FreeBSD 10.1環境下apache2.4配置ssl實現https

環境：

FreeBSD 10.1 x86 64

Apache2.4

openssl 1.0

 

01 安裝openssl（Linux 發行版自行安裝）

先搜索一下

#pkg search openssl

openssl-1.0.2j_1,1             SSL and crypto library
openssl-devel-1.1.0c           SSL and crypto library (1.1.x)

這裏我選擇安裝1.0

#pkg install openssl

安裝以後的目錄：/usr/local/openssl

配置文件

#cp /usr/local/openssl/openssl.cnf.sample /usr/local/openssl/openssl.cnf

 

02 生成key

 
Generating a 2048 bit RSA private key
..................+++
.............................................................+++
writing new private key to 'cert.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, YOUR name) []:
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:#openssl req -new -nodes -out req.pem -keyout cert.key -sha256 -newkey rsa:2048CNCNBeijingBeijingBeijingBeijingMinsecMinsecAdministratorAdministratorcol.minsec.cnroot@minsec.cn

 

03 生成RSA key

 
0 semi-random bytes loaded
Generating RSA private key, 2048 bit long modulus
.............................................+++
.................................................................................................................+++
e is 65537 (0x10001)#openssl genrsa -rand -genkey -out cert.key 2048

 

04 生成crt

 
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:
Email Address []:#openssl req -new -x509 -days 365 -key cert.key -out cert.crt -sha256CNCNBeijingBeijingBeijingBeijingMinsecMinsecAdministratorAdministratorcol.minsec.cnroot@minsec.cn

 

當前目錄下生成 cert.key 和 cert.crt 文件

#cp ./cert.key /etc/ssl/col.key

#cp ./cert.crt /etc/ssl/col.crt

爲了安全修改一下權限

#chmod 700 /etc/ssl/col.key /etc/ssl/col.crt

 

05 修改http.conf

啓用模塊

LoadModule ssl_module libexec/apache24/mod_ssl.so

LoadModule socache_shmcb_module libexec/apache24/mod_socache_shmcb.so

啓用配置

Include etc/apache24/extra/httpd-ssl.conf

修改extra/httpd-ssl.conf文件

SSLCertificateFile "/etc/ssl/col.crt" #修改成crt文件位置

SSLCertificateKeyFile "/etc/ssl/col.crt" #修改成key文件位置

 

06 修改虛擬主機

添加443端口支持

<VirtualHost *:443>
    ServerAdmin root@minsec.cn
    DocumentRoot "/data/wwwroot"
    ServerName col.minsec.cn
    ServerAlias col.minsec.cn
    DirectoryIndex index.php index.html index.htm
    SSLEngine on
    SSLCertificateFile "/etc/ssl/col.crt" #crt文件位置
    SSLCertificateKeyFile "/etc/ssl/col.key" #key文件位置
    <Directory "/data/wwwroot">
        Options -Indexes +FollowSymlinks
        AllowOverride All
        Require all granted
    </Directory>
</VirtualHost>

07 http跳轉到https

修改.htaccess文件

RewriteEngine On
RewriteBase /
RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^.*$ https://%{SERVER_NAME}%{REQUEST_RUI} [L,R]

 

08 測試

重啓apache

#service apache24 restart

訪問http://col.minsec.cn 重定向到https://col.minsec.cn

 

00 參考網址

https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/openssl.html

http://blog.csdn.net/a332708815/article/details/50461092

https://my.oschina.net/itblog/blog/651434

https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/network-ldap.html#ldap-config