环境：

FreeBSD 10.1 x86 64

Apache2.4

openssl 1.0

 

01 安装openssl（Linux 发行版自行安装）

先搜索一下

#pkg search openssl

openssl-1.0.2j_1,1             SSL and crypto library

openssl-devel-1.1.0c           SSL and crypto library (1.1.x)

这里我选择安装1.0

#pkg install openssl

安装之后的目录：/usr/local/openssl

配置文件

#cp /usr/local/openssl/openssl.cnf.sample /usr/local/openssl/openssl.cnf

 

02 生成key

# openssl req -new -nodes -out req.pem -keyout cert.key -sha256 -newkey rsa:2048Generating a 2048 bit RSA private key..................+++.............................................................+++writing new private key to 'cert.key'-----You are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank.-----Country Name (2 letter code) [AU]:CNState or Province Name (full name) [Some-State]:BeijingLocality Name (eg, city) []:BeijingOrganization Name (eg, company) [Internet Widgits Pty Ltd]:MinsecOrganizational Unit Name (eg, section) []:AdministratorCommon Name (eg, YOUR name) []:col.minsec.cnEmail Address []:root@minsec.cnPlease enter the following 'extra' attributesto be sent with your certificate requestA challenge password []:An optional company name []:

 

03 生成RSA key

# openssl genrsa -rand -genkey -out cert.key 20480 semi-random bytes loadedGenerating RSA private key, 2048 bit long modulus.............................................+++.................................................................................................................+++e is 65537 (0x10001)

 

04 生成crt

# openssl req -new -x509 -days 365 -key cert.key -out cert.crt -sha256You are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank.-----Country Name (2 letter code) [AU]:CNState or Province Name (full name) [Some-State]:BeijingLocality Name (eg, city) []:BeijingOrganization Name (eg, company) [Internet Widgits Pty Ltd]:MinsecOrganizational Unit Name (eg, section) []:AdministratorCommon Name (e.g. server FQDN or YOUR name) []:col.minsec.cnEmail Address []:root@minsec.cn

 

当前目录下生成 cert.key 和 cert.crt 文件

#cp ./cert.key /etc/ssl/col.key

#cp ./cert.crt /etc/ssl/col.crt

为了安全修改一下权限

#chmod 700 /etc/ssl/col.key /etc/ssl/col.crt

 

05 修改http.conf

启用模块

LoadModule ssl_module libexec/apache24/mod_ssl.so

LoadModule socache_shmcb_module libexec/apache24/mod_socache_shmcb.so

启用配置

Include etc/apache24/extra/httpd-ssl.conf

修改extra/httpd-ssl.conf文件

SSLCertificateFile "/etc/ssl/col.crt" #修改为crt文件位置

SSLCertificateKeyFile "/etc/ssl/col.crt" #修改为key文件位置

 

06 修改虚拟主机

添加443端口支持

<VirtualHost *:443>

    ServerAdmin root@minsec.cn     DocumentRoot "/data/wwwroot"     ServerName col.minsec.cn     ServerAlias col.minsec.cn     DirectoryIndex index.php index.html index.htm     SSLEngine on     SSLCertificateFile "/etc/ssl/col.crt" #crt文件位置     SSLCertificateKeyFile "/etc/ssl/col.key" #key文件位置     <Directory "/data/wwwroot">         Options -Indexes +FollowSymlinks         AllowOverride All         Require all granted     </Directory> </VirtualHost>

07 http跳转到https

修改.htaccess文件

RewriteEngine On

RewriteBase / RewriteCond %{SERVER_PORT} !^443$ RewriteRule ^.*$ https://%{SERVER_NAME}%{REQUEST_RUI} [L,R]

 

08 测试

重启apache

#service apache24 restart

访问http://col.minsec.cn 重定向到https://col.minsec.cn

 

00 参考网址

https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/openssl.html

http://blog.csdn.net/a332708815/article/details/50461092

https://my.oschina.net/itblog/blog/651434

https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/network-ldap.html#ldap-config