понедельник, 17 января 2011 г.

Настройка SSL в Apache2 с самоподписанным сертификатом

Создание самоподписанного сертификата.
# mkdir -p /usr/local/etc/apache22/sslkey


# openssl req -new -x509 -days 365 -sha1 -newkey rsa:1024 -nodes -keyout /usr/local/etc/apache22/sslkey/server.key -out /usr/local/etc/apache22/sslkey/server.crt -subj '/C=RU/ST=AreaName/L=CityName/O=CompanyName/OU=ServiceName/CN=SiteName'

Настройки SSL в Apache22.
/usr/local/etc/apache22/httpd.conf:
LoadModule ssl_module libexec/apache22/mod_ssl.so


<Directory /usr/local/www/SiteName>
    Options FollowSymLinks
    AllowOverride All
    Order Deny,Allow
    Allow from all
#    Deny from all
#    Allow from 192.168.0
    DefaultLanguage ru
    AddDefaultCharset UTF8
</Directory>


Include etc/apache22/Includes/*.conf

/usr/local/etc/apache22/Includes/httpd-ssl.conf:
Listen 443


AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl    .crl


SSLPassPhraseDialog  builtin


#SSLSessionCache         "dbm:/var/run/ssl_scache"
SSLSessionCache        "shmcb:/var/run/ssl_scache(512000)"
SSLSessionCacheTimeout  300


SSLMutex  "file:/var/run/ssl_mutex"

/usr/local/etc/apache22/Includes/httpd-vhosts.conf:
NameVirtualHost *:80


<VirtualHost *:80>
    ServerAdmin webmaster@SiteName
    ServerName SiteName
#    DocumentRoot "/usr/local/www/SiteName"
#    ErrorLog "/var/log/httpdmailerrorlog"
#    CustomLog "/var/log/httpdmailaccesslog" common
Redirect / https://SiteName
</VirtualHost>


NameVirtualHost *:443


<VirtualHost *:443>
    ServerAdmin webmaster@SiteName
    ServerName SiteName:443
    DocumentRoot "/usr/local/www/SiteName"
    CustomLog "/var/log/httpdmailsslaccesslog" "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"


    SSLEngine on
    SSLVerifyClient none
    SSLProxyEngine off


    SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
    SSLCertificateFile "/usr/local/etc/apache22/sslkey/server.crt"
    SSLCertificateKeyFile "/usr/local/etc/apache22/sslkey/server.key"


    <FilesMatch "\.(cgi|shtml|phtml|php)$">
        SSLOptions +StdEnvVars
    </FilesMatch>
    <Directory "/usr/local/www/apache22/cgi-bin">
        SSLOptions +StdEnvVars
    </Directory>


    BrowserMatch ".*MSIE.*"  nokeepalive ssl-unclean-shutdown downgrade-1.0 force-response-1.0
</VirtualHost>

Комментариев нет: