一、實驗環(huán)境：CA:192.168.199.141、Apache：192.168.199.143

二、實驗步驟

1、CA證書服務器的配置

1.1.安裝openssl工具（默認使安裝完成的）

[root@CA ~]#  yum install -y openssl

1.2.查看配置文件

[root@CA /]# vim /etc/pki/tls/openssl.cnf

相關證書的存放目錄  
42 dir             = /etc/pki/CA    

存儲簽發(fā)的數(shù)字證書       

43 certs           = $dir/certs   

記錄頒發(fā)證書得到信息                 

45 database        = $dir/index.txt       

記錄證書編號

51 serial          = $dir/serial

1.3.存放證書存放相關文件位置

[root@CA ~]# cd /etc/pki/CA/

1.4.CA證書服務私鑰存放位置

[root@CA CA]# cd private

1.5.CA證書服務器創(chuàng)建自簽名證書并設置權限為600

[root@CA private]#  (umask 077;openssl genrsa -out /etc/pki/CA/private/cakey.pem 2048)

Generating RSA private key, 2048 bit long modulus

......................................+++

...............+++

e is 65537 (0x10001)

1.6.CA證書服務器簽發(fā)本地自簽名證書（需要輸入一些信息）

[root@CA private]# openssl req -new -x509 -key /etc/pki/CA/private/cakey.pem -out /etc/pki/CA/cacert.pem -days 365

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

---

Country Name (2 letter code) [XX]:cn  

State or Province Name (full name) []:zhuhai 

Locality Name (eg, city) [Default City]:zhuhai

Organization Name (eg, company) [Default Company Ltd]:skills

Organizational Unit Name (eg, section) []:skills

Common Name (eg, your name or your server's hostname) []:CA

Email Address []:

1.7.創(chuàng)建CA證書服務申請文件

[root@CA private]# cd ../

創(chuàng)建記錄申請證書的文件

[[root@CA CA]# touch index.txt  

寫入證書編號

[root@CA CA]# echo 01 > serial

[root@CA CA]# cat serial

01

2、Apache服務器的配置

2.1.安裝服務

[root@www1 /]# yum install -y httpd mod_ssl

2.2.寫入一個頁面，暫不啟動服務

[root@www1 /]# echo "this is CA " >> /var/www/html/index.html

2.3.本地生成私鑰

[root@www1 ~]# mkdir ssl 

[root@www1 ~]# cd ssl/ 

[root@www1 ssl]# (umask 077;openssl genrsa -out /root/ssl/httpd.key 2048) 
Generating RSA private key, 2048 bit long modulus 
.........................................................+++ 
..........................+++ 
e is 65537 (0x10001)

2.4.使用私鑰生成證書申請文件

[root@www1 ssl]# openssl req -new -key httpd.key -out httpd.csr

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

---

Country Name (2 letter code) [XX]:cn

State or Province Name (full name) []:zhuhai

Locality Name (eg, city) [Default City]:zhuhai

Organization Name (eg, company) [Default Company Ltd]:skills

Organizational Unit Name (eg, section) []:skills

Common Name (eg, your name or your server's hostname) []:www1

Email Address []:

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

2.5.將生成的證書申請文件發(fā)送到CA證書服務器進行授權操作

[root@www1 ssl]# scp httpd.csr root@192.168.199.141:/

3、CA證書服務器配置

3.1.將發(fā)送過來的申請文件進行授權

[root@CA /]# openssl ca -in httpd.csr -out /etc/pki/CA/certs/httpd.crt -days 365

Using configuration from /etc/pki/tls/openssl.cnf

Check that the request matches the signature

Signature ok

Certificate Details:

        Serial Number: 1 (0x1)

        Validity

            Not Before: Sep 22 02:58:58 2021 GMT

            Not After : Sep 22 02:58:58 2022 GMT

        Subject:

            countryName               = cn

            stateOrProvinceName       = zhuhai

            organizationName          = skills

            organizationalUnitName    = skills

            commonName                = www1

        X509v3 extensions:

            X509v3 Basic Constraints:

                CA:FALSE

            Netscape Comment:

                OpenSSL Generated Certificate

            X509v3 Subject Key Identifier:

                57:3E:51:FD:DE:00:B6:0D:6B:09:37:CF:F7:D2:BD:F3:F5:81:54:E1

            X509v3 Authority Key Identifier:

                keyid:B3:DD:A6:9D:11:39:AE:30:D6:0C:8B:D3:72:D7:5F:24:BE:E1:DD:F0

Certificate is to be certified until Sep 22 02:58:58 2022 GMT (365 days)

Sign the certificate? [y/n]:y  #輸入y是否要進行簽署操作

1 out of 1 certificate requests certified, commit? [y/n]y 

Write out database with 1 new entries

Data Base Updated

3.2.將生成的證書文件傳送會Apache服務器

[root@CA /]# scp /etc/pki/CA/certs/httpd.crt [root@192.168.199.143](mailto:root@192.168.199.143):/root/ssl

4、Apache服務器的配置

4.1.查看文件是已傳輸?shù)侥夸浿?/strong>

[root@www1 ssl]# ls  

httpd.crt  httpd.csr  httpd.key

[root@www1 ssl]# vim /etc/httpd/conf.d/ssl.conf

100 SSLCertificateFile /root/ssl/httpd.crt

107 SSLCertificateKeyFile /root/ssl/httpd.key

 [root@www1 ssl]# systemctl stop firewalld

[root@www1 ssl]# setenforce 0

[root@www1 ssl]# systemctl start httpd

[root@www1 ssl]# ss -tan |grep 80

LISTEN     0      128         :::80                      :::*                  

[root@www1 ssl]# ss -tan |grep 443

LISTEN     0      128         :::443                     :::*