Linux系统Apache配置SSL证书

发表于 更新于 分类于
在Centos7系列系统下，配置Apache服务器，给服务器增加SSL证书功能，让页面访问是不再提示不安全，具体操作流程如下。

在Centos7系列系统下，配置Apache服务器，给服务器增加SSL证书功能，让页面访问是不再提示不安全，具体操作流程如下。

1.第一步首先需要安装mod_ssl模块，执行yum install -y mod_ssl命令即可安装完毕。

打开配置文件写入以下配置项。

[lyshark@localhost] # cat /etc/httpd/conf/httpd.conf

ServerRoot "/etc/httpd"
Listen 80

# 导入模块
Include conf.modules.d/*.conf

# 启用伪静态
LoadModule rewrite_module modules/mod_rewrite.so

User apache
Group apache
ServerAdmin root@localhost
DocumentRoot "/var/www/html"

<Directory />
    Options FollowSymLinks
    AllowOverride all
    Require all denied
</Directory>

<Directory "/var/www">
    Options FollowSymLinks
    AllowOverride None
    Require all granted
</Directory>

<Directory "/var/www/html">
    Options FollowSymLinks
    AllowOverride All
    Require all granted
</Directory>

<IfModule dir_module>
    DirectoryIndex index.html
</IfModule>

<Files ".ht*">
    Require all denied
</Files>

ErrorLog "logs/error_log"
LogLevel warn

<IfModule log_config_module>
    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
    LogFormat "%h %l %u %t \"%r\" %>s %b" common

    <IfModule logio_module>
      LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
    </IfModule>

    CustomLog "logs/access_log" combined
</IfModule>

<IfModule alias_module>
    ScriptAlias /cgi-bin/ "/var/www/cgi-bin/"
</IfModule>

<Directory "/var/www/cgi-bin">
    AllowOverride None
    Options None
    Require all granted
</Directory>

<IfModule mime_module>
    TypesConfig /etc/mime.types
    AddType application/x-compress .Z
    AddType application/x-gzip .gz .tgz
    AddType text/html .shtml
    AddOutputFilter INCLUDES .shtml
</IfModule>

AddDefaultCharset UTF-8

<IfModule mime_magic_module>
    MIMEMagicFile conf/magic
</IfModule>

#EnableMMAP off
EnableSendfile on

IncludeOptional conf.d/*.conf

# 设置http跳转到https上面
RewriteEngine On
RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^(.*)?$ https://www.lyshark.com

ServerTokens Prod
ServerSignature Off

# 设置加密访问,当用户访问lyshark目录需要密码
# htpasswd -c /etc/htpasswd.db test
#<Directory /var/www/html/lyshark>
#	AuthName "请输入管理员密码"
#	AuthType Basic
#	AuthUserFile /etc/htpasswd.db
#	Require valid-user
#</Directory>

# 限制Apache只允许接受GET POST请求方式
<Location "/">
	<LimitExcept GET POST>
		Order Allow,Deny
		Deny from all
	</LimitExcept>
</Location>

2.其次需要打开ssl配置目录，将证书上传到指定目录下，并增加你自己的证书文件路径。

[lyshark@localhost] # cat /etc/httpd/conf.d/ssl.conf

Listen 443 https
SSLPassPhraseDialog exec:/usr/libexec/httpd-ssl-pass-dialog
SSLSessionCache         shmcb:/run/httpd/sslcache(512000)
SSLSessionCacheTimeout  300
SSLRandomSeed startup file:/dev/urandom  256
SSLRandomSeed connect builtin
SSLCryptoDevice builtin

<VirtualHost _default_:443>
DocumentRoot "/var/www/html"
ServerName www.lyshark.com:443
ErrorLog logs/ssl_error_log
TransferLog logs/ssl_access_log
LogLevel warn
SSLEngine on
SSLProtocol all -SSLv2 -SSLv3
SSLCipherSuite HIGH:3DES:!aNULL:!MD5:!SEED:!IDEA

# 此处增加SSL证书具体路径
SSLCertificateFile /var/www/ssl/4575832_www.lyshark.com_public.crt
SSLCertificateKeyFile /var/www/ssl/4575832_www.lyshark.com.key
SSLCertificateChainFile /var/www/ssl/4575832_www.lyshark.com_chain.crt

<Files ~ "\.(cgi|shtml|phtml|php3?)$">
    SSLOptions +StdEnvVars
</Files>
<Directory "/var/www/cgi-bin">
    SSLOptions +StdEnvVars
</Directory>

BrowserMatch "MSIE [2-5]" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0
CustomLog logs/ssl_request_log \
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

</VirtualHost>

至此只需要重启systemctl restart httpd服务器即可完成ssl配置。

3.如果需要配置伪静态，则在Web网站根目录下增加一个隐藏文件，并写入一下配置，伪静态转发。

[lyshark@localhost] # cat /var/www/html/.htaccess

RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]