編輯“CentOS/讓服務(wù)器支持安全HTTP協(xié)議”（章節(jié)）

==為HTTP服務(wù)器配置mod_ssl==
[1] 建立服務(wù)器密鑰
<pre>[root@sample conf]# cd /etc/httpd/conf　 ← 進(jìn)入HTTP服務(wù)器配置文件所在目錄

[root@sample conf]# rm -f ssl.*/server.*　 ← 刪除默認(rèn)或殘留的服務(wù)器證書相關(guān)文件

[root@sample conf]# make genkey　 ← 建立服務(wù)器密鑰
umask 77 ; \
/usr/bin/openssl genrsa -des3 1024 > /etc/httpd/conf/ssl.key/server.key
Generating RSA private key, 1024 bit long modulus
................++++++
....................................................................++++++
e is 65537 (0x10001)
Enter pass phrase:　 ← 在這里輸入口令
Verifying - Enter pass phrase:　 ← 確認(rèn)口令，再次輸入

[root@sample conf]# openssl rsa -in ssl.key/server.key -out ssl.key/server.key　 
← 從密鑰中刪除密碼（以避免系統(tǒng)啟動(dòng)后被詢問(wèn)口令）

Enter pass phrase for ssl.key/server.key:　 ← 輸入口令
writing RSA key
</pre>

[2] 建立服務(wù)器公鑰
<pre>[root@sample conf]# make certreq　 ← 建立服務(wù)器密鑰

umask 77 ; \
/usr/bin/openssl req -new -key /etc/httpd/conf/ssl.key/server.key -out 
/etc/httpd/conf/ssl.csr/server.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:CN　 ← 輸入國(guó)名
State or Province Name (full name) [Berkshire]:Heilongjiang　 ← 輸入省名
Locality Name (eg, city) [Newbury]:Harbin　 ← 輸入城市名
Organization Name (eg, company) [My Company Ltd]:www.centospub.com　 ← 輸入組織名（任意）
Organizational Unit Name (eg, section) []:　 ← 不輸入，直接回車
Common Name (eg, your name or your server's hostname) []:www.centospub.com　 ← 輸入通稱（任意）
Email Address []:yourname@yourserver.com 　
 ← 輸入電子郵箱地址 Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:　 ← 不輸入，直接回車
An optional company name []: 　 ← 不輸入，直接回車</pre>

[3] 建立服務(wù)器證書
<pre>[root@sample conf]# openssl x509 -in ssl.csr/server.csr -out ssl.crt/server.crt -req 
-signkey ssl.key/server.key -days 365　 ← 建立服務(wù)器證書

Signature ok
subject=/C=CN/ST=Heilongjiang/L=Harbin/O=
www.centospub.com/CN=www.centospub.com/emailAddress=yourname@yourserver.com
Getting Private key</pre>

[4] 設(shè)置[[SSL]]
<pre>[root@sample conf]# vi /etc/httpd/conf.d/ssl.conf　 ← 修改SSL的設(shè)置文件

#DocumentRoot "/var/www/html"　 ← 找到這一行，將行首的“#”去掉
　↓
DocumentRoot "/var/www/html"　 ← 變?yōu)榇藸顟B(tài)</pre>

[5] 重新啟動(dòng)HTTP服務(wù)器，讓SSL生效
<pre>[root@sample conf]# /etc/rc.d/init.d/httpd restart 　← 重新啟動(dòng)HTTP服務(wù)器 

Stopping httpd: 　　　　　　　　　　　　　 [ OK ]
Starting httpd:　　　　　　　　　　　　　　[ OK ]</pre>

[6] 設(shè)置[[防火墻]]允許SSL
<pre>[root@sample conf]# vi /etc/sysconfig/iptables 　 ← 編輯防火墻配置文件 

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT　 
← 找到這一行，接著添加如下行：
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT　 
← 開放443號(hào)端口，允許SSL

[root@sample conf]# /etc/rc.d/init.d/iptables restart 　 ← 重新啟動(dòng)防火墻，使設(shè)置生效

Flushing firewall rules: 　　　　　　　　　　　[ OK ]
Setting chains to policy ACCEPT: filter　　　 [ OK ]
Unloading iptables modules:　　　　　　　　 [ OK ]
Applying iptables firewall rules:　　　　　　 [ OK ]</pre>