前言
1、安裝mod_ssl
yum -y install mod_ssl
2、HTTP 服務器上配置mod_ssl
2.1、進入http服務器配置文件所在目錄
cd /etc/pki/tls/certs/
2.2、建立服務器密鑰
[root@fee6202a726e certs]# make server.key #建立服務器密鑰
umask 77 ; \
/usr/bin/openssl genrsa -aes128 2048 > server.key
Generating RSA private key, 2048 bit long modulus
...............................+++
........+++
e is 65537 (0x10001)
Enter pass phrase: #設置一個口令
Verifying - Enter pass phrase: #確定口令
[root@fee6202a726e certs]#
[root@fee6202a726e certs]# openssl rsa -in server.key -out server.key #從密鑰中刪除密碼（以避免系統啟動后被詢問口令）
2.3、建立服務器公鑰
[root@fee6202a726e certs]# make server.csr #生成服務器公鑰 umask 77 ; \ /usr/bin/openssl req -utf8 -new -key server.key -out server.csr You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:CN #填入國家代碼 例如CN State or Province Name (full name) []:Shanghai #省 例如 Shanghai Locality Name (eg, city) [Default City]:Shanghai #市 例如 Shanghai Organization Name (eg, company) [Default Company Ltd]:NOC #組織名 例如NO （任意） Organizational Unit Name (eg, section) []:Newegg #組織單位名 例如 New （任意） Common Name (eg, your name or your server's hostname) []:NOC #通用名 例如 NO (任意) Email Address []:noc@newegg.com # 電子郵箱 Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: # 不填，直接回車 An optional company name []: # 不填，直接回車 [root@fee6202a726e certs]#
2.3、建立服務器證書
openssl x509 -in server.csr -out server.pem -req -signkey server.key -days 365
Signature ok subject=/C=CN/ST=Shanghai/L=Shanghai/O=NOC/OU=Newegg/CN=NOC/emailAddress=noc@newegg.com Getting Private key
chmod 400 server.* # 修改權限為400
2.4、設置SSL
vim /etc/httpd/conf.d/ssl.conf
# General setup for the virtual host, inherited from global configuration DocumentRoot "/var/www/html" # 去掉此參數的注釋‘#’
systemctl restart httpd # 重啟httpd 服務，
驗證： 通過https 打開網頁查看是否成功
代理（強制http請求跳轉到https）
<Directory "/var/www/html"> # 此類容最后增加下面三行
RewriteEngine on # 開啟重定向擎設置為on，就是讓url重寫生效
RewriteCond %{SERVER_PORT} !^443$ # 設置規則，端口重定向成 443 端口
RewriteRule ^(.*)?$ https://%{SERVER_NAME}/$1 [L,R] # ^(.*)?$是一個正則表達式，意思是對所有請求都重定向到https://....
其它代碼解釋
RewriteCond %{REQUEST_FILENAME} !-f #如果文件存在，就直接訪問文件，不進行下面的RewriteRule.
RewriteCond %{REQUEST_FILENAME} !-d # 如果目錄存在就直接訪問目錄不進行RewriteRule
RewriteCond $1 !^(index\.php|images|robots\.txt) #配置url重寫規則，!^(index\.php|images|robots\.txt) 這個正則表達式指明了哪些文件不需要重 寫，而是直接訪問；
zabbix 修改https 並實現http跳轉到https
vim /etc/httpd/conf/httpd.conf # 添加如下內容
<Directory "/usr/share/"> # 這里的路徑是 zabbix 的路徑 /usr/share/zabbix Options Indexes FollowSymLinks Require all granted RewriteEngine on RewriteCond %{SERVER_PORT} !^443$ RewriteRule (.*) https://%{SERVER_NAME}/$1 [R] #RewriteRule ^(.*)?$ https://%{SERVER_NAME}/$1 [L,R] </Directory>