在最近的項(xiàng)目中遇到因?yàn)椴皇峭ㄟ^(guò)https方式訪問(wèn)網(wǎng)站,導(dǎo)致等保測(cè)評(píng)無(wú)法通過(guò),被打上了高風(fēng)險(xiǎn)的標(biāo)簽,而高風(fēng)險(xiǎn)為一票否決項(xiàng),因此這是必須整改的內(nèi)容,客戶網(wǎng)絡(luò)為內(nèi)部網(wǎng)絡(luò)環(huán)境,從網(wǎng)絡(luò)環(huán)境和實(shí)際需求看完全可以通過(guò)OpenSSL進(jìn)行自簽發(fā)SSL證書(shū)來(lái)實(shí)現(xiàn)這一個(gè)目的。下邊就來(lái)看下如何操作的,首先你需要一臺(tái)Linux服務(wù)器并且已經(jīng)安裝了OpenSSL工具,如果沒(méi)有安裝的可以使用yum/apt-get一鍵安裝,安裝完成后操作如下:1、使用nginx -V查看是否支持SSL證書(shū)2、找到一臺(tái)服務(wù)器,假如這臺(tái)服務(wù)器就是CA證書(shū)服務(wù)器,我這里是用的Linux服務(wù)器,具體版本(Centos7.9),進(jìn)入/etc/pki/CA/目錄,執(zhí)行如下命令,將umask設(shè)置為077權(quán)限,然后使用OpenSSL生成私鑰。umask 077;openssl genrsa -out private/cakey.pem 2048
3、執(zhí)行如下命令生成根證書(shū)并且創(chuàng)建兩個(gè)文件,分別是index.txt和serial,index.txt使用touch創(chuàng)建即可,serial中輸入01。openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 3650
會(huì)讓你填寫(xiě)一些信息,根據(jù)提示填寫(xiě)就好了[root@security CA]# openssl req -new -x509 -key httpd.key -out cacert.pem -days 3650
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
Country Name (2 letter code) [XX]:CN #國(guó)家
State or Province Name (full name) []:SC #省份
Locality Name (eg, city) [Default City]:CD #城市
Organization Name (eg, company) [Default Company Ltd]:chengdu #單位名稱
Organizational Unit Name (eg, section) []:yunwei #部門(mén)名稱
Common Name (eg, your name or your server's hostname) []:www.ca.cn #填一個(gè)域名
Email Address []:12345678@qq.com #郵箱
4、找到另外一臺(tái)服務(wù)器,我這里只有一臺(tái)服務(wù)器,到另外一個(gè)目錄創(chuàng)建相關(guān)的證書(shū),假如是/usr/ssl目錄執(zhí)行命令生成證書(shū)簽署請(qǐng)求,其中hostname項(xiàng)為網(wǎng)站域名,其他內(nèi)容都和CA證書(shū)一致openssl req -new -key server.key -out server.csr
5、用之前生成的CA證書(shū)對(duì)證書(shū)簽署請(qǐng)求進(jìn)行簽名,得到服務(wù)端證書(shū)openssl ca -in /usr/ssl/server.csr -out server.crt -days 3650
這就把證書(shū)簽好了,然后我們可以在index.txt和serial文件中看下相關(guān)數(shù)據(jù)6、然后就可以去nginx或者Apache httpd中配置HTTPS方式訪問(wèn)了將簽署的證書(shū)簽署請(qǐng)求、服務(wù)端的key文件都放到nginx配置目錄下:/etc/nginx/下,或者可以自建一個(gè)目錄用于存放ssl證書(shū)文件。user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;
include /usr/share/nginx/modules/*.conf;
events {
worker_connections 1024;
}
http {
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 4096;
include /etc/nginx/mime.types;
default_type application/octet-stream;
include /etc/nginx/conf.d/*.conf;
server {
listen 8888;
listen [::]:8888;
server_name www.mytest.cn;
root /var/www/html;
return 301 https://www.mytest.cn:9443;
}
server {
listen 9443 ssl;
listen [::]:9443 ssl;
server_name www.mytest.cn;
root /var/www/html;
ssl_certificate "/etc/nginx/ssl/server.crt";
ssl_certificate_key "/etc/nginx/ssl/server.key";
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 10m;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
location ~ \.php$ {
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}
include /etc/nginx/default.d/*.conf;
error_page 404 /404.html;
location = /40x.html {
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
}
}
}
配置完成后使用nginx -s reload重新加載配置,讓其生效,然后配置本地證書(shū)文件和hosts將第三步生成的CA服務(wù)器需要對(duì)外公開(kāi)的證書(shū)文件cacert.pem復(fù)制到電腦本地,后綴名改為crt格式,然后雙擊安裝證書(shū),將其導(dǎo)入到電腦本地顯示導(dǎo)入成功即可,由于www.mytest.cn這個(gè)域名沒(méi)有在DNS域名服務(wù)商哪里注冊(cè),所以需要我們自己在hosts文件中添加域名解析地址,Windows電腦在C:\Windows\System32\drivers\etc下,先將hosts文件拖出來(lái)到桌面,然后修改添加如下內(nèi)容在拖進(jìn)去你的服務(wù)器ip地址 www.mytest.cn
修改完成后就可以試著用https方式訪問(wèn)了,由于我使用了天翼云的ECS云主機(jī),但是天翼云如果使用80或者443端口需要進(jìn)行備案,所以我這里使用9443作為網(wǎng)頁(yè)端口。抓個(gè)包看下,數(shù)據(jù)被加密處理。這就是使用openssl工具自簽發(fā)證書(shū)解決網(wǎng)頁(yè)未使用https訪問(wèn)問(wèn)題。
閱讀原文:原文鏈接
該文章在 2025/9/16 11:56:41 編輯過(guò)