② CA主机将已签署的证书通过可靠方式传送给该Webf服务器。这里同样使用scp命令。
[root@test1 ~]# scp /etc/pki/CA/certs/httpd.crt root@192.168.10.128:/etc/httpd/ssl/
(11) Web服务器在已经得到CA签署的证书了，现在开始配置HTTPS服务，首先安装mod_ssl模块。
[root@web ~]# yum install mod_ssl
查看ssl_module是否已经加载。
[root@web ~]# httpd -M | grep ssl_module
ssl_module (shared) # ssl模块已经加载
Syntax OK
(12) 修改/etc/httpd/conf.d/ssl.conf配置文件。
[root@web ~]# vim /etc/httpd/conf.d/ssl.conf
# 修改以下配置项
<VirtualHost 192.168.10.128:443>
DocumentRoot "/web/vhosts/www2"
ServerName www2.itab.com
SSLCertificateFile /etc/httpd/ssl/httpd.crt
SSLCertificateKeyFile /etc/httpd/ssl/httpd.key
检查语法错误。
[root@web ~]# httpd -t
Syntax OK
重载服务。
[root@web ~]# service httpd reload
查看是否监听在443端口。
[root@web ~]# ss -tnl | grep 443
LISTEN 0 128 :::443 :::*
(13) 使用Web服务器本主机测试。
[root@web ~]# openssl s_client -connect www2.itab.com:443 -CAfile /etc/pki/CA/cacert.pem
CONNECTED(00000003)
......（中间省略）......
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES256-GCM-SHA384
Session-ID: 379BE969583B315BC9C8C43F64107EE2CD9CB12668ECA26725D8749BA9CDABD2
Session-ID-ctx:
Master-Key: FB5258D5C5FB3EF484831FC306B883EA84D106399CC5630A34169E7B2949FD45A9B90D025AB82EC34887A7C9D8E3F7E2
Key-Arg : None
Krb5 Principal: None
PSK identity: None
PSK identity hint: None
TLS session ticket lifetime hint: 300 (seconds)
TLS session ticket:
0000 - 55 ba da 0d 93 a9 67 a4-46 1b 21 ab 6f a3 03 5d U.....g.F.!.o..]
0010 - 6e aa d8 23 25 8d 7d 8a-41 db 47 ea a9 3b fb 7c n..#%.}.A.G..;.|
0020 - 70 59 b2 a3 6c cd 7e 00-4e 8a 3e ef 7d 6b f4 68 pY..l.~.N.>.}k.h
0030 - 59 0a 2d 6d a1 1b 36 84-62 7c 3f 51 5d 24 aa 90 Y.-m..6.b|?Q]$..
0040 - a8 7f 0a a9 f7 a3 fa b2-a0 ea 30 ef 35 80 7d 13 ..........0.5.}.
0050 - 66 8c d2 47 be b5 47 1f-64 90 e9 c7 ce 7e a6 6f f..G..G.d....~.o
0060 - 10 e5 ab 58 98 70 ab 14-07 ca 04 b0 c4 2f d8 f6 ...X.p......./..
0070 - 70 52 85 f2 1c 93 13 ca-0c ef 7e b2 5a f3 f2 09 pR........~.Z...
0080 - e3 fd e6 d1 01 18 4b 63-74 ce b9 9c c0 a5 2e 1e ......Kct.......
0090 - 8c 9a 7d 7f 35 69 b3 81-01 64 7a 9c 2c 61 24 07 ..}.5i...dz.,a$.
00a0 - 29 69 af b8 19 a7 78 ff-2a 2e a5 8f fe 11 21 b0 )i....x.*.....!.
00b0 - 86 78 fd b7 ae 55 3b 10-44 b4 81 25 02 40 0a c5 .x...U;.D..%.@..
Start Time: 1491487607
Timeout : 300 (sec)
Verify return code: 21 (unable to verify the first certificate)
---
GET /index.html HTTP/1.1 # 测试能否获取www2.itab.com的主页面资源
Host: www2.itab.com
HTTP/1.1 200 OK # 获取成功
Date: Thu, 06 Apr 2017 14:06:57 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Thu, 06 Apr 2017 11:29:45 GMT
ETag: "4342e-19-54c7dd36ab98c"
Accept-Ranges: bytes
Content-Length: 25
Connection: close
Content-Type: text/html; charset=UTF-8
<h1> www2.itab.com </h1>
closed
[root@web ~]#
测试完毕，使用httpd-2.2搭建HTTP/HTTPS服务成功。接下来使用httpd-2.4搭建同样的HTTP/HTTPS服务。
httpd-2.4