minsec.cn
    DirectoryIndex index.php index.html index.htm
    SSLEngine on
    SSLCertificateFile "/etc/ssl/col.crt" #crt文件位置
    SSLCertificateKeyFile "/etc/ssl/col.key" #key文件位置
    <Directory "/data/wwwroot">
        Options -Indexes +FollowSymlinks
        AllowOverride All
        Require all granted
    </Directory>
</VirtualHost>

07 http跳转到https

修改.htaccess文件

RewriteEngine On
RewriteBase /
RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^.*$ https://%{SERVER_NAME}%{REQUEST_RUI} [L,R]

 

08 测试

重启apache

#service apache24 restart

访问http://col.minsec.cn 重定向到https://col.minsec.cn

 

00 参考网址

https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/openssl.html

http://blog.csdn.net/a332708815/article/details/50461092

https://my.oschina.net/itblog/blog/651434

https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/network-ldap.html#ldap-config