httpd

1. httpd简介

httpd是Apache超文本传输协议(HTTP)服务器的主程序。被设计为一个独立运行的后台进程,它会建立一个处理请求的子进程或线程的池。

通常,httpd不应该被直接调用,而应该在类Unix系统中由apachectl调用,在Windows中作为服务运行。

2. httpd版本

本文主要介绍httpd的两大版本,httpd-2.2和httpd-2.4。

  • CentOS6系列的版本默认提供的是httpd-2.2版本的rpm包
  • CentOS7系列的版本默认提供的是httpd-2.4版本的rpm包

2.1 httpd的特性

httpd有很多特性,下面就分别来说说httpd-2.2版本和httpd-2.4版本各自的特性。

2.2 httpd-2.4新增的模块

httpd-2.4在之前的版本基础上新增了几大模块,下面就几个常用的来介绍一下。

3. httpd基础

3.1 httpd自带的工具程序

3.2 rpm包安装的httpd程序环境

mpm:以DSO机制提供,配置文件为/etc/httpd/conf.modules.d/00-mpm.conf

3.3 web相关的命令

3.3.1 curl命令

curl是基于URL语法在命令行方式下工作的文件传输工具,它支持FTP,FTPS,HTTP,HTTPS,GOPHER,TELNET,DICT,FILE及LDAP等协议。

curl支持以下功能:

  • https认证
  • http的POST/PUT等方法
  • ftp上传
  • kerberos认证
  • http上传
  • 代理服务器
  • cookies
  • 用户名/密码认证
  • 下载文件断点续传
  • socks5代理服务器
  • 通过http代理服务器上传文件到ftp服务器
//语法:curl [options] [URL ...]
//常用的options:
    -A/--user-agent <string>    //设置用户代理发送给服务器
    -basic              //使用Http基本认证
    --tcp-nodelay       //使用TCP_NODELAY选项
    -e/--referer <URL>      //来源网址
    --cacert <file>     //CA证书(SSL)
    --compressed        //要求返回时压缩的格式
    -H/--header <line>  //自定义请求首部信息传递给服务器
    -I/--head           //只显示响应报文首部信息
    --limit-rate <rate>     //设置传输速度
    -u/--user <user[:password]>     //设置服务器的用户和密码
    -0/--http1      //使用http 1.0版本,默认使用1.1版本。这个选项是数字0而不是字母o
    -o/--output     //把输出写到文件中
    -#/--progress-bar       //进度条显示当前的传送状态
    
//通过curl下载文件
[root@localhost ~]# ls
[root@localhost ~]# curl -o myblog.html http://blog.51cto.com/itchentao
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 67025    0 67025    0     0  87248      0 --:--:-- --:--:-- --:--:-- 87385
[root@localhost ~]# ls
myblog.html

3.3.2 httpd命令

//语法:httpd [options]
//常用的options:
    -l      //查看静态编译的模块,列出核心中编译了哪些模块。 \
            //它不会列出使用LoadModule指令动态加载的模块
    -M      //输出一个已经启用的模块列表,包括静态编译在服务 \
            //器中的模块和作为DSO动态加载的模块
    -v      //显示httpd的版本,然后退出
    -V      //显示httpd和apr/apr-util的版本和编译参数,然后退出
    -X      //以调试模式运行httpd。仅启动一个工作进程,并且 \
            //服务器不与控制台脱离
    -t      //检查配置文件是否有语法错误
            
[root@localhost ~]# httpd -l
Compiled in modules:
  core.c
  mod_so.c
  http_core.c
  
[root@localhost ~]# httpd -M
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using localhost.localdomain. Set the 'ServerName' directive globally to suppress this message
Loaded Modules:
 core_module (static)
 so_module (static)
 http_module (static)
 access_compat_module (shared)
 actions_module (shared)
 alias_module (shared)
 allowmethods_module (shared)
 auth_basic_module (shared) 
 ......
 ......
 
[root@localhost ~]# httpd -v
Server version: Apache/2.4.6 (CentOS)
Server built:   Jun 27 2018 13:48:59

[root@localhost ~]# httpd -V
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using localhost.localdomain. Set the 'ServerName' directive globally to suppress this message
Server version: Apache/2.4.6 (CentOS)
Server built:   Jun 27 2018 13:48:59
Server's Module Magic Number: 20120211:24
Server loaded:  APR 1.4.8, APR-UTIL 1.5.2
Compiled using: APR 1.4.8, APR-UTIL 1.5.2
Architecture:   64-bit
Server MPM:     prefork
  threaded:     no
    forked:     yes (variable process count)
Server compiled with....
 -D APR_HAS_SENDFILE
 -D APR_HAS_MMAP
 -D APR_HAVE_IPV6 (IPv4-mapped addresses enabled)
 -D APR_USE_SYSVSEM_SERIALIZE
 -D APR_USE_PTHREAD_SERIALIZE
 -D SINGLE_LISTEN_UNSERIALIZED_ACCEPT
 -D APR_HAS_OTHER_CHILD
 -D AP_HAVE_RELIABLE_PIPED_LOGS
 -D DYNAMIC_MODULE_LIMIT=256
 -D HTTPD_ROOT="/etc/httpd"
 -D SUEXEC_BIN="/usr/sbin/suexec"
 -D DEFAULT_PIDLOG="/run/httpd/httpd.pid"
 -D DEFAULT_SCOREBOARD="logs/apache_runtime_status"
 -D DEFAULT_ERRORLOG="logs/error_log"
 -D AP_TYPES_CONFIG_FILE="conf/mime.types"
 -D SERVER_CONFIG_FILE="conf/httpd.conf"

4. 编译安装httpd-2.4

httpd依赖于apr-1.4+,apr-util-1.4+,[apr-icon]

apr:apache portable runtime

//安装开发环境
[root@localhost ~]# yum groupinstall "Development Tools"
Loaded plugins: product-id, search-disabled-repos, subscription-manager
This system is not registered with an entitlement server. You can use subscription-manager to register.
There is no installed groups file.
Maybe run: yum groups mark convert (see man yum)
Resolving Dependencies
--> Running transaction check
---> Package autoconf.noarch 0:2.69-11.el7 will be installed
--> Processing Dependency: m4 >= 1.4.14 for package: autoconf-2.69-11.el7.noarch
--> Processing Dependency: perl(Data::Dumper) for package: autoconf-2.69-11.el7.noarch
---> Package automake.noarch 0:1.13.4-3.el7 will be installed
--> Processing Dependency: perl(Thread::Queue) for package: automake-1.13.4-3.el7.noarch 
......
......
Dependency Updated:
  elfutils-libelf.x86_64 0:0.170-4.el7             elfutils-libs.x86_64 0:0.170-4.el7
  glibc.x86_64 0:2.17-222.el7                      glibc-common.x86_64 0:2.17-222.el7
  libgcc.x86_64 0:4.8.5-28.el7_5.1                 libgomp.x86_64 0:4.8.5-28.el7_5.1
  libstdc++.x86_64 0:4.8.5-28.el7_5.1              rpm.x86_64 0:4.11.3-32.el7
  rpm-build-libs.x86_64 0:4.11.3-32.el7            rpm-libs.x86_64 0:4.11.3-32.el7
  rpm-python.x86_64 0:4.11.3-32.el7

Complete!

[root@localhost ~]# groupadd -r apache
[root@localhost ~]# useradd -r -g apache apache
[root@localhost ~]# yum -y install openssl-devel pcre-devel expat-devel libtool
Loaded plugins: product-id, search-disabled-repos, subscription-manager
This system is not registered with an entitlement server. You can use subscription-manager to register.
Resolving Dependencies
--> Running transaction check
---> Package openssl-devel.x86_64 1:1.0.2k-12.el7 will be installed
--> Processing Dependency: openssl-libs(x86-64) = 1:1.0.2k-12.el7 for package: 1:openssl-devel-1.0.2k-12.el7.x86_64 
......
......
  libselinux-utils.x86_64 0:2.5-12.el7          libsepol.x86_64 0:2.5-8.1.el7
  libss.x86_64 0:1.42.9-12.el7_5                openssl.x86_64 1:1.0.2k-12.el7
  openssl-libs.x86_64 1:1.0.2k-12.el7

Complete!


//下载并安装apr-1.4+和apr-util-1.4+
[root@localhost ~]# cd /usr/src/
[root@localhost src]# wget http://mirrors.shu.edu.cn/apache//apr/apr-1.6.5.tar.bz2
--2018-08-04 18:42:17--  http://mirrors.shu.edu.cn/apache//apr/apr-1.6.5.tar.bz2
Resolving mirrors.shu.edu.cn (mirrors.shu.edu.cn)... 202.121.199.235
Connecting to mirrors.shu.edu.cn (mirrors.shu.edu.cn)|202.121.199.235|:80... connected.
HTTP request sent, awaiting response... 302 Found
Location: http://172.16.24.182/mirrors.shu.edu.cn/apache//apr/apr-1.6.5.tar.bz2 [following]
--2018-08-04 18:42:17--  http://172.16.24.182/mirrors.shu.edu.cn/apache//apr/apr-1.6.5.tar.bz2
Connecting to 172.16.24.182:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 854100 (834K) [application/x-bzip2]
Saving to: ‘apr-1.6.3.tar.bz2’

100%[======================================================>] 854,100     1.67MB/s   in 0.5s

2018-08-04 18:42:18 (1.67 MB/s) - ‘apr-1.6.5.tar.bz2’ saved [854100/854100]

[root@localhost src]# wget http://mirrors.shu.edu.cn/apache//apr/apr-util-1.6.1.tar.bz2
--2018-08-04 18:43:13--  http://mirrors.shu.edu.cn/apache//apr/apr-util-1.6.1.tar.bz2
Resolving mirrors.shu.edu.cn (mirrors.shu.edu.cn)... 202.121.199.235
Connecting to mirrors.shu.edu.cn (mirrors.shu.edu.cn)|202.121.199.235|:80... connected.
HTTP request sent, awaiting response... 302 Found
Location: http://172.16.24.175/mirrors.shu.edu.cn/apache//apr/apr-util-1.6.1.tar.bz2 [following]
--2018-08-04 18:43:13--  http://172.16.24.175/mirrors.shu.edu.cn/apache//apr/apr-util-1.6.1.tar.bz2
Connecting to 172.16.24.175:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 428595 (419K) [application/x-bzip2]
Saving to: ‘apr-util-1.6.1.tar.bz2’

100%[======================================================>] 428,595     1.14MB/s   in 0.4s

2018-08-04 18:43:14 (1.14 MB/s) - ‘apr-util-1.6.1.tar.bz2’ saved [428595/428595]

[root@localhost src]# ls
apr-1.6.5.tar.bz2  apr-util-1.6.1.tar.bz2  debug  kernels
[root@localhost src]# tar xf apr-1.6.5.tar.bz2
[root@localhost src]# tar xf apr-util-1.6.1.tar.bz2
[root@localhost src]# ls
apr-1.6.5  apr-1.6.5.tar.bz2  apr-util-1.6.1  apr-util-1.6.1.tar.bz2  debug  kernels
[root@localhost src]# cd apr-1.6.5
[root@localhost apr-1.6.5]# vim configure
    cfgfile="${ofile}T"
    trap "$RM \"$cfgfile\"; exit 1" 1 2 15
    # $RM "$cfgfile"        //将此行加上注释,或者删除此行

[root@localhost apr-1.6.5]# ./configure --prefix=/usr/local/apr
配置过程略...
[root@localhost apr-1.6.5]# make && make install
编译安装过程略...

[root@localhost apr-1.6.5]# cd /usr/src/apr-util-1.6.1
[root@localhost apr-util-1.6.1]# ./configure --prefix=/usr/local/apr-util --with-apr=/usr/local/apr
配置过程略...
[root@localhost apr-util-1.6.1]# make && make install
编译安装过程略...

//编译安装httpd
[root@localhost ~]# wget http://mirror.bit.edu.cn/apache//httpd/httpd-2.4.37.tar.bz2
--2018-08-04 18:30:46--  http://mirror.bit.edu.cn/apache//httpd/httpd-2.4.37.tar.bz2
Resolving mirror.bit.edu.cn (mirror.bit.edu.cn)... 114.247.56.117, 2001:da8:204:2001:250:56ff:fea1:22
Connecting to mirror.bit.edu.cn (mirror.bit.edu.cn)|114.247.56.117|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 6942969 (6.6M) [application/octet-stream]
Saving to: ‘httpd-2.4.37.tar.bz2’

100%[======================================================>] 6,942,969    591KB/s   in 19s

2018-08-04 18:31:05 (353 KB/s) - ‘httpd-2.4.37.tar.bz2’ saved [6942969/6942969]


[root@localhost ~]# ls
httpd-2.4.37.tar.bz2
[root@localhost ~]# tar xf httpd-2.4.37.tar.bz2
[root@localhost ~]# cd httpd-2.4.37
[root@localhost httpd-2.4.37]# ./configure --prefix=/usr/local/apache \
--sysconfdir=/etc/httpd24 \
--enable-so \
--enable-ssl \
--enable-cgi \
--enable-rewrite \
--with-zlib \
--with-pcre \
--with-apr=/usr/local/apr \
--with-apr-util=/usr/local/apr-util/ \
--enable-modules=most \
--enable-mpms-shared=all \
--with-mpm=prefork

[root@localhost httpd-2.4.37]# make && make install
编译安装过程略...

``
//安装后配置
[root@localhost ~]# echo 'export PATH=/usr/local/apache/bin:$PATH' > /etc/profile.d/httpd.sh
[root@localhost ~]# source /etc/profile.d/httpd.sh
[root@localhost ~]# ln -s /usr/local/apache/include/ /usr/include/httpd
[root@localhost ~]# echo 'MANPATH /usr/local/apache/man' >> /etc/man.config

//取消ServerName前面的注释
[root@localhost ~]# sed -i '/#ServerName/s/#//g' /etc/httpd24/httpd.conf 

//启动apache
[root@localhost ~]# apachectl start
[root@localhost ~]# ss -antl
State      Recv-Q Send-Q   Local Address:Port                  Peer Address:Port
LISTEN     0      128                  *:22                               *:*
LISTEN     0      100          127.0.0.1:25                               *:*
LISTEN     0      128                 :::80                              :::*
LISTEN     0      128                 :::22                              :::*
LISTEN     0      100                ::1:25                              :::* 

5. httpd常用配置

切换使用MPM(编辑/etc/httpd/conf.modules.d/00-mpm.conf文件):


//LoadModule mpm_NAME_module modules/mod_mpm_NAME.so
//NAME有三种,分别是:
    prefork
    event
    worker
    

[root@localhost conf.modules.d]# pwd
/etc/httpd/conf.modules.d
[root@localhost conf.modules.d]# ls
00-base.conf  00-lua.conf  00-proxy.conf    01-cgi.conf
00-dav.conf   00-mpm.conf  00-systemd.conf
[root@localhost conf.modules.d]# vim 00-mpm.conf
# Select the MPM module which should be used by uncommenting exactly
# one of the following LoadModule lines:

# prefork MPM: Implements a non-threaded, pre-forking web server
# See: http://httpd.apache.org/docs/2.4/mod/prefork.html
LoadModule mpm_prefork_module modules/mod_mpm_prefork.so

访问控制法则:

注意:httpd-2.4版本默认是拒绝所有主机访问的,所以安装以后必须做显示授权访问

示例:

<Directory /var/www/html/www>
    <RequireAll>
        Require not ip 192.168.1.20
        Require all granted
    </RequireAll>
</Directory>

**虚拟主机:**
虚拟主机有三类:

* 相同IP不同端口
* 不同IP相同端口
* 相同IP相同端口不同域名

配置相同ip不同端口:

[root@localhost ~]# vim /etc/httpd24/httpd.conf 
ServerName www.example.com:80       //取消此行前面的#号

[root@localhost ~]# vim /etc/httpd24/httpd.conf 
//在配置文件的最后加上如下内容:
<VirtualHost *:80>
    DocumentRoot "/usr/local/apache/htdocs/runtime"
    ServerName runtime.example.com
    ErrorLog "logs/runtime.example.com-error_log"
    CustomLog "logs/rutime.example.com-access_log" common
</VirtualHost>

<VirtualHost *:81>
    DocumentRoot "/usr/local/apache/htdocs/wheel"
    ServerName wheel.example.com
    ErrorLog "logs/wheel.example.com-error_log"
    CustomLog "logs/wheel.example.com-access_log" common
</VirtualHost>

//  在配置文件中修改监听的端口号
[root@localhost ~]#  vim /etc/httpd24/httpd.conf 
#
Listen 80
Listen 81          // 新添加一个81端口

// 创建网站的根目录并且写入内容到index文件中
[root@100 ~]# mkdir /usr/local/apache/htdocs/runtime
[root@100 ~]# mkdir /usr/local/apache/htdocs/wheel
[root@100 ~]# apachectl -t
Syntax OK
[root@100 ~]# echo "runtime" >/usr/local/apache/htdocs/runtime/index.html
[root@100 ~]# echo "wheel" >/usr/local/apache/htdocs/wheel/index.html

[root@100 ~]# apachectl restart     //重启服务
[root@100 ~]# ss -antl
State       Recv-Q Send-Q                Local Address:Port                               Peer Address:Port              
LISTEN      0      128                               *:22                                            *:*                  
LISTEN      0      100                       127.0.0.1:25                                            *:*                  
LISTEN      0      128                              :::80                                           :::*                  
LISTEN      0      128                              :::81                                           :::*                  
LISTEN      0      128                              :::22                                           :::*                  
LISTEN      0      100                             ::1:25                                           :::* 

**浏览器进行验证:**
打开浏览器输入ip //默认使用的是80端口和81端口访问

配置不同ip相同端口:

[root@localhost ~]#  vim /etc/httpd24/httpd.conf 
ServerName www.example.com:80       //取消此行前面的#号

[root@localhost ~]#  vim /etc/httpd24/httpd.conf
//在配置文件的最后加上如下内容:
<VirtualHost 192.168.100.100:80>
    DocumentRoot "/usr/local/apache/htdocs/runtime"
    ServerName runtime.example.com
    ErrorLog "logs/runtime.example.com-error_log"
    CustomLog "logs/rutime.example.com-access_log" common
</VirtualHost>

<VirtualHost 192.168.100.101:80>
    DocumentRoot "/usr/local/apache/htdocs/wheel"
    ServerName wheel.example.com
    ErrorLog "logs/wheel.example.com-error_log"
    CustomLog "logs/wheel.example.com-access_log" common
</VirtualHost>

// 创建网站的根目录并且写入内容到index文件中
[root@100 ~]# mkdir /usr/local/apache/htdocs/runtime
[root@100 ~]# mkdir /usr/local/apache/htdocs/wheel
[root@100 ~]# apachectl -t
Syntax OK
[root@100 ~]# echo "runtime" >/usr/local/apache/htdocs/runtime/index.html
[root@100 ~]# echo "wheel" >/usr/local/apache/htdocs/wheel/index.html

[root@100 ~]# apachectl restart     //重启服务
[root@100 ~]# ss -antl
State       Recv-Q Send-Q                Local Address:Port                               Peer Address:Port              
LISTEN      0      128                               *:22                                            *:*                  
LISTEN      0      100                       127.0.0.1:25                                            *:*                  
LISTEN      0      128                              :::80                                           :::*                  
LISTEN      0      128                              :::81                                           :::*                  
LISTEN      0      128                              :::22                                           :::*                  
LISTEN      0      100                             ::1:25                                           :::* 

例如以下ip:
//给主机服务端再添加一个ip为192.168.100.101
[root@100 ~]# ip addr add 192.168.100.101 dev eth0
[root@100 ~]# ip addr show eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:0c:29:0f:a6:60 brd ff:ff:ff:ff:ff:ff
    inet 192.168.100.100/24 brd 192.168.100.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet 192.168.100.101/32 scope global eth0
       valid_lft forever preferred_lft forever

配置相同ip相同端口不同域名:

[root@localhost ~]# vim /etc/httpd24/httpd.conf
......
ServerAdmin root@localhost

#
# ServerName gives the name and port that the server uses to identify itself.
# This can often be determined automatically, but we recommend you specify
# it explicitly to prevent problems during startup.
#
# If your host doesn't have a registered DNS name, enter its IP address here.
#
ServerName www.example.com:80       //取消此行前面的#号
......

[root@localhost ~]# vim /etc/httpd/conf/httpd.conf
//在配置文件的最后加上如下内容
[root@localhost ~]# tail -25 /etc/httpd/conf/httpd.conf
#virtual host 1     # 虚拟主机1的配置
<VirtualHost 172.16.12.128:80>
    ServerName www.lanyihao.com
    DocumentRoot "/usr/local/apache/htdocs/www"
    ErrorLog "logs/www/error_log"
    CustomLog "logs/www/access_log" combined
</VirtualHost>

# virtual host 2     # 虚拟主机2的配置
<VirtualHost 172.16.12.128:80>
    ServerName blog.lanyihao.com
    DocumentRoot "/usr/local/apache/htdocs/blog"
    ErrorLog "logs/blog/error_log"
    CustomLog "logs/blog/access_log" combined
</VirtualHost>

//创建网页目录并修改属主属组
[root@localhost ~]# cd /usr/local/apache/htdocs/
[root@localhost htdocs]# ls
[root@localhost htdocs]# mkdir www blog
[root@localhost htdocs]# ll
total 0
drwxr-xr-x 2 root root 6 Aug  5 16:56 blog
drwxr-xr-x 2 root root 6 Aug  5 16:56 www
[root@localhost html]# chown -R apache.apache blog
[root@localhost html]# chown -R apache.apache www
[root@localhost html]# ll
total 0
drwxr-xr-x 2 apache apache 6 Aug  5 16:56 blog
drwxr-xr-x 2 apache apache 6 Aug  5 16:56 www

//创建网页
[root@localhost htdocs]# pwd
/var/www/html
[root@localhost htdocs]# ls
blog  www
[root@localhost htdocs]# echo 'hello welcome to visit www' > www/index.html
[root@localhost htdocs]# echo 'hello welcome to visit blog' > blog/index.html

//启动服务并查看是否有80端口
[root@localhost ~]# apachectl restart
[root@localhost ~]# ss -antl
State      Recv-Q Send-Q   Local Address:Port                  Peer Address:Port
LISTEN     0      128                  *:22                               *:*
LISTEN     0      100          127.0.0.1:25                               *:*
LISTEN     0      128                 :::80                              :::*
LISTEN     0      128                 :::22                              :::*
LISTEN     0      100                ::1:25                              :::* 

//在客户机上验证
1.修改hosts文件
 ~ cat /etc/hosts
##
# Host Database
#
# localhost is used to configure the loopback interface
# when the system is booting.  Do not change this entry.
##
127.0.0.1   localhost
255.255.255.255 broadcasthost
::1             localhost
118.31.33.0 zabbix.forevercq.com
0.0.0.0 account.jetbrains.com
//添加以下2行
172.16.12.128 www.wangqing.com
172.16.12.128 blog.wangqing.com

2.在浏览器上打开网页测试
ssl配置:

启用模块:
yum 安装的情况下:
编辑/etc/httpd/conf.modules.d/00-base.conf文件,添加下面这行,如果已经有了但是注释了,则取消注释即可
LoadModule ssl_module modules/mod_ssl.so

源码安装的情况下:

[root@100 httpd]# vim /etc/httpd24/httpd.conf
LoadModule ssl_module modules/mod_ssl.so        //将此行注释取消掉

https配置:
环境说明:

// openssl实现私有CA:
CA的配置文件:/etc/pki/tls/openssl.cnf

a) CA生成一对密钥

[root@96 ~]# cd /etc/pki/CA
[root@96 CA]# ls
certs  crl  newcerts  private

[root@96 CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048)
Generating RSA private key, 2048 bit long modulus
.............+++
................+++
e is 65537 (0x10001)

[root@96 CA]# openssl rsa -in private/cakey.pem -pubout

b)CA生成自签署证书

[root@96 CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HuBei
Locality Name (eg, city) [Default City]:WuHan
Organization Name (eg, company) [Default Company Ltd]:runtime.example.com
Organizational Unit Name (eg, section) []:runtime.example.com
Common Name (eg, your name or your server's hostname) []:runtime.example.com
Email Address []:1@2.com

[root@96 CA]# openssl x509 -text -in cacert.pem      //读出证书的内容
内容略。。。。
[root@96 CA]# mkdir certs newcerts crl        //创建目录

[root@96 CA]# touch index.txt && echo 01 > serial
[root@96 CA]# ls
cacert.pem  certs  crl  index.txt  newcerts  private  serial
[root@96 CA]# cat serial 

c) 服务端生成密钥

[root@100 ~]# cd /etc/httpd24 && mkdir ssl && cd ssl
[root@100 ssl]# 

[root@100 ssl]# (umask 077;openssl genrsa -out httpd.key 2048)
Generating RSA private key, 2048 bit long modulus
.....................+++
................+++
e is 65537 (0x10001)
[root@100 ssl]# 

d) 服务端生成证书签署请求

[root@100 ssl]# openssl req -new -key httpd.key -days 365 -out httpd.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HuBei
Locality Name (eg, city) [Default City]:WuHan
Organization Name (eg, company) [Default Company Ltd]:runtime.example.com
Organizational Unit Name (eg, section) []:runtime.example.com
Common Name (eg, your name or your server's hostname) []:runtime.example.com
Email Address []:1@2.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:                          //不设置密码直接回车
An optional company name []:
[root@100 ssl]# 

e) 服务端把证书签署请求文件发送给CA

[root@100 ssl]# scp httpd.csr root@192.168.100.96:/root
httpd.csr                                                            100% 1082    21.2KB/s   00:00    
[root@100 ssl]# 

[root@96 CA]# cd
[root@96 ~]# ls
httpd.csr

f) CA签署服务端提交上来的证书

[root@96 ~]# openssl ca -in /root/httpd.csr -out httpd.crt -days 365
[root@96 ~]# ls
httpd.crt     httpd.csr

g) CA把签署好的证书httpd.crt发给服务端

[root@96 ~]# scp httpd.crt root@192.168.100.100:/root/
[root@100 ~]# ls
httpd.crt 
[root@100 ~]# mv httpd.crt /etc/httpd24/ssl/
[root@100 ~]# cd /etc/httpd24/ssl/
[root@100 ssl]# ls
httpd.crt  httpd.csr  httpd.key
[root@100 ssl]# 

// ssl配置:

// 配置虚拟主机
[root@100 ~]# vim /etc/httpd24/extra/httpd-ssl.conf 
/DocumentRoot   //搜索
修改为以下内容:
DocumentRoot "/usr/local/apache/htdocs/runtime"
ServerName runtime.example.com:443
ServerAdmin you@example.com
ErrorLog "/usr/local/apache/logs/runtime.example.com-error_log"
TransferLog "/usr/local/apache/logs/runtime.example.com-access_log"
紧接着将
 SSLCertificateFile "/etc/httpd24/server.crt"  改为 SSLCertificateFile "/etc/httpd24/ssl/httpd.crt"
SSLCertificateKeyFile "/etc/httpd24/server.key"  改为   SSLCertificateKeyFile "/etc/httpd24/ssl/httpd.key"

//配置完成之后检查一下配置文件是否有语法错误:
[root@100 httpd24]# apachectl -t
Syntax OK

[root@100 httpd24]# vim httpd.conf
Include /etc/httpd24/extra/httpd-ssl.conf    //将此行的注释取消
LoadModule ssl_module modules/mod_ssl.so   //将此行的注释取消

[root@100 httpd24]# vim extra/httpd-ssl.conf 
#SSLSessionCache        "shmcb:/usr/local/apache/logs/ssl_scache(512000)"  //此行添加注释

//修改完成之后检查一下配置文件是否有语法错误:
[root@100 httpd24]# apachectl -t
Syntax OK

//重启服务
[root@100 httpd24]# apachectl restart

//查看https端口(443)起来没有
[root@100 httpd24]# ss -antl
State       Recv-Q Send-Q      Local Address:Port                     Peer Address:Port              
LISTEN      0      50                      *:139                                 *:*                  
LISTEN      0      128                     *:111                                 *:*                  
LISTEN      0      128                     *:22                                  *:*                  
LISTEN      0      100             127.0.0.1:25                                  *:*                  
LISTEN      0      50                      *:445                                 *:*                  
LISTEN      0      128                     *:44643                               *:*                  
LISTEN      0      50                     :::139                                :::*                  
LISTEN      0      128                    :::111                                :::*                  
LISTEN      0      128                    :::80                                 :::*                  
LISTEN      0      128                    :::22                                 :::*                  
LISTEN      0      100                   ::1:25                                 :::*                  
LISTEN      0      128                    :::443                                :::*          //443端口起来了

修改客户端的hosts文件
C:\Windows\System32\drivers\etc\hosts
192.168.100.100 runtime.example.com

配置https步骤总结:

  • 生成证书(参考博客linux运维系列第6章)
  • 配置httpd.conf,取消以下内容的注释

    LoadModule ssl_module modules/mod_ssl.so
    Include /etc/httpd24/extra/httpd-vhosts.conf
    Include /etc/httpd24/extra/httpd-ssl.conf
    在httpd-vhosts.conf中配置虚拟主机
    
  • 在httpd-ssl.conf中配置证书的位置
  • 检查配置文件是否有语法错误
  • 启动或重启服务
  • 设置hosts以便用域名访问(仅学习阶段,企业实际工作中无需做此步。)

作业

1.编译安装httpd-2.4
2.配置三种不同风格的虚拟主机
3.写博客,要写明环境背景、配置步骤,要有验证截图