其他分享
首页 > 其他分享> > 编译安装httpd

编译安装httpd

作者：互联网

编译安装httpd、

目录

1. httpd简介

httpd是Apache超文本传输协议（HTTP）服务器的主程序。被设计为一个独立运行的后台进程，它会建立一个处理请求的子进程或线程的池。

通常，httpd不应该被直接调用，而应该在类Unix系统中由apachectl调用，在Windows中作为服务运行。

2. httpd版本

本文主要介绍httpd的两大版本，httpd-2.2和httpd-2.4。

2.1 httpd的特性

httpd有很多特性，下面就分别来说说httpd-2.2版本和httpd-2.4版本各自的特性。

版本 特性
2.2 事先创建进程 按需维持适当的进程 模块化设计，核心比较小，各种功能通过模块添加（包括PHP），支持运行时配置，支持单独编译模块 支持多种方式的虚拟主机配置，如基于ip的虚拟主机，基于端口的虚拟主机，基于域名的虚拟主机等 支持https协议（通过mod_ssl模块实现） 支持用户认证 支持基于IP或域名的ACL访问控制机制 支持每目录的访问控制（用户访问默认主页时不需要提供用户名和密码，但是用户访问某特定目录时需要提供用户名和密码） 支持URL重写 支持MPM（Multi Path Modules，多处理模块）。用于定义httpd的工作模型（单进程、单进程多线程、多进程、多进程单线程、多进程多线程）
2.4 httpd-2.4的新特性： MPM支持运行DSO机制（Dynamic Share Object，模块的动态装/卸载机制），以模块形式按需加载 支持event MPM，eventMPM模块生产环境可用 支持异步读写 支持每个模块及每个目录分别使用各自的日志级别 每个请求相关的专业配置，使用来配置 增强版的表达式分析器 支持毫秒级的keepalive timeout 基于FQDN的虚拟主机不再需要NameVirtualHost指令 支持用户自定义变量 支持新的指令（AllowOverrideList） 降低对内存的消耗
工作模型 工作方式
prefork 多进程模型，预先生成进程，一个请求用一个进程响应 一个主进程负责生成n个子进程，子进程也称为工作进程 每个子进程处理一个用户请求，即使没有用户请求，也会预先生成多个空闲进程，随时等待请求到达，最大不会超过1024个
worker 基于线程工作，一个请求用一个线程响应（启动多个进程，每个进程生成多个线程）
event 基于事件的驱动，一个进程处理多个请求

2.2 httpd-2.4新增的模块

httpd-2.4在之前的版本基础上新增了几大模块，下面就几个常用的来介绍一下。

模块 功能
mod_proxy_fcgi 反向代理时支持apache服务器后端协议的模块
mod_ratelimit 提供速率限制功能的模块
mod_remoteip 基于ip的访问控制机制被改变，不再支持使用Order，Deny，Allow来做基于IP的访问控制

3. httpd基础

3.1 httpd自带的工具程序

工具 功能
htpasswd basic认证基于文件实现时，用到的帐号密码生成工具
apachectl httpd自带的服务控制脚本，支持start，stop，restart
apxs 由httpd-devel包提供的，扩展httpd使用第三方模块的工具
rotatelogs 日志滚动工具
suexec 访问某些有特殊权限配置的资源时，临时切换至指定用户运行的工具
ab apache benchmark，httpd的压力测试工具

3.2 rpm包安装的httpd程序环境

文件/目录 对应的功能
/var/log/httpd/access.log 访问日志
/var/log/httpd/error_log 错误日志
/var/www/html/ 站点文档目录
/usr/lib64/httpd/modules/ 模块文件路径
/etc/httpd/conf/httpd.conf 主配置文件
/etc/httpd/conf.modules.d/*.conf 模块配置文件
/etc/httpd/conf.d/*.conf 辅助配置文件

mpm：以DSO机制提供，配置文件为/etc/httpd/conf.modules.d/00-mpm.conf

3.3.2 httpd命令

//语法：httpd [options]
//常用的options：
    -l      //查看静态编译的模块，列出核心中编译了哪些模块。 \
            //它不会列出使用LoadModule指令动态加载的模块
    -M      //输出一个已经启用的模块列表，包括静态编译在服务 \
            //器中的模块和作为DSO动态加载的模块
    -v      //显示httpd的版本，然后退出
    -V      //显示httpd和apr/apr-util的版本和编译参数，然后退出
    -X      //以调试模式运行httpd。仅启动一个工作进程，并且 \
            //服务器不与控制台脱离
    -t      //检查配置文件是否有语法错误
 [root@localhost ~]# httpd -l
Compiled in modules:
  core.c
  mod_so.c
  http_core.c
[root@localhost ~]# httpd -M
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using localhost.localdomain. Set the 'ServerName' directive globally to suppress this message
Loaded Modules:
 core_module (static)
 so_module (static)
 http_module (static)
 access_compat_module (shared)
 actions_module (shared)
 alias_module (shared)
 allowmethods_module (shared)
 auth_basic_module (shared)
 auth_digest_module (shared)
[root@localhost ~]# httpd -v
Server version: Apache/2.4.37 (centos)
Server built:   Nov 12 2021 04:57:27
[root@localhost ~]# httpd -V
Server version: Apache/2.4.37 (centos)
Server built:   Nov 12 2021 04:57:27
Server's Module Magic Number: 20120211:83
Server loaded:  APR 1.6.3, APR-UTIL 1.6.1
Compiled using: APR 1.6.3, APR-UTIL 1.6.1
Architecture:   64-bit
Server MPM:     event
  threaded:     yes (fixed thread count)
    forked:     yes (variable process count)
Server compiled with....

3.3.4编译安装httpd-2.4

下载安装apr-1.4+、apr-uti-1.4+

[root@localhost ~]# yum -y install gcc gcc-c++ make
Failed to set locale, defaulting to C.UTF-8
Last metadata expiration check: 0:04:17 ago on Tue Jul 12 21:37:01 2022.
Dependencies resolved.
================================================================================
=
Package Architecture Version Repository Size
================================================================================
=
Installing:
gcc x86_64 8.5.0-13.el8 appstream 23 M
gcc-c++ x86_64 8.5.0-13.el8 appstream 12 M
make x86_64 1:4.2.1-11.el8 baseos 498 k
Complete!
[root@localhost ~]# dnf -y groupinstall "Development Tools"
Failed to set locale, defaulting to C.UTF-8
Last metadata expiration check: 0:06:58 ago on Tue Jul 12 19:40:05 2022.
Dependencies resolved.
Upgrading:
elfutils-libelf x86_64
0.187-4.el8 baseos
231 k
elfutils-libs x86_64
0.187-4.el8 baseos
297 k
glibc x86_64
2.28-206.el8 baseos
2.2 M
…………
Complete!
[root@localhost ~]# dnf -y install openssl-devel pcre-devel expat-devel
Failed to set locale, defaulting to C.UTF-8
Last metadata expiration check: 0:03:56 ago on Tue Jul 12 23:12:44 2022.
Dependencies resolved.
================================================================================
===
Package Architecture Version Repository
Size
================================================================================
===
Installing:
expat-devel x86_64 2.2.5-4.el8 base 55
k
2.安装apr、apr-uit、
下载并解压apr源码包
编译安装apr
下载并解压apr-utils源码包
openssl-devel x86_64 1:1.1.1k-5.el8_5 base 2.3
M
pcre-devel x86_64 8.42-6.el8 base 551
k
创建一个系统用户，用来管理apache进程
[root@localhost ~]# useradd -rMs /sbin/nologin apache
[root@localhost ~]# id apache
uid=995(apache) gid=992(apache) groups=992(apache)
[root@localhost ~]#

下载安装apr-utils、apr-util

[root@localhost src]# wget http://mirrors.aliyun.com/apache/apr/apr-1.7.0.tar.gz
--2022-07-21 15:08:29--  http://mirrors.aliyun.com/apache/apr/apr-1.7.0.tar.gz
Resolving mirrors.aliyun.com (mirrors.aliyun.com)... 119.96.138.210, 119.96.138.213, 119.96.204.210, ...
Connecting to mirrors.aliyun.com (mirrors.aliyun.com)|119.96.138.210|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1093896 (1.0M) [application/octet-stream]
Saving to: 'apr-1.7.0.tar.gz'

apr-1.7.0.tar.gz     100%[=====================>]   1.04M   337KB/s    in 3.2s    

2022-07-21 15:08:32 (337 KB/s) - 'apr-1.7.0.tar.gz' saved [1093896/1093896]

[root@localhost src]# ls
apr-1.7.0.tar.gz  debug  kernels
[root@localhost src]# wget https://mirrors.aliyun.com/apache/apr/apr-util-1.6.1.tar.gz
--2022-07-21 15:10:27--  https://mirrors.aliyun.com/apache/apr/apr-util-1.6.1.tar.gz
Resolving mirrors.aliyun.com (mirrors.aliyun.com)... 119.96.204.211, 119.96.138.213, 119.96.204.213, ...
Connecting to mirrors.aliyun.com (mirrors.aliyun.com)|119.96.204.211|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 554301 (541K) [application/octet-stream]
Saving to: 'apr-util-1.6.1.tar.gz'

apr-util-1.6.1.tar.g 100%[=====================>] 541.31K   359KB/s    in 1.5s    

2022-07-21 15:10:29 (359 KB/s) - 'apr-util-1.6.1.tar.gz' saved [554301/554301]

[root@localhost src]# ls
apr-1.7.0.tar.gz  apr-util-1.6.1.tar.gz  debug  kernels
[root@localhost src]# 
[root@localhost src]# tar xf apr-1.7.0.tar.gz
[root@localhost src]# ls
apr-1.7.0  apr-1.7.0.tar.gz  apr-util-1.6.1  apr-util-1.6.1.tar.gz  debug  kernels
[root@localhost src]# 
[root@localhost apr-1.7.0]# vi configure
[root@localhost apr-1.7.0]# 
 cfgfile="${ofile}T"
    trap "$RM \"$cfgfile\"; exit 1" 1 2 15
    # $RM "$cfgfile"        //将此行加上注释，或者删除此行
[root@localhost apr-1.7.0]# ./configure --prefix=/usr/local/apr
[root@localhost apr-1.7.0]# make && make install
[root@localhost apr-1.7.0]# cd /usr/src/apr-util-1.6.1
[root@localhost apr-util-1.6.1]# ./configure --prefix=/usr/local/apr-util --with-apr=/usr/local/apr
[root@localhost apr-util-1.6.1]# make && make install

下载并解压httpd源码包

[root@localhost ~]# wget https://mirrors.aliyun.com/apache/httpd/httpd-2.4.54.tar.gz
[root@localhost ~]# wget https://mirrors.aliyun.com/apache/httpd/httpd-2.4.54.tar.gz
--2022-07-21 15:23:02--  https://mirrors.aliyun.com/apache/httpd/httpd-2.4.54.tar.gz
Resolving mirrors.aliyun.com (mirrors.aliyun.com)... 119.96.138.215, 119.96.204.215, 119.96.204.213, ...
Connecting to mirrors.aliyun.com (mirrors.aliyun.com)|119.96.138.215|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 9743277 (9.3M) [application/octet-stream]
Saving to: 'httpd-2.4.54.tar.gz'

httpd-2.4.54.tar.gz  100%[=====================>]   9.29M   295KB/s    in 31s     

2022-07-21 15:23:33 (305 KB/s) - 'httpd-2.4.54.tar.gz' saved [9743277/9743277]

[root@localhost ~]#  tar -xf httpd-2.4.54.tar.gz -C /usr/local/src/
[root@localhost ~]#

编译安装httpd

 [root@localhost ~]# cd /usr/local/src/httpd-2.4.54/
[root@localhost httpd-2.4.54]#./configure --prefix=/usr/local/apache --enable-so --enable-ssl --enable-cgi --enable-rewrite --with-zlib --with-pcre --with-apr=/usr/local/apr --with-apr-util=/usr/local/apr-util/ --enable-modules=most --enable-mpms-shared=all --with-mpm=prefork
[root@localhost httpd-2.4.54]# make && make install
Installing CGIs
mkdir /usr/local/apache/cgi-bin
Installing header files
mkdir /usr/local/apache/include
Installing build system files
mkdir /usr/local/apache/build
Installing man pages and online manual
mkdir /usr/local/apache/man
mkdir /usr/local/apache/man/man1
mkdir /usr/local/apache/man/man8
mkdir /usr/local/apache/manual

4.配置环境变量

[root@localhost ~]# echo 'export PATH=/usr/local/apache/bin:$PATH'
export PATH=/usr/local/apache/bin:$PATH
[root@localhost ~]# >/etc/profile.d/apache.sh
[root@localhost ~]# echo 'export PATH=/usr/local/apache/bin:$PATH'
export PATH=/usr/local/apache/bin:$PATH
[root@localhost ~]# source /etc/profile.d/apache.sh
[root@localhost ~]# which apache
/usr/bin/which: no apache in (/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/root/bin)
[root@localhost ~]# ln -s /usr/local/apache/include/ /usr/include/apache
[root@localhost ~]# ll /usr/include/ | grep apache
lrwxrwxrwx.  1 root root     26 Jul 21 15:37 apache -> /usr/local/apache/include/
[root@localhost ~]#

5. httpd常用配置

切换使用MPM（编辑/etc/httpd/conf.modules.d/00-mpm.conf文件）：

访问控制法则：

法则 功能
Require all granted 允许所有主机访问
Require all deny 拒绝所有主机访问
Require ip IPADDR 授权指定来源地址的主机访问
Require not ip IPADDR 拒绝指定来源地址的主机访问
Require host HOSTNAME 授权指定来源主机名的主机访问
Require not host HOSTNAME 拒绝指定来源主机名的主机访问
IPADDR的类型 HOSTNAME的类型
IP：192.168.1.1 Network/mask：192.168.1.0/255.255.255.0 Network/Length：192.168.1.0/24 Net：192.168 FQDN：特定主机的全名 DOMAIN：指定域内的所有主机

注意：httpd-2.4版本默认是拒绝所有主机访问的，所以安装以后必须做显示授权访问

[root@localhost ~]# cd /var/www/html
[root@localhost html]# ls
[root@localhost html]# echo "hello world" > index.html
[root@localhost html]# echo "hello world" > a.html
[root@localhost ~]# cd /var/www/html
[root@localhost html]# ls
a.html  index.html
[root@localhost html]# mkdir nie
[root@localhost html]# mv a.html nie/
[root@localhost html]# ll
total 4
-rw-r--r--. 1 root root 12 Jul 21 17:42 index.html
drwxr-xr-x. 2 root root 20 Jul 21 17:48 nie
[root@localhost html]# curl http://192.168.10.145
hello world
[root@localhost html]# curl http://192.168.10.145/nie/a.html
hello world
[root@localhost html]# 
[root@localhost html]# curl http://192.168.10.145/nie/a.html
hello world
[root@localhost html]# vi /etc/httpd/conf/httpd.conf 
<Directory /var/www/html/nie>
    <RequireAll>
        Require not ip 192.168.10.1
        Require all granted
    </RequireAll>
</Directory>

[root@localhost html]# httpd -t //检查语法
Syntax OK
[root@localhost html]# systemctl restart httpd  //重启httpd服务
[root@localhost html]#

image

6.虚拟主机

虚拟主机有三类：

[root@localhost ~]# dnf -y install httpd
[root@localhost ~]# find / -name *vhosts.conf
/usr/share/doc/httpd/httpd-vhosts.conf
[root@localhost ~]# cd /etc/httpd
[root@localhost httpd]# ls
conf  conf.d  conf.modules.d  logs  modules  run  state
[root@localhost httpd]# cd conf.d/
[root@localhost conf.d]# cp /usr/share/doc/httpd/httpd-vhosts.conf /etc/httpd/conf.d/
[root@localhost html]# ls  /将自己需要的文件上传至文件夹内
doudizhu.zip  index.html  nie  tankedazhan.zip
[root@localhost html]# dnf -y install unzip /需要下载unzip解压
[root@localhost html]# unzip zhuawawaji.zip
[root@localhost html]# unzip doudizhu.zip
[root@localhost html]# ls
 doudizhu.zip                      index.html               nie
'HTML5 canvas移动端斗地主小游戏'   jQuery抓娃娃机游戏代码   zhuawawaji.zip
[root@localhost html]# 
[root@localhost html]# rm -rf doudizhu.zip zhuawawaji.zip
[root@localhost html]# ls
'HTML5 canvas移动端斗地主小游戏'   index.html   jQuery抓娃娃机游戏代码   nie
[root@localhost html]# mkdir doudizhu zhuawawaji
[root@localhost html]# mv 'HTML5 canvas移动端斗地主小游戏'/* doudizhu/
[root@localhost html]# mv jQuery抓娃娃机游戏代码/* zhuawawaji/
[root@localhost html]# ls
 doudizhu                          index.html               nie
'HTML5 canvas移动端斗地主小游戏'   jQuery抓娃娃机游戏代码   zhuawawaji
[root@localhost html]# rm -rf 'HTML5 canvas移动端斗地主小游戏' jQuery抓娃娃机游 戏代码
[root@localhost html]# ls
doudizhu  index.html  nie  zhuawawaji
[root@localhost html]# cd doudizhu/
[root@localhost doudizhu]# ls
DJDDZ.js  img  index.html  JControls.js  Prototype.js  ResourceData.js
[root@localhost html]# cd zhuawawaji/
[root@localhost zhuawawaji]# ls
images  img  index.html  js
[root@localhost zhuawawaji]# 
[root@localhost conf.d]# vi httpd-vhosts.conf
<VirtualHost 192.168.10.145:80>
    DocumentRoot "/var/www/html/zhuawawaji"
    ServerName www.zhuawawaji.com
    ErrorLog "/var/log/httpd/www.zhuawawaji.com-error_log"
    CustomLog "/var/log/httpd/www.zhuawawaji.com-access_log" common
</VirtualHost>
listen 81
<VirtualHost 192.168.10.145:81>
    DocumentRoot "/var/www/html/doudizhu"
    ServerName www.doudizhu.com
    ErrorLog "/var/log/httpd/www.doudizhu.com-error_log"
    CustomLog "/var/log/httpd/www.doudizhu.com-access_log" common
</VirtualHost>
[root@localhost ~]# httpd -t
Syntax OK
[root@localhost ~]# 
[root@localhost ~]# systemctl stop firewalld
[root@localhost ~]# systemctl disable firewalld
Removed /etc/systemd/system/multi-user.target.wants/firewalld.service.
Removed /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.
[root@localhost ~]# systemctl restart httpd
[root@localhost ~]#

image

image

配置不同ip相同端口

[root@localhost ~]# ip addr add 192.168.10.146/24 dev ens33
[root@localhost ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:0c:29:07:19:47 brd ff:ff:ff:ff:ff:ff
    inet 192.168.10.145/24 brd 192.168.10.255 scope global dynamic noprefixroute ens33
       valid_lft 1678sec preferred_lft 1678sec
    inet 192.168.10.146/24 scope global secondary ens33
       valid_lft forever preferred_lft forever
    inet6 fe80::20c:29ff:fe07:1947/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
[root@localhost ~]# cd /etc/httpd/conf.d/
[root@localhost conf.d]# vi httpd-vhosts.conf
<VirtualHost 192.168.10.145:80>
    DocumentRoot "/var/www/html/zhuawawaji"
    ServerName www.zhuawawaji.com
    ErrorLog "/var/log/httpd/www.zhuawawaji.com-error_log"
    CustomLog "/var/log/httpd/www.zhuawawaji.com-access_log" common
</VirtualHost>


<VirtualHost 192.168.10.146:80>
    DocumentRoot "/var/www/html/doudizhu"
    ServerName www.doudizhu.com
    ErrorLog "/var/log/httpd/www.doudizhu.com-error_log"
    CustomLog "/var/log/httpd/www.doudizhu.com-access_log" common
</VirtualHost>
[root@localhost conf.d]# httpd -t
Syntax OK
[root@localhost conf.d]# 
[root@localhost conf.d]# systemctl restart httpd

image

image

配置相同ip相同端口不同域名

以记事本方式打开hosts文件

image

image

image

[root@localhost conf.d]# dnf -y install bind-utils
[root@localhost conf.d]# vi httpd-vhosts.conf 
<VirtualHost 192.168.10.145:80>
    DocumentRoot "/var/www/html/zhuawawaji"
    ServerName www.zhuawawaji.com
    ErrorLog "/var/log/httpd/www.zhuawawaji.com-error_log"
    CustomLog "/var/log/httpd/www.zhuawawaji.com-access_log" common
</VirtualHost>


<VirtualHost 192.168.10.145:80>
    DocumentRoot "/var/www/html/doudizhu"
    ServerName www.doudizhu.com
    ErrorLog "/var/log/httpd/www.doudizhu.com-error_log"
    CustomLog "/var/log/httpd/www.doudizhu.com-access_log" common
</VirtualHost>
[root@localhost conf.d]# httpd -t
Syntax OK
[root@localhost conf.d]# systemctl restart httpd
[root@localhost conf.d]#

image

image

添加访问权限

[root@localhost conf.d]# vi httpd-vhosts.conf 
[root@localhost conf.d]# 
<Directory /var/www/html/zhuawawaji>
    <RequireAll>
        Require not ip 192.168.10.1
        Require all granted
    </RequireAll>
</Directory>
[root@localhost conf.d]# httpd -t
Syntax OK
[root@localhost conf.d]# systemctl restart httpd
[root@localhost conf.d]#

image

7安装https

安装ssl安全模块

[root@localhost ~]# dnf -y install mod_ssl
Installed:
  mod_ssl-1:2.4.37-43.module_el8.5.0+1022+b541f3b1.x86_64                       
  sscg-2.3.3-14.el8.x86_64                                                      

Complete!

[root@localhost ~]# systemctl restart httpd
[root@localhost ~]# httpd -M | grep ssl
 ssl_module (shared)
[root@localhost ~]#

ca生成一对密钥

[root@localhost ~]# systemctl restart httpd
[root@localhost ~]# httpd -M | grep ssl
 ssl_module (shared)
[root@localhost ~]# cd /etc/pki
[root@localhost pki]# ls
ca-trust  java  rpm-gpg  rsyslog  tls
[root@localhost pki]# mkdir ca
[root@localhost pki]# cd ca
[root@localhost ca]# pwd
/etc/pki/ca
[root@localhost ca]# mkdir private
[root@localhost ca]# (umask 077;openssl genrsa -out private/cakey.pem 2048)
Generating RSA private key, 2048 bit long modulus (2 primes)
...........+++++
...+++++
e is 65537 (0x010001)
[root@localhost ca]# openssl rsa -in private/cakey.pem -pubout
writing RSA key
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1zFDyXdaABzbLIKtyN8v
3FN2k9ZW/sXcJECbJa2BI36Ioy6HTFUKZsu9UCh4uANlobDKzthguMLy70MKq46N
RzevJdRuuuNwrb7Qcg9DqfR2fPJah4n4bQAbGIWCu7uF8VvVTXxIOXHCA+P60pib
3abl9gvHjLuwiRQIzyGY6Ycpqzy3WkJWZnb5iKyuk9qMr2TzOItFEQMl277W+bQY
geVxPoSV2ChLuADqpCskCfN9PigbGMbTnVVVrSwnMQ95GprUf4TtoCThDIXYZTCh
FZa7CyS+5ON8Xu9fs2OPiNl337RN+r7d7TbI6yDfoKSLWWuA104D39+RkoKjlCni
vwIDAQAB
-----END PUBLIC KEY-----

ca生成自签署证书

[root@localhost ca]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:vn
State or Province Name (full name) []:hb
Locality Name (eg, city) [Default City]:wh
Organization Name (eg, company) [Default Company Ltd]:runtime
Organizational Unit Name (eg, section) []:peixun
Common Name (eg, your name or your server's hostname) []:www.doudizhu.com
Email Address []:1@2.com
[root@localhost ca]# 
[root@localhost ca]#  mkdir certs newcerts crl
[root@localhost ca]# touch index.txt && echo 01 > serial
[root@localhost ca]# ls
cacert.pem  certs  crl  index.txt  newcerts  private  serial
[root@localhost ca]# cat serial
01
[root@localhost ca]#

客户端生成密钥

[root@localhost ca]# cd /etc/httpd && mkdir ssl && cd ssl
[root@localhost ssl]# pwd
/etc/httpd/ssl
[root@localhost ssl]# (umask 077;openssl genrsa -out httpd.key 2048)
Generating RSA private key, 2048 bit long modulus (2 primes)
.+++++
......................................+++++
e is 65537 (0x010001)
[root@localhost ssl]# 
[root@localhost ssl]# ls
httpd.key

客户端生成证书签署请求

[root@localhost ssl]# openssl req -new -key httpd.key -days 365 -out httpd.csr 
Ignoring -days; not generating a certificate
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:hb
Locality Name (eg, city) [Default City]:wh
Organization Name (eg, company) [Default Company Ltd]:runtime
Organizational Unit Name (eg, section) []:peixun
Common Name (eg, your name or your server's hostname) []:www.doudizhu.com
Email Address []:1@2.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []
[root@localhost ssl]# 
[root@localhost ssl]#

ca客户端提交证书

[root@localhost ssl]# openssl ca -in ./httpd.csr -out httpd.crt -days 365
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Jul 23 08:37:51 2022 GMT
            Not After : Jul 23 08:37:51 2023 GMT
        Subject:
            countryName               = cn
            stateOrProvinceName       = hb
            organizationName          = runtime
            organizationalUnitName    = peixun
            commonName                = www.duodizhu.com
            emailAddress              = 1@2.com
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
                27:23:14:CB:51:6C:E0:8E:D8:8C:B1:D2:EF:BB:62:1F:EB:A1:97:E5
            X509v3 Authority Key Identifier: 
                keyid:C8:13:CA:71:2C:58:9B:16:6B:84:4F:71:41:9C:FA:B9:19:49:25:76

Certificate is to be certified until Jul 23 08:37:51 2023 GMT (365 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
[root@localhost ssl]# ls
httpd.crt  httpd.csr  httpd.key

修改ssl.cof配置文件

[root@localhost ssl]# pwd
/etc/httpd/ssl
[root@localhost ssl]# cd /etc/httpd/conf.d/
[root@localhost conf.d]# ls
autoindex.conf  httpd-vhosts.conf  README  ssl.conf  userdir.conf  welcome.conf
[root@localhost conf.d]# vim ssl.conf 	

<VirtualHost _default_:443>

# General setup for the virtual host, inherited from global configuration
DocumentRoot "/var/www/html/zhuawawaji"		
ServerName www.zhuawawaji.com:443

SSLCertificateFile /etc/httpd/ssl/httpd.crt		//修改位置
SSLCertificateKeyFile /etc/httpd/ssl/httpd.key	//修改位置
[root@localhost conf.d]# httpd -t
Syntax OK
[root@localhost conf.d]# systemctl restart httpd
[root@localhost conf.d]# ss -anlt | grep 443
LISTEN 0      128                *:443             *:*

image

image

标签：httpd,apr,root,编译,html,conf,安装,localhost
来源： https://www.cnblogs.com/nie123/p/16514978.html