利用httpd+openssl来实现网站的https
CA验证中心（颁发/吊销证书）
/ \ \
CA 证书 / 下发 \ \ 证书请求
/ 证书 \ \
client <--------数字证书------ WEB
1。web服务器,生成非对称加密密钥对（web公钥，web私钥）
2。web服务器使用 web身份信息＋web公钥 生成 web服务器的证书请求 ，并将证书请求发给CA服务器
3。CA服务器使用 CA的私钥 对 web 服务器的证书请求 进行数字签名得到 web服务器的数字证书，并将web服务器的数字证书颁发给web服务器。
4。client访问web服务器，请求https连接，下载web数字证书
5。client下载 CA数字证书（CA身份信息＋CA公钥，由上一级CA颁发，也可自签名颁发），验证 web数字证书（CA数字证书中有CA公钥，web数字证书是使用CA私钥签名的）
6。client与web协商对称加密算法，client生成对称加密密钥并使用web公钥加密，发送给web服务器，web服务器使用web私钥解密
7。使用对称加密密钥传输数据，并校验数据的完整性
下面呢我们来讲一下具体步骤
配置CA服务器
========================================================
1.配置CA 172.16.1.2 生成CA自己的公钥 私钥 CA对自己进行证书自签名 (用脚本生成)
[root@CA ~]# vim /etc/pki/tls/openssl.cnf
dir = /etc/CA # Where everything is kept 第45行
basicConstraints=CA:TRUE # 自签署的证书可以使用 第178行
[root@CA ~]# vim /etc/pki/tls/misc/CA
CATOP=/etc/CA #第42行
[root@CA ~]# /etc/pki/tls/misc/CA -newca
CA certificate filename (or enter to create)
Making CA certificate ...
Generating a 1024 bit RSA private key
......++++++
.......................++++++
writing new private key to '../../CA/private/./cakey.pem' #私钥
Enter PEM pass phrase:123456 #保护CA私钥
Verifying - Enter PEM pass phrase:123456
-----
You are about to be asked to enter information that will be incorporated into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:CN #身份信息
State or Province Name (full name) [Berkshire]:BEIJING
Locality Name (eg, city) [Newbury]:HD
Organization Name (eg, company) [My Company Ltd]:linuxidc
Organizational Unit Name (eg, section) []:IT
Common Name (eg, your name or your server's hostname) []:CA.linuxidc.com
Email Address []:CA@linuxidc.com
Please enter the following 'extra' attributes to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for ../../CA/private/./cakey.pem:123456 #使用私钥自签名
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 0 (0x0)
Validity
Not Before: Mar 5 01:40:50 2012 GMT
Not After : Mar 5 01:40:50 2015 GMT
Subject:
countryName = CN
stateOrProvinceName = BEIJING
organizationName = linuxidc
organizationalUnitName = IT
commonName = CA.linuxidc.com
emailAddress = CA@linuxidc.com
X509v3 extensions:
X509v3 Basic Constraints:
CA:TRUE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
61:D5:3A:C7:5C:0F:66:FE:D5:EF:5D:A1:94:8F:FD:C2:E5:94:7D:D3
X509v3 Authority Key Identifier:
keyid:61:D5:3A:C7:5C:0F:66:FE:D5:EF:5D:A1:94:8F:FD:C2:E5:94:7D:D3
Certificate is to be certified until Mar 5 01:40:50 2015 GMT (1095 days)
Write out database with 1 new entries
Data Base Updated