阿里云申请免费SSL证书并对Apache进行HTTPS配置

你的名字 2023-07-24 03:09 58阅读 0赞

# 在阿里云页面申请云顿证书 #

###### 1.在阿里云页面搜索 “云顿证书”，并点击 “云盾证书服务包年” ######

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L29uZTMxMg_size_16_color_FFFFFF_t_70]

###### 2.点击 弹出窗口最底部的 “云顿证书服务包年购买页” 即可进入申请证书页面 ######

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L29uZTMxMg_size_16_color_FFFFFF_t_70 1]

###### 3.选择 “免费(个人)DV” 类型，购买数量根据需要填写，每个阿里云账号最多 签发20个。免费版 每个 二级域名 和 每个 一级域名 都只能分别单独使用一个证书。 ######

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L29uZTMxMg_size_16_color_FFFFFF_t_70 2]

###### 4.支付成功后 点击 “证书控制台” ######

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L29uZTMxMg_size_16_color_FFFFFF_t_70 3]

###### 5.点击证书后面的 “证书申请”，并填写信息，域名必须跟要使用的域名一致，邮箱手机号 也必须 是有效的，如果是 阿里云购买的域名，则可以选择 自动DNS验证，CSR选择系统自动生成审核速度快。 ######

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L29uZTMxMg_size_16_color_FFFFFF_t_70 4]

###### 6.未申请和申请后的证书列表如下 ######

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L29uZTMxMg_size_16_color_FFFFFF_t_70 5]

###### 7.下载申请通过的证书 ######

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L29uZTMxMg_size_16_color_FFFFFF_t_70 6]

###### 8.选择下载 Apache 服务器对应的证书，解压得到如下3个文件 ######

*  3734130\_blog.qinqinxia.com.key
 *  3734130\_blog.qinqinxia.com\_chain.crt
 *  3734130\_blog.qinqinxia.com\_public.crt

###### 9.以上3个文件上传到服务器如下位置，也可以是其他目录（/etc/httpd/conf.d/ssl.conf文件中配置需要与之对应） ######

SSLCertificateFile /etc/pki/tls/certs/3734130_blog.qinqinxia.com_chain.crt
    SSLCertificateKeyFile /etc/pki/tls/private/3734130_blog.qinqinxia.com.key
    SSLCertificateChainFile /etc/pki/tls/certs/3734130_blog.qinqinxia.com_public.crt

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L29uZTMxMg_size_16_color_FFFFFF_t_70 7]

# Apache配置 HTTPS #

*  您也可以参照这里：https : // www . cnblogs . com /jungejava/p/11200631.html

##### 1.Apache 安装 mod\_ssl.so 模块 yum -y install mod\_ssl #####

[root@izhp3flliiu1wistk24f3cz modules]# yum -y install mod_ssl
    Loaded plugins: fastestmirror
    base                                                                                                                            | 3.6 kB  00:00:00     
    epel                                                                                                                            | 4.7 kB  00:00:00     
    extras                                                                                                                          | 2.9 kB  00:00:00     
    updates                                                                                                                         | 2.9 kB  00:00:00     
    (1/5): epel/x86_64/group_gz                                                                                                     |  95 kB  00:00:00     
    (2/5): epel/x86_64/updateinfo                                                                                                   | 1.0 MB  00:00:00     
    (3/5): updates/7/x86_64/primary_db                                                                                              | 7.6 MB  00:00:00     
    (4/5): extras/7/x86_64/primary_db                                                                                               | 165 kB  00:00:00     
    (5/5): epel/x86_64/primary_db                                                                                                   | 6.8 MB  00:00:00     
    Determining fastest mirrors
    Resolving Dependencies
    --> Running transaction check
    ---> Package mod_ssl.x86_64 1:2.4.6-90.el7.centos will be installed
    --> Processing Dependency: httpd = 2.4.6-90.el7.centos for package: 1:mod_ssl-2.4.6-90.el7.centos.x86_64
    --> Running transaction check
    ---> Package httpd.x86_64 0:2.4.6-80.el7.centos will be updated
    ---> Package httpd.x86_64 0:2.4.6-90.el7.centos will be an update
    --> Processing Dependency: httpd-tools = 2.4.6-90.el7.centos for package: httpd-2.4.6-90.el7.centos.x86_64
    --> Running transaction check
    ---> Package httpd-tools.x86_64 0:2.4.6-80.el7.centos will be updated
    ---> Package httpd-tools.x86_64 0:2.4.6-90.el7.centos will be an update
    --> Finished Dependency Resolution
    
    Dependencies Resolved
    
    =======================================================================================================================================================
     Package                             Arch                           Version                                         Repository                    Size
    =======================================================================================================================================================
    Installing:
     mod_ssl                             x86_64                         1:2.4.6-90.el7.centos                           base                         112 k
    Updating for dependencies:
     httpd                               x86_64                         2.4.6-90.el7.centos                             base                         2.7 M
     httpd-tools                         x86_64                         2.4.6-90.el7.centos                             base                          91 k
    
    Transaction Summary
    =======================================================================================================================================================
    Install  1 Package
    Upgrade             ( 2 Dependent packages)
    
    Total download size: 2.9 M
    Downloading packages:
    Delta RPMs disabled because /usr/bin/applydeltarpm not installed.
    (1/3): httpd-tools-2.4.6-90.el7.centos.x86_64.rpm                                                                               |  91 kB  00:00:00     
    (2/3): httpd-2.4.6-90.el7.centos.x86_64.rpm                                                                                     | 2.7 MB  00:00:00     
    (3/3): mod_ssl-2.4.6-90.el7.centos.x86_64.rpm                                                                                   | 112 kB  00:00:00     
    -------------------------------------------------------------------------------------------------------------------------------------------------------
    Total                                                                                                                  5.3 MB/s | 2.9 MB  00:00:00     
    Running transaction check
    Running transaction test
    Transaction test succeeded
    Running transaction
      Updating   : httpd-tools-2.4.6-90.el7.centos.x86_64                                                                                              1/5 
      Updating   : httpd-2.4.6-90.el7.centos.x86_64                                                                                                    2/5 
      Installing : 1:mod_ssl-2.4.6-90.el7.centos.x86_64                                                                                                3/5 
      Cleanup    : httpd-2.4.6-80.el7.centos.x86_64                                                                                                    4/5 
      Cleanup    : httpd-tools-2.4.6-80.el7.centos.x86_64                                                                                              5/5 
      Verifying  : httpd-tools-2.4.6-90.el7.centos.x86_64                                                                                              1/5 
      Verifying  : httpd-2.4.6-90.el7.centos.x86_64                                                                                                    2/5 
      Verifying  : 1:mod_ssl-2.4.6-90.el7.centos.x86_64                                                                                                3/5 
      Verifying  : httpd-tools-2.4.6-80.el7.centos.x86_64                                                                                              4/5 
      Verifying  : httpd-2.4.6-80.el7.centos.x86_64                                                                                                    5/5 
    
    Installed:
      mod_ssl.x86_64 1:2.4.6-90.el7.centos                                                                                                                 
    
    Dependency Updated:
      httpd.x86_64 0:2.4.6-90.el7.centos                                      httpd-tools.x86_64 0:2.4.6-90.el7.centos                                     
    
    Complete!
    [root@izhp3flliiu1wistk24f3cz modules]#

*  2.安装完成 后可以在 /etc/httpd/modules 目录下找到 mod\_ssl.so 文件

[root@izhp3flliiu1wistk24f3cz modules]# pwd
    /etc/httpd/modules
    [root@izhp3flliiu1wistk24f3cz modules]# ls
    libphp5.so            mod_authn_core.so       mod_authz_host.so     mod_cgi.so           mod_dir.so         mod_heartbeat.so            mod_log_debug.so     mod_mpm_worker.so      mod_proxy_http.so      mod_rewrite.so           mod_ssl.so         mod_version.so
    mod_access_compat.so  mod_authn_dbd.so        mod_authz_owner.so    mod_charset_lite.so  mod_dumpio.so      mod_heartmonitor.so         mod_log_forensic.so  mod_negotiation.so     mod_proxy_scgi.so      mod_sed.so               mod_status.so      mod_vhost_alias.so
    mod_actions.so        mod_authn_dbm.so        mod_authz_user.so     mod_data.so          mod_echo.so        mod_include.so              mod_logio.so         mod_proxy_ajp.so       mod_proxy.so           mod_setenvif.so          mod_substitute.so  mod_watchdog.so
    mod_alias.so          mod_authn_file.so       mod_autoindex.so      mod_dav_fs.so        mod_env.so         mod_info.so                 mod_lua.so           mod_proxy_balancer.so  mod_proxy_wstunnel.so  mod_slotmem_plain.so     mod_suexec.so
    mod_allowmethods.so   mod_authn_socache.so    mod_buffer.so         mod_dav_lock.so      mod_expires.so     mod_lbmethod_bybusyness.so  mod_macro.so         mod_proxy_connect.so   mod_ratelimit.so       mod_slotmem_shm.so       mod_systemd.so
    mod_asis.so           mod_authz_core.so       mod_cache_disk.so     mod_dav.so           mod_ext_filter.so  mod_lbmethod_byrequests.so  mod_mime_magic.so    mod_proxy_express.so   mod_reflector.so       mod_socache_dbm.so       mod_unique_id.so
    mod_auth_basic.so     mod_authz_dbd.so        mod_cache.so          mod_dbd.so           mod_file_cache.so  mod_lbmethod_bytraffic.so   mod_mime.so          mod_proxy_fcgi.so      mod_remoteip.so        mod_socache_memcache.so  mod_unixd.so
    mod_auth_digest.so    mod_authz_dbm.so        mod_cache_socache.so  mod_deflate.so       mod_filter.so      mod_lbmethod_heartbeat.so   mod_mpm_event.so     mod_proxy_fdpass.so    mod_reqtimeout.so      mod_socache_shmcb.so     mod_userdir.so
    mod_authn_anon.so     mod_authz_groupfile.so  mod_cgid.so           mod_dialup.so        mod_headers.so     mod_log_config.so           mod_mpm_prefork.so   mod_proxy_ftp.so       mod_request.so         mod_speling.so           mod_usertrack.so
    [root@izhp3flliiu1wistk24f3cz modules]#

##### 2. 命令执行结束安装完成后 /etc/httpd/conf.d 目录下会出现一个ssl.conf文件 #####

[root@izhp3flliiu1wistk24f3cz modules]# ls /etc/httpd/conf.d
    autoindex.conf  php.conf  README  ssl.conf  userdir.conf  welcome.conf
    [root@izhp3flliiu1wistk24f3cz modules]#

##### 3.在这个文件里面找到如下内容 #####

SSLCertificateFile xxx_public.crt
    SSLCertificateKeyFile xxx.key
    SSLCertificateChainFile xxx_chain.crt

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L29uZTMxMg_size_16_color_FFFFFF_t_70 8]

##### 4.修改这三项配置如下 #####

SSLCertificateFile /etc/pki/tls/certs/3734130_blog.qinqinxia.com_public.crt
    SSLCertificateKeyFile /etc/pki/tls/private/3734130_blog.qinqinxia.com.key
    SSLCertificateChainFile /etc/pki/tls/certs/3734130_blog.qinqinxia.com_chain.crt

##### 5.然后继续在此文件中配置找到以下内容配置443站点信息 #####

*  按照内容直接改就可以

# 子站点配置
    ServerName blog.qinqinxia.com #域名
    DocumentRoot "/www/wwwroot/blog_online/www/" #项目的路径
    DirectoryIndex index.php index.html index.htm
    # 项目目录权限配置
    <Directory "/www/wwwroot/www">
    	Options +Includes -Indexes
    	AllowOverride All
    	Order Deny,Allow
    	Allow from All
    </Directory>

*  2.然后这个文件就编辑完了。
 *  3.然后找到/etc/httpd/conf/httpd.conf 文件并打开，找到\#LoadModule ssl\_module modules/mod\_ssl.so 并将前面的\#号去掉， 或者 该配置在 /etc/httpd/conf/conf.modules.d/00-ssl.conf 文件中
 *  4.在/etc/httpd/conf/httpd.conf文件的最后引入之前配置好的文件。例如：

#引入外部的ssl配置文件
    Include /etc/httpd/conf.d/ssl.conf

*  5.至此，配置完成，重启Apache然后访问你的域名即可

systemctl restart httpd

##### 6.如果启动Apache失败 #####

则将 ssl.conf 文件备份一下，然后替换内容为如下纯净版的，其中配置换成与你对应的，然后重启apahce

Listen 443
    <VirtualHost *:443>
    	SSLEngine on
    	SSLProtocol all -SSLv2 -SSLv3
    	SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
    	
    	SSLCertificateFile /etc/pki/tls/certs/3734130_blog.qinqinxia.com_public.crt
    	SSLCertificateKeyFile /etc/pki/tls/private/3734130_blog.qinqinxia.com.key
    	SSLCertificateChainFile /etc/pki/tls/certs/3734130_blog.qinqinxia.com_chain.crt
     
    	# 子站点配置
    	ServerName blog.qinqinxia.com
    	DocumentRoot "/www/wwwroot/blog_online/www/"
    	DirectoryIndex index.php index.html index.htm
    
    	<Directory /www/wwwroot/blog_online/www/>
    		Options +Indexes +FollowSymLinks +ExecCGI
    		AllowOverride All
    		Order allow,deny
    		Allow from all
    		Require all granted
    	</Directory>
    </VirtualHost>

##### 7.测试，用浏览器以https方式访问站点：https://blog.qinqinxia.com/，如下图，访问正常 #####

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L29uZTMxMg_size_16_color_FFFFFF_t_70 9]

##### 8.如果需要将 http://blog.qinqinxia.com 转发到 https://blog.qinqinxia.com 则在http.conf文件中增加如下配置并重启apche即可： #####

<VirtualHost *:80>
            ServerName blog.qinqinxia.com
            Redirect permanent / https://blog.qinqinxia.com/
            DocumentRoot "/www/wwwroot/blog/www/"
            DirectoryIndex index.php index.html index.htm
    		<Directory "/www/wwwroot/blog/www/">
    	        Options +Includes -Indexes
    	        AllowOverride All
    	        Order Deny,Allow
    	        Allow from All
    		</Directory>
    </VirtualHost>

##### 9.测试访问80端口重定向到443端口，浏览器访问 http://blog.qinqinxia.com，如果浏览器地址会自动换成 https://blog.qinqinxia.com 表示 配置成功. #####

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L29uZTMxMg_size_16_color_FFFFFF_t_70]: /images/20230528/9bfb16f87f604e0f94ccd4fcfc9c30c4.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L29uZTMxMg_size_16_color_FFFFFF_t_70 1]: /images/20230528/4326beafa0214cb5a1a939d6dbcb98fe.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L29uZTMxMg_size_16_color_FFFFFF_t_70 2]: /images/20230528/49cbf4c7fdfb4b0cbb58ed7897503d9a.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L29uZTMxMg_size_16_color_FFFFFF_t_70 3]: /images/20230528/22f2ffd3576a4a52a8bac37890fc7673.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L29uZTMxMg_size_16_color_FFFFFF_t_70 4]: /images/20230528/784d53dccfc94bf99b1aff1ee57f6c5d.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L29uZTMxMg_size_16_color_FFFFFF_t_70 5]: /images/20230528/dbc75284e8b04e82977ebc8a06671440.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L29uZTMxMg_size_16_color_FFFFFF_t_70 6]: /images/20230528/6ef40494e448422f9f4274a053bccea8.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L29uZTMxMg_size_16_color_FFFFFF_t_70 7]: /images/20230528/fb94c6f3e4cf47ae8ad49f16af97f44a.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L29uZTMxMg_size_16_color_FFFFFF_t_70 8]: /images/20230528/db337bace8744282848b3da7f56060fc.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L29uZTMxMg_size_16_color_FFFFFF_t_70 9]: /images/20230528/65d20bd32f52478c9cedb5c496d34f15.png