环境： FreeBSD 10.1 x86 64 Apache2.4 openssl 1.0 01 安装openssl（Linux 发行版自行安装） 先搜索一下 #pkg search openssl
环境：
FreeBSD 10.1 x86 64
Apache2.4
openssl 1.0
01 安装openssl（Linux 发行版自行安装）
先搜索一下
#pkg search openssl
openssl-1.0.2j_1,1 SSL and crypto library
openssl-devel-1.1.0c SSL and crypto library (1.1.x)
这里我选择安装1.0
#pkg install openssl
安装之后的目录：/usr/local/openssl
配置文件
#cp /usr/local/openssl/openssl.cnf.sample /usr/local/openssl/openssl.cnf
02 生成key
#openssl req -new -nodes -out req.pem -keyout cert.key -sha256 -newkey rsa:2048Generating a 2048 bit RSA private key..................+++.............................................................+++writing new private key to 'cert.key'-----You are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank.-----Country Name (2 letter code) [AU]:State or Province Name (full name) [Some-State]:CNLocality Name (eg, city) []:BeijingOrganization Name (eg, company) [Internet Widgits Pty Ltd]:BeijingOrganizational Unit Name (eg, section) []:MinsecCommon Name (eg, YOUR name) []:Administratorcol.minsec.cnEmail Address []:[email protected]Please enter the following 'extra' attributesto be sent with your certificate requestA challenge password []:An optional company name []:
03 生成RSA key
#openssl genrsa -rand -genkey -out cert.key 20480 semi-random bytes loadedGenerating RSA private key, 2048 bit long modulus.............................................+++.................................................................................................................+++e is 65537 (0x10001)
04 生成crt
#openssl req -new -x509 -days 365 -key cert.key -out cert.crt -sha256You are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank.-----Country Name (2 letter code) [AU]:State or Province Name (full name) [Some-State]:CNLocality Name (eg, city) []:BeijingOrganization Name (eg, company) [Internet Widgits Pty Ltd]:BeijingOrganizational Unit Name (eg, section) []:MinsecCommon Name (e.g. server FQDN or YOUR name) []:Administratorcol.minsec.cnEmail Address []:[email protected]
当前目录下生成 cert.key 和 cert.crt 文件
#cp ./cert.key /etc/ssl/col.key
#cp ./cert.crt /etc/ssl/col.crt
为了安全修改一下权限
#chmod 700 /etc/ssl/col.key /etc/ssl/col.crt
05 修改http.conf
启用模块
LoadModule ssl_module libexec/apache24/mod_ssl.so
LoadModule socache_shmcb_module libexec/apache24/mod_socache_shmcb.so
启用配置
Include etc/apache24/extra/httpd-ssl.conf
修改extra/httpd-ssl.conf文件
SSLCertificateFile "/etc/ssl/col.crt" #修改为crt文件位置
SSLCertificateKeyFile "/etc/ssl/col.crt" #修改为key文件位置
06 修改虚拟主机
添加443端口支持
<VirtualHost *:443>
ServerAdmin [email protected]
DocumentRoot "/data/wwwroot"
ServerName col.minsec.cn
ServerAlias col.minsec.cn
DirectoryIndex index.php index.html index.htm
SSLEngine on
SSLCertificateFile "/etc/ssl/col.crt" #crt文件位置
SSLCertificateKeyFile "/etc/ssl/col.key" #key文件位置
<Directory "/data/wwwroot">
Options -Indexes +FollowSymlinks
AllowOverride All
Require all granted
</Directory>
</VirtualHost>
07 http跳转到https
修改.htaccess文件
RewriteEngine On
RewriteBase /
RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^.*$ https://%{SERVER_NAME}%{REQUEST_RUI} [L,R]
08 测试
重启apache
#service apache24 restart
访问http://col.minsec.cn 重定向到https://col.minsec.cn
00 参考网址
https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/openssl.html
http://blog.csdn.net/a332708815/article/details/50461092
https://my.oschina.net/itblog/blog/651434
https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/network-ldap.html#ldap-config
