这里可以参考:
关于SSL的配置很多,这里我根据实际情况,做了一个简单实用的SSL加密机制。方法如下:Apache2在Ubuntu系统内的基本情况如下:
l 默认站点在 /var/www/
l 配置文件在 /etc/apache2/
l 日志在 /var/log/apache/
l 启动脚本是 /usr/sin/apache2ctl 或者 /etc/init.d/apache2
Apache2已经在前面第2步安装好了,下面安装SSL模块:
安装SSL模块
sudo a2enmod ssl
我们可以使用openssl来创建,这里我就是此方法创建SSL证书的。
#sudo openssl req -x509 -newkey rsa:1024 -keyout apache.pem -out apache.pem -nodes -days 999
注:在要求输入Common Name (eg, YOUR name) 时,输入你的主机名。
示例过程如下:
#sudo openssl req -x509 -newkey rsa:1024 -keyout apache.pem -out apache.pem -nodes -days 999
Generating a 1024 bit RSA private key
.....................++++++
..++++++
writing new private key to 'apache.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:China
string is too long, it needs to be less than 2 bytes long
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:Beijing
Locality Name (eg, city) []:Haidian
Organization Name (eg, company) [Internet Widgits Pty Ltd]:ABC
Organizational Unit Name (eg, section) []:Dep9
Common Name (eg, YOUR name) []:SvnServer
Email Address []:111@gmail.com
此时/home/administrator目录下就有了一个apache.pem的文件
创建目录,存放证书文件
sudo mkdir /etc/apache2/ssl
复制一份站点配置做为SSL配置的原型
#sudo cp /etc/apache2/sites-available/default /etc/apache2/sites-available/ssl
#sudo ln -s /etc/apache2/sites-available/ssl /etc/apache2/sites-enabled/ssl
然后编辑SSL的配置
#sudo vi /etc/apache2/sites-enabled/ssl
把端口改为443(默认是80),加入SSL认证配置,其它的根据需要自己定制 与普通配置无异,以下蓝色字体为新添加的:
<VirtualHost *:443>
ServerSignature On
SSLEngine On
SSLCertificateFile /etc/apache2/ssl/apache.pem
ServerAdmin webmaster@localhost
DocumentRoot /var/www/
<Directory />
Options FollowSymLinks
AllowOverride None
</Directory>
<Directory /var/www/>
Options Indexes FollowSymLinks MultiViews
AllowOverride None
Order allow,deny
allow from all
</Directory>
ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
<Directory "/usr/lib/cgi-bin">
AllowOverride None
Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
"/etc/apache2/sites-enabled/ssl" 45L, 1055C
编辑Apache端口配置,去掉80端口的监听:
#sudo vi /etc/apache2/ports.conf
NameVirtualHost *:80
#Listen 80
<IfModule mod_ssl.c>
# SSL name based virtual hosts are not yet supported, therefore no
# NameVirtualHost statement here
Listen 443
</IfModule>
这里可以不用加“Listen 443”因为SSL默认认证的443端口已经打开。
别忘了把前面生成的SSL密钥文件拷贝过来
sudo cp /home/administrator/apache.pem /etc/apache2/ssl/
最后重新启动apache服务:
sudo /etc/init.d/apache2 restart
然后
netstat –an|grep :443
如果443已经打开,则说明https服务已经启动了。在浏览器上再验证一下:
https://192.168.19.3/svn
选择“是”则弹出如下验证窗口:
输入superman和口令之后:
说明加密的http访问svn也成功了。