配置 https
最后更新于:2022-04-02 02:55:21
[TOC]
## 配置
> [参考文档](https://blog.csdn.net/wlmnzf/article/details/50244409)
### httpd.conf
取消注释
```
#LoadModule ssl_module modules/mod_ssl.so
#Include conf/extra/httpd-mpm.conf
#Include conf/extra/httpd-ssl.conf
```
### httpd-ssl.conf
取消注释
```
SSLCertificateFile "c:/Apache24/conf/server.crt"
SSLCertificateKeyFile "c:/Apache24/conf/server.key"
SSLCACertificateFile "c:/Apache24/conf/ca.crt"
SSLVerifyClient require
SSLVerifyDepth 1
SSLEngine on
```
### 生成证书
```
#生成服务器端的私钥(key文件)
set OPENSSL_CONF=openssl.cnf
openssl genrsa -des3 -out server.key 1024
# 生成server.csr
openssl req -new -key server.key -out server.csr -config openssl.cnf
# 对客户端也作同样的命令生成key及csr文件
openssl genrsa -des3 -out client.key 1024
openssl req -new -key client.key -out client.csr -config openssl.cnf
# 生成ca证书
openssl req -new -x509 -keyout ca.key -out ca.crt -config openssl.cnf
```
创建文件
```
在bin目录下新建一个demoCA文件夹,进入它
新建newcerts文件夹,不需要进入
新建index.txt
新建serial,打开后输入01保存即可
```
```
# 用生成的CA的证书为刚才生成的server.csr,client.csr文件签名
openssl ca -in server.csr -out server.crt -cert ca.crt -keyfile ca.key -config openssl.cnf
openssl ca -in client.csr -out client.crt -cert ca.crt -keyfile ca.key -config openssl.cnf
```
第二条指令出现错误,进入demoCA,然后打开index.txt.attr,把它修改成`unique_subject = no`就可以了
生成一个ca.pfx,导入`打开IE浏览器-》工具-》Internet选项-》内容-》证书`
`openssl pkcs12 -export -in ca.crt -inkey ca.key -out ca.pfx`
### 配置站点
```
DocumentRoot "../your_htdocs"
Options FollowSymLinks
AllowOverride All
Require all granted
```
## 错误
### The commonName field needed to be supplied and was missing
修改 `openssl.cnf`
```
commonName = supplied
//改为
commonName = optional
```
### 2.SSLPassPhraseDialog builtin is not supported on Win32(key file C:/Apache24/conf/server.key)
Windows不支持加密密钥
`openssl rsa -in server.key -out server.key
`
直接替换server.key 即可,无需重新走流程
### client denied by server configuration
配置文件
';