FreeBSD 10.1环境下apache2.4配置ssl实现https

环境：

FreeBSD 10.1 x86 64

Apache2.4

openssl 1.0

01 安装openssl（Linux 发行版自行安装）

先搜索一下

#pkg search openssl

openssl-1.0.2j_1,1 SSL and crypto library
openssl-devel-1.1.0c SSL and crypto library (1.1.x)

这里我选择安装1.0

#pkg install openssl

安装之后的目录：/usr/local/openssl

配置文件

#cp /usr/local/openssl/openssl.cnf.sample /usr/local/openssl/openssl.cnf

02 生成key

# openssl req -new -nodes -out req.pem -keyout cert.key -sha256 -newkey rsa:2048 Generating a 2048 bit RSA private key ..................+++ .............................................................+++ writing new private key to \'cert.key\' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter \'.\', the field will be left blank. ----- Country Name (2 letter code) [AU]:CN State or Province Name (full name) [Some-State]:Beijing Locality Name (eg, city) []:Beijing Organization Name (eg, company) [Internet Widgits Pty Ltd]:Minsec Organizational Unit Name (eg, section) []:Administrator Common Name (eg, YOUR name) []:col.minsec.cn Email Address []:root@minsec.cn Please enter the following \'extra\' attributes to be sent with your certificate request A challenge password []: An optional company name []:

03 生成RSA key

# openssl genrsa -rand -genkey -out cert.key 2048 0 semi-random bytes loaded Generating RSA private key, 2048 bit long modulus .............................................+++ .................................................................................................................+++ e is 65537 (0x10001)

04 生成crt

# openssl req -new -x509 -days 365 -key cert.key -out cert.crt -sha256 You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter \'.\', the field will be left blank. ----- Country Name (2 letter code) [AU]:CN State or Province Name (full name) [Some-State]:Beijing Locality Name (eg, city) []:Beijing Organization Name (eg, company) [Internet Widgits Pty Ltd]:Minsec Organizational Unit Name (eg, section) []:Administrator Common Name (e.g. server FQDN or YOUR name) []:col.minsec.cn Email Address []:root@minsec.cn

当前目录下生成 cert.key 和 cert.crt 文件

#cp ./cert.key /etc/ssl/col.key

#cp ./cert.crt /etc/ssl/col.crt

为了安全修改一下权限

#chmod 700 /etc/ssl/col.key /etc/ssl/col.crt

05 修改http.conf

启用模块

LoadModule ssl_module libexec/apache24/mod_ssl.so

LoadModule socache_shmcb_module libexec/apache24/mod_socache_shmcb.so

启用配置

Include etc/apache24/extra/httpd-ssl.conf

修改extra/httpd-ssl.conf文件

SSLCertificateFile "/etc/ssl/col.crt" #修改为crt文件位置

SSLCertificateKeyFile "/etc/ssl/col.crt" #修改为key文件位置

06 修改虚拟主机

添加443端口支持

<VirtualHost *:443>
ServerAdmin root@minsec.cn
DocumentRoot "/data/wwwroot"
ServerName col.minsec.cn
ServerAlias col.minsec.cn
DirectoryIndex index.php index.html index.htm
SSLEngine on
SSLCertificateFile "/etc/ssl/col.crt" #crt文件位置
SSLCertificateKeyFile "/etc/ssl/col.key" #key文件位置
<Directory "/data/wwwroot">
Options -Indexes +FollowSymlinks
AllowOverride All
Require all granted
</Directory>
</VirtualHost>

07 http跳转到https

修改.htaccess文件

RewriteEngine On
RewriteBase /
RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^.*$ https://%{SERVER_NAME}%{REQUEST_RUI} [L,R]

08 测试

重启apache

#service apache24 restart

访问http://col.minsec.cn 重定向到https://col.minsec.cn

00 参考网址

https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/openssl.html

http://blog.csdn.net/a332708815/article/details/50461092

https://my.oschina.net/itblog/blog/651434

https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/network-ldap.html#ldap-config