环境：
FreeBSD 10.1 x86 64
Apache2.4
openssl 1.0
01 安装openssl（Linux 发行版自行安装）
先搜索一下
#pkg search openssl
openssl-1.0.2j_1,1 SSL and crypto library
openssl-devel-1.1.0c SSL and crypto library (1.1.x)
这里我选择安装1.0
#pkg install openssl
安装之后的目录：/usr/local/openssl
配置文件
#cp /usr/local/openssl/openssl.cnf.sample /usr/local/openssl/openssl.cnf
02 生成key
# openssl req -new -nodes -out req.pem -keyout cert.key -sha256 -newkey rsa:2048Generating a 2048 bit RSA private key ..................+++ .............................................................+++ writing new private key to \'cert.key\' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter \'.\', the field will be left blank. ----- Country Name (2 letter code) [AU]:CNState or Province Name (full name) [Some-State]:BeijingLocality Name (eg, city) []:BeijingOrganization Name (eg, company) [Internet Widgits Pty Ltd]:MinsecOrganizational Unit Name (eg, section) []:AdministratorCommon Name (eg, YOUR name) []:col.minsec.cnEmail Address []:root@minsec.cnPlease enter the following \'extra\' attributes to be sent with your certificate request A challenge password []: An optional company name []:
03 生成RSA key
# openssl genrsa -rand -genkey -out cert.key 20480 semi-random bytes loaded Generating RSA private key, 2048 bit long modulus .............................................+++ .................................................................................................................+++ e is 65537 (0x10001)
04 生成crt
# openssl req -new -x509 -days 365 -key cert.key -out cert.crt -sha256You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter \'.\', the field will be left blank. ----- Country Name (2 letter code) [AU]:CNState or Province Name (full name) [Some-State]:BeijingLocality Name (eg, city) []:BeijingOrganization Name (eg, company) [Internet Widgits Pty Ltd]:MinsecOrganizational Unit Name (eg, section) []:AdministratorCommon Name (e.g. server FQDN or YOUR name) []:col.minsec.cnEmail Address []:root@minsec.cn
当前目录下生成 cert.key 和 cert.crt 文件
#cp ./cert.key /etc/ssl/col.key
#cp ./cert.crt /etc/ssl/col.crt
为了安全修改一下权限
#chmod 700 /etc/ssl/col.key /etc/ssl/col.crt
05 修改http.conf
启用模块
LoadModule ssl_module libexec/apache24/mod_ssl.so
LoadModule socache_shmcb_module libexec/apache24/mod_socache_shmcb.so
启用配置
Include etc/apache24/extra/httpd-ssl.conf
修改extra/httpd-ssl.conf文件
SSLCertificateFile "/etc/ssl/col.crt" #修改为crt文件位置
SSLCertificateKeyFile "/etc/ssl/col.crt" #修改为key文件位置
06 修改虚拟主机
添加443端口支持
ServerAdmin root@minsec.cn
DocumentRoot "/data/wwwroot"
ServerName col.minsec.cn
ServerAlias col.minsec.cn
DirectoryIndex index.php index.html index.htm
SSLEngine on
SSLCertificateFile "/etc/ssl/col.crt" #crt文件位置
SSLCertificateKeyFile "/etc/ssl/col.key" #key文件位置
Options -Indexes +FollowSymlinks
AllowOverride All
Require all granted
07 http跳转到https
修改.htaccess文件
RewriteEngine On
RewriteBase /
RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^.*$ https://%{SERVER_NAME}%{REQUEST_RUI} [L,R]
08 测试
重启apache
#service apache24 restart
访问http://col.minsec.cn 重定向到https://col.minsec.cn
00 参考网址
https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/openssl.html
http://blog.csdn.net/a332708815/article/details/50461092
https://my.oschina.net/itblog/blog/651434
https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/network-ldap.html#ldap-config