该文配置的https仅在apache2.2.25+openssl<1.0.0版本下通过测试,在openssl>=1.0.1测试不通过(只有openssl版本>=1.0.1才能够使用TLSv1.2协议)。其他apache版本没有测试过。
大致配置步骤:
1. apache需要有如下几个模块,才能够开启SSL:
bin/openssl.exe、bin/ssleay32.dll、bin/libeay32.dll、modules/mod_ssl.so
ps: 如果找不到这些文件,可以在自带有OpenSSL的apache安装目录下找到对应文件。请注意openssl版本
2. 申请SSL证书(在阿里云官网CA证书服务申请),有个人域名型DV,企业型OV,根据需要申请相应证书。
申请过程中,有域名验证的需要,详见:https://help.aliyun.com/knowledge_detail/48014.html;
申请通过后,下载相应证书文件,按照阿里云的安装配置提示操作(相应配置可查看步骤3的内容):
ps: 关于证书文件的配置,最好是填写证书的绝对路径。
3. 需要在apache的安装目录下找到conf/httpd.conf文件,找到如下语句并去掉注释,
#LoadModule ssl_module modules/mod_ssl.so#Include conf/extra/httpd-ssl.conf
ps: 可以不注释httpd-ssl.conf,但是需要在httpd.conf配置SSL相关内容,
配置可参考如下示例(httpd-ssl.conf也是相同内容,根据阿里云CA证书的文档配置):
示例:
Listen 443
NameVirtualHost *:443
AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl .crl
SSLPassPhraseDialog builtin
SSLSessionCache "dbm:C:/Program Files (x86)/Apache Software Foundation/Apache2.2/logs/ssl_scache"
SSLSessionCacheTimeout 300
SSLMutex default
############## for Dscake #######################
<VirtualHost *:443>
ServerName xcx.ews88.com:443
ServerAlias xcx.ews88.com
DocumentRoot "D:/www/htdocs/Dscake"
SSLEngine on
SSLProtocol all -SSLv2 -SSLv3
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4
SSLCertificateFile "C:/Program Files (x86)/Apache Software Foundation/Apache2.2/cert/public.pem"
SSLCertificateKeyFile "C:/Program Files (x86)/Apache Software Foundation/Apache2.2/cert/214273850970747.key"
SSLCertificateChainFile "C:/Program Files (x86)/Apache Software Foundation/Apache2.2/cert/chain.pem"
JkMount /*.jsp Dscake
JkMount /*.do Dscake
JkMount /*.html Dscake
<Directory "D:/www/htdocs/Dscake">
Options FollowSymLinks Indexes
AllowOverride All
Order deny,allow
Allow from all
</Directory>
<IfModule dir_module>
DirectoryIndex index.jsp
</IfModule>
SetEnv force-proxy-request-1.0.1
SetEnv proxy-nokeepalive 1
CustomLog "|bin/rotatelogs D:/apacheLogs/Dscake_logs/Dscake_access_log_%Y_%m_%d_%H.log 3600 480" combined
ErrorLog "|bin/rotatelogs D:/apacheLogs/Dscake_logs/Dscake_error_log_%Y_%m_%d_%H.log 3600 480"
</VirtualHost>
############## for Dscake #######################
4. 重启apache,查看是否启动成功。
注意事项:
当apache启动不成功时,出现“the requested operation has failed”,可以按下列方法操作:
检查错误方法:进入cmd 然后进入 Apache安装目录(具体为你自己的安装目录)\bin> httpd.exe -w -n "Apache2" -k start
(引号中的Apache2修改为你的Apache服务名,我的是2.2.4版,服务名就是Apache2,可以到计算机服务里找)
等于重新启动,这样会打印出错误信息。apache重啟失敗,報錯信息Syntax error on line 62 of C:/Program Files (x86)/Apache Software Foundation/Apache2.2/conf/extra/httpd-ssl.conf:
SSLSessionCache: Invalid argument: size has to be >= 8192 bytes
解決辦法:
將conf\extra\httpd-ssl.conf中SSLSessionCache行修改成下面這樣即可SSLSessionCache "dbm:C:/Program Files (x86)/Apache Software Foundation/Apache2.2/logs/ssl_scache"
即将SSLSessionCache "shmcb:C:/Program Files (x86)/Apache Software Foundation/Apache2.2/logs/ssl_scache(512000)"
即改成dbm。
附录:
- apache升级openssl
参考文章:http://blog.csdn.net/jayxujia123/article/details/25240511
注意:如果你是64位的windows安装了apache,那你在升级openssl时,需要先用32位的openssl安装包安装,然后找到安装后的bin目录下的openssl.exe、libeay32.dll、ssleay32.dll并替换apache/bin目录下的相应文件,才能够升级成功。