阿里云配置ssl证书apache(阿里云申请免费SSL证书并对Apache进行HTTPS配置)

1.在阿里云页面搜索 “云盾证书”，并点击 “云盾证书服务包年”

2.点击 弹出窗口最底部的 “云顿证书服务包年购买页” 即可进入申请证书页面

3.选择 “免费(个人)DV” 类型，购买数量根据需要填写，每个阿里云账号最多 签发20个。免费版 每个 二级域名 和 每个 一级域名 都只能分别单独使用一个证书。

4.支付成功后 点击 “证书控制台”

5.点击证书后面的 “证书申请”，并填写信息，域名必须跟要使用的域名一致，邮箱手机号 也必须 是有效的，如果是 阿里云购买的域名，则可以选择 自动DNS验证，CSR选择系统自动生成审核速度快。

6.未申请和申请后的证书列表如下

7.下载申请通过的证书

8.选择下载 Apache 服务器对应的证书，解压得到如下3个文件

9.以上3个文件上传到服务器如下位置，也可以是其他目录（/etc/httpd/conf.d/ssl.conf文件中配置需要与之对应）

SSLCertificateFile /etc/pki/tls/certs/3734130_blog.qinqinxia.com_chain.crt SSLCertificateKeyFile /etc/pki/tls/private/3734130_blog.qinqinxia.com.key SSLCertificateChainFile /etc/pki/tls/certs/3734130_blog.qinqinxia.com_public.crt

1.Apache 安装 mod_ssl.so 模块 yum -y install mod_ssl

[root@izhp3flliiu1wistk24f3cz modules]# yum -y install mod_ssl Loaded plugins: fastestmirror base | 3.6 kB 00:00:00 epel | 4.7 kB 00:00:00 extras | 2.9 kB 00:00:00 updates | 2.9 kB 00:00:00 (1/5): epel/x86_64/group_gz | 95 kB 00:00:00 (2/5): epel/x86_64/updateinfo | 1.0 MB 00:00:00 (3/5): updates/7/x86_64/primary_db | 7.6 MB 00:00:00 (4/5): extras/7/x86_64/primary_db | 165 kB 00:00:00 (5/5): epel/x86_64/primary_db | 6.8 MB 00:00:00 Determining fastest mirrors Resolving Dependencies --> Running transaction check ---> Package mod_ssl.x86_64 1:2.4.6-90.el7.centos will be installed --> Processing Dependency: httpd = 2.4.6-90.el7.centos for package: 1:mod_ssl-2.4.6-90.el7.centos.x86_64 --> Running transaction check ---> Package httpd.x86_64 0:2.4.6-80.el7.centos will be updated ---> Package httpd.x86_64 0:2.4.6-90.el7.centos will be an update --> Processing Dependency: httpd-tools = 2.4.6-90.el7.centos for package: httpd-2.4.6-90.el7.centos.x86_64 --> Running transaction check ---> Package httpd-tools.x86_64 0:2.4.6-80.el7.centos will be updated ---> Package httpd-tools.x86_64 0:2.4.6-90.el7.centos will be an update --> Finished Dependency Resolution Dependencies Resolved ======================================================================================================================================================= Package Arch Version Repository Size ======================================================================================================================================================= Installing: mod_ssl x86_64 1:2.4.6-90.el7.centos base 112 k Updating for dependencies: httpd x86_64 2.4.6-90.el7.centos base 2.7 M httpd-tools x86_64 2.4.6-90.el7.centos base 91 k Transaction Summary ======================================================================================================================================================= Install 1 Package Upgrade ( 2 Dependent packages) Total download size: 2.9 M Downloading packages: Delta RPMs disabled because /usr/bin/applydeltarpm not installed. (1/3): httpd-tools-2.4.6-90.el7.centos.x86_64.rpm | 91 kB 00:00:00 (2/3): httpd-2.4.6-90.el7.centos.x86_64.rpm | 2.7 MB 00:00:00 (3/3): mod_ssl-2.4.6-90.el7.centos.x86_64.rpm | 112 kB 00:00:00 ------------------------------------------------------------------------------------------------------------------------------------------------------- Total 5.3 MB/s | 2.9 MB 00:00:00 Running transaction check Running transaction test Transaction test succeeded Running transaction Updating : httpd-tools-2.4.6-90.el7.centos.x86_64 1/5 Updating : httpd-2.4.6-90.el7.centos.x86_64 2/5 Installing : 1:mod_ssl-2.4.6-90.el7.centos.x86_64 3/5 Cleanup : httpd-2.4.6-80.el7.centos.x86_64 4/5 Cleanup : httpd-tools-2.4.6-80.el7.centos.x86_64 5/5 Verifying : httpd-tools-2.4.6-90.el7.centos.x86_64 1/5 Verifying : httpd-2.4.6-90.el7.centos.x86_64 2/5 Verifying : 1:mod_ssl-2.4.6-90.el7.centos.x86_64 3/5 Verifying : httpd-tools-2.4.6-80.el7.centos.x86_64 4/5 Verifying : httpd-2.4.6-80.el7.centos.x86_64 5/5 Installed: mod_ssl.x86_64 1:2.4.6-90.el7.centos Dependency Updated: httpd.x86_64 0:2.4.6-90.el7.centos httpd-tools.x86_64 0:2.4.6-90.el7.centos Complete! [root@izhp3flliiu1wistk24f3cz modules]#

2.安装完成 后可以在 /etc/httpd/modules 目录下找到 mod_ssl.so 文件

[root@izhp3flliiu1wistk24f3cz modules]# pwd /etc/httpd/modules [root@izhp3flliiu1wistk24f3cz modules]# ls libphp5.so mod_authn_core.so mod_authz_host.so mod_cgi.so mod_dir.so mod_heartbeat.so mod_log_debug.so mod_mpm_worker.so mod_proxy_http.so mod_rewrite.so mod_ssl.so mod_version.so mod_access_compat.so mod_authn_dbd.so mod_authz_owner.so mod_charset_lite.so mod_dumpio.so mod_heartmonitor.so mod_log_forensic.so mod_negotiation.so mod_proxy_scgi.so mod_sed.so mod_status.so mod_vhost_alias.so mod_actions.so mod_authn_dbm.so mod_authz_user.so mod_data.so mod_echo.so mod_include.so mod_logio.so mod_proxy_ajp.so mod_proxy.so mod_setenvif.so mod_substitute.so mod_watchdog.so mod_alias.so mod_authn_file.so mod_autoindex.so mod_dav_fs.so mod_env.so mod_info.so mod_lua.so mod_proxy_balancer.so mod_proxy_wstunnel.so mod_slotmem_plain.so mod_suexec.so mod_allowmethods.so mod_authn_socache.so mod_buffer.so mod_dav_lock.so mod_expires.so mod_lbmethod_bybusyness.so mod_macro.so mod_proxy_connect.so mod_ratelimit.so mod_slotmem_shm.so mod_systemd.so mod_asis.so mod_authz_core.so mod_cache_disk.so mod_dav.so mod_ext_filter.so mod_lbmethod_byrequests.so mod_mime_magic.so mod_proxy_express.so mod_reflector.so mod_socache_dbm.so mod_unique_id.so mod_auth_basic.so mod_authz_dbd.so mod_cache.so mod_dbd.so mod_file_cache.so mod_lbmethod_bytraffic.so mod_mime.so mod_proxy_fcgi.so mod_remoteip.so mod_socache_memcache.so mod_unixd.so mod_auth_digest.so mod_authz_dbm.so mod_cache_socache.so mod_deflate.so mod_filter.so mod_lbmethod_heartbeat.so mod_mpm_event.so mod_proxy_fdpass.so mod_reqtimeout.so mod_socache_shmcb.so mod_userdir.so mod_authn_anon.so mod_authz_groupfile.so mod_cgid.so mod_dialup.so mod_headers.so mod_log_config.so mod_mpm_prefork.so mod_proxy_ftp.so mod_request.so mod_speling.so mod_usertrack.so [root@izhp3flliiu1wistk24f3cz modules]#

3. 命令执行结束安装完成后 /etc/httpd/conf.d 目录下会出现一个ssl.conf文件

[root@izhp3flliiu1wistk24f3cz modules]# ls /etc/httpd/conf.d autoindex.conf php.conf README ssl.conf userdir.conf welcome.conf [root@izhp3flliiu1wistk24f3cz modules]#

4.在这个文件里面找到如下内容

SSLCertificateFile xxx_public.crt SSLCertificateKeyFile xxx.key SSLCertificateChainFile xxx_chain.crt

5.修改这三项配置如下

SSLCertificateFile /etc/pki/tls/certs/3734130_blog.qinqinxia.com_public.crt SSLCertificateKeyFile /etc/pki/tls/private/3734130_blog.qinqinxia.com.key SSLCertificateChainFile /etc/pki/tls/certs/3734130_blog.qinqinxia.com_chain.crt

6.然后继续在此文件中配置找到以下内容配置443站点信息

# 子站点配置 ServerName blog.qinqinxia.com #域名 DocumentRoot "/www/wwwroot/blog_online/www/" #项目的路径 DirectoryIndex index.php index.html index.htm # 项目目录权限配置 <Directory "/www/wwwroot/www"> Options +Includes -Indexes AllowOverride All Order Deny,Allow Allow from All </Directory>

#引入外部的ssl配置文件 Include /etc/httpd/conf.d/ssl.conf

systemctl restart httpd

6.如果启动Apache失败

则将 ssl.conf 文件备份一下，然后替换内容为如下纯净版的，其中配置换成与你对应的，然后重启apahce

Listen 443 <VirtualHost *:443> SSLEngine on SSLProtocol all -SSLv2 -SSLv3 SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5 SSLCertificateFile /etc/pki/tls/certs/3734130_blog.qinqinxia.com_public.crt SSLCertificateKeyFile /etc/pki/tls/private/3734130_blog.qinqinxia.com.key SSLCertificateChainFile /etc/pki/tls/certs/3734130_blog.qinqinxia.com_chain.crt # 子站点配置 ServerName blog.qinqinxia.com DocumentRoot "/www/wwwroot/blog_online/www/" DirectoryIndex index.php index.html index.htm <Directory /www/wwwroot/blog_online/www/> Options +Indexes +FollowSymLinks +ExecCGI AllowOverride All Order allow,deny Allow from all Require all granted </Directory> </VirtualHost>

7.测试，用浏览器以https方式访问站点：https://blog.qinqinxia.com/，如下图，访问正常

8.如果需要将 http://blog.qinqinxia.com 转发到 https://blog.qinqinxia.com 则在http.conf文件中增加如下配置并重启apche即可：

9.测试访问80端口重定向到443端口，浏览器访问 http://blog.qinqinxia.com，如果浏览器地址会自动换成 https://blog.qinqinxia.com 表示 配置成功.