安全工具ssl

如何实现ssl

1、要想使我们的web服务器支持ssl的功能，第一步需要安装ssl的模块
yum install mod_ssl -y   #安装在172.16.50.5上
2、提供CA，CA自签证书让我们的服务器生成一段密钥，把公钥发送给服务器端，让服务器端实现签名
在这里我们使用两台主机来实现CA，它们的IP地址分别为
172.16.50.5，172.16.50.4，让172.16.50.4作为CA
3、生成一个私钥（这是在172.16.50.4上生成的） 如图1

图1

4、生成自签证书   #如图2
在生成自签证书时它会让我们填很多的信息，填起来很烦人，但是他也有默认信息，我们只有修改
一下它的默认选项，下次再用时就不用填了
vim /etc/pki/tls/openssl.cnf   #编辑配置文件
[ req_distinguished_name ]
countryName                     = Country Name (2 letter code)
countryName_default             = CN   #默认国家名
countryName_min                 = 2
countryName_max                 = 2

stateOrProvinceName             = State or Province Name (full name)
stateOrProvinceName_default     = Henan   #默认省份

localityName                    = Locality Name (eg, city)
 
     
     localityName_default            = zhengzhou   #默认城市名

 
     
     0.organizationName              = Organization  
     Name 
      (eg, company)
 
     
     0.organizationName_default      = Magedu   #组织名称

 
     
     # we can do this but it  
     is 
       
     not 
      needed normally :-)
 
     
     #1.organizationName             =  
     Second 
      Organization  
     Name 
      (eg, company)
 
     
     #1.organizationName_default     = World Wide Web Pty Ltd

 
     
     organizationalUnitName          = Organizational Unit  
     Name 
      (eg,  
     section 
     )
 
     
     organizationalUnitName_default  = Tech   #部门名称
 
     
     好了，现在我们来生成自签证书

图2

5、这里我们还要改一下配置文件中我们生成自签证书的路径
vim /etc/pki/tls/openssl.cnf
[ CA_default ]

dir             = /etc/pki/CA  路径位置 # Where everything is kept
certs           = $dir/certs 生成证书的位置 # Where the issued certs are kept
crl_dir         = $dir/crl  证书吊销列表的位置  # Where the issued crl are kept
database        = $dir/index.txt 签订的证书放在这个索引文件中# database index file.
#unique_subject = no                    # Set to 'no' to allow creation of
                                        # several ctificates with same subject.
new_certs_dir   = $dir/newcerts 新签的证书的位置 # default place for new certs.

certificate     = $dir/cacert.pem CA证书      # The CA certificate
serial          = $dir/serial 序列号          # The current serial number
crlnumber       = $dir/crlnumber        # the current crl number
                                        # must be commented out to leave a V1 CRL
crl             = $dir/crl.pem          # The current CRL
private_key     = $dir/private/cakey.pem生成的私钥# The private key
RANDFILE        = $dir/private/.rand    # private random number file

x509_extensions = usr_cert              # The extentions to add to the cert
6、好了配置文件改好，接下来准备CA需要的目录和文件（注意这些工作是在CA目录下完成的）
[root@server21 CA]# mkdir certs crl newcerts   #创建目录
[root@server21 CA]# touch index.txt    #创建文件
[root@server21 CA]# echo 01 > serial    #序列号
[root@server21 CA]# ls    #查看生成的目录及文件
cacert.pem  certs  crl  index.txt  newcerts  private  serial
现在CA就可以用了，那么接下来如果有人需要用到证书，他只需要申请一对密钥、并把他
的申请放到我们这里，并生成一个证书签署请求，把请求发到我们的服务器上来签署就可以了
7、回到我们的服务器端（172.16.50.5）
如果刚才那个证书就是给我们的web服务器用的，因此我们需要把证书放在/etc/httpd/
[root@station41 httpd]# cd /etc/httpd/
[root@station41 httpd]# cd
[root@station41 ~]# cd /etc/httpd/
[root@station41 httpd]# ls
conf  conf.d  logs  modules  run
[root@station41 httpd]# mkdir ssl -pv
mkdir: created directory `ssl'
[root@station41 httpd]# cd ssl/
#生成一对密钥，把公钥包装成证书签署请求发送给服务器
[root@station41 ssl]# (umask 077; openssl genrsa 1024 > httpd.key)
Generating RSA private key, 1024 bit long modulus
..........................++++++
..............................++++++
e is 65537 (0x10001)
#生成证书颁发请求
[root@station41 ssl]# openssl req -new -key httpd.key -out httpd.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:国家
State or Province Name (full name) [Henan]:省份
Locality Name (eg, city) [Zhengzhou]:zhengzhou城市
Organization Name (eg, company) [MagEdu]:Magedu组织机构
Organizational Unit Name (eg, section) [Tech]: 部门
Common Name (eg, your name or your server's hostname) []:www.jll.com 主机名，你给谁用就写谁
Email Address []:[email protected]    #邮件

Pleaseenter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@station41 ssl]# ls
httpd.csr  httpd.key
8、返回CA主机，把刚才的复制过来，或者直接在服务器端传送，都可以
[root@server21 tmp]# scp 172.16.50.5:/etc/httpd/ssl/httpd.csr ./
[email protected]'s password:
httpd.csr                                                     100%  688     0.7KB/s   00:00
[root@server21 tmp]# ll
total 8
-rw-r--r-- 1 root root 688 Apr 10 02:15 httpd.csr
9、CA签署
[root@server21 ~]# openssl ca -in /tmp/httpd.csr -out /tmp/httpd.crt -days 3650
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Apr  9 18:20:00 2013 GMT
            Not After : Apr  7 18:20:00 2023 GMT
        Subject:
            countryName               = CN
            stateOrProvinceName       = Henan
            organizationName          = Magedu
            organizationalUnitName    = Tech
            commonName                = www.jll.com
            emailAddress              = [email protected]
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            Netscape Comment:
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier:
                C2:94:C8:E7:A1:70:36:09:92:4F:0D:BD:42:8A:F9:5D:1F:64:32:DC
            X509v3 Authority Key Identifier:
                keyid:27:71:DB:56:8E:33:29:76:1B:D6:92:BC:5E:57:D0:AE:70:5F:BB:8A
Certificate is to be certified until Apr  7 18:20:00 2023 GMT (3650 days)
Sign the certificate? [y/n]:y  #确定
1 out of 1 certificate requests certified, commit? [y/n]y  #确定
Write out database with 1 new entries
Data Base Updated
[root@server21 ~]# cd /etc/pki/CA/  #验证
[root@server21 CA]# ls
cacert.pem  crl        index.txt.attr  newcerts  serial
certs       index.txt  index.txt.old   private   serial.old
[root@server21 CA]# cat index.txt  #查看
V   230407182000Z       01  unknown /C=CN/ST=Henan/O=Magedu/OU=Tech/CN=www.jll.com/[email protected]
[root@server21 CA]# cat serial   #查看序列号
02
10、签署完成，把证书复制给172.16.50.4即可
root@server21 CA]# scp /tmp/httpd.crt 172.16.50.5:/etc/httpd/ssl/
[email protected]'s password:
httpd.crt                                                     100% 3822     3.7KB/s
11、回到172.16.50.5
查看是否复制成功
[root@station41 ssl]# ls
httpd.crt  httpd.csr  httpd.key
12、再回到172.16.50.4
此时为了安全起见我们应该删除tmp下安全性文件，以防别人获取你的安全信息
[root@server21 CA]# cd /tmp/
[root@server21 tmp]# ls
httpd.crt  httpd.csr
[root@server21 tmp]# rm -rf httpd.c*
[root@server21 tmp]# ls
[root@server21 tmp]#
13、创建工作环境
[root@station41 ~]# cd /etc/httpd/conf.d/
[root@station41 conf.d]# ls
manual.conf  proxy_ajp.conf  README  ssl.conf  welcome.conf
[root@station41 conf.d]# cp ssl.conf ssl.conf.bak  #修改配置文件前先备份一份
[root@station41 conf.d]# vim ssl.conf   #修改配置文件，如图，修改完成后在进行下面的工作




[root@station41 conf.d]# httpd -t
Warning: DocumentRoot [/www/jll.com] does not exist   #目录不存在，创建一下即可
Syntax OK
创建虚拟主机
vim /etc/httpd/conf.d/virtual.conf
 NameVirtualHost 172.16.50.5:80
<VirtualHost 172.16.50.5:80>
 ServerName www.jll.com
 DocumentRoot "/www/jll.com"
</VirtualHost>     #这部分知识在博文apache的配置中有详细介绍
取消中心主机
vim /etc/httpd/conf/httpd.conf
DocumentRoot "/var/www/html"    #将此行注释掉

[root@station41 conf.d]# mkdir /www/jll.com -pv  #创建目录
mkdir: created directory `/www'
mkdir: created directory `/www/jll.com'
[root@station41 conf.d]# httpd -t
Syntax OK
[root@station41 conf.d]# vim /www/jll.com/index.html   #编辑一下文档
<h1>jll.com</h1>
[root@station41 conf.d]# service httpd restart   #重启服务
Stopping httpd:                                            [  OK  ]
Starting httpd:                                            [  OK  ]
[root@station41 conf.d]# netstat -tnlp   #查看监听的443端口是否启动
tcp        0      0 0.0.0.0:443                 0.0.0.0:*                   LISTEN      7901/httpd
14、在windows上使用主机名解析
首先在hosts文件中添加
172.16.50.5 www.jll.com
[root@server21 ~]# cd /etc/pki/CA/    #在172.16.50.4上完成的操作
将此/etc/pki/httpd/cacert.pem导出到物理主机上,并重命名为cacert.crt
双击并安装
此时在访问www.jll.com就可以了
https://www.jll.com 如图

到此我们的CA认证就做好了

 

这就是简单的CA认证，你会了吗？可能会有一种晕的感觉，嘿嘿，多做几遍就可以了，不要急哦！