allowoverride al_allowoverride none_allow to do doing(6)

签发证书的问题：如果使用的是商业证书，具体的签署方法请查看相关销售商的说明；如果是知己签发的证书，可以使用openssl自带的CA.sh脚本工具。

IXDBA.NET社区论坛

如果不为单独的客户端签发证书，客户端证书可以不用生成，客户端与服务器端使用相同的证书。

(1) conf/ssl.conf 配置文件中的主要参数配置如下：

Listen 443

SSLPassPhraseDialog buildin

#SSLPassPhraseDialog exec:/path/to/program

SSLSessionCache dbm:/usr/local/apache2/logs/ssl_scache

SSLSessionCacheTimeout 300

SSLMutex file:/usr/local/apache2/logs/ssl_mutex

<VirtualHost _default_:443>

# General setup for the virtual host

DocumentRoot '/usr/local/apache2/htdocs'

ServerName :443

ServerAdmin you@example.com

ErrorLog /usr/local/apache2/logs/error_log

TransferLog /usr/local/apache2/logs/access_log

SSLEngine on

SSLCipherSuiteALL:!ADH:!EXPORT56:R+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL

SSLCertificateFile /usr/local/apache2/conf/ssl.crt/server.crt

SSLCertificateKeyFile/usr/local/apache2/conf/ssl.key/server.key

CustomLog /usr/local/apache2/logs/ssl_request_log '%t %h%{SSL_PROTOCOL}x %{SSL_CIPHER}x '%r' %b'

</VirtualHost>

(2) 创建和使用自签署的证书：

a.Create a RSA private key for your Apache server

/usr/local/openssl/bin/openssl genrsa -des3 -out/usr/local/apache2/conf/ssl.key/server.key 1024

b. Create a Certificate Signing Request (CSR)

/usr/local/openssl/bin/openssl req -new -key/usr/local/apache2/conf/ssl.key/server.key -out/usr/local/apache2/conf/ssl.key/server.csr

c. Create a self-signed CA Certificate (X509 structure) with theRSA key of the CA

/usr/local/openssl/bin/openssl req -x509 -days 365 -key/usr/local/apache2/conf/ssl.key/server.key -in/usr/local/apache2/conf/ssl.key/server.csr -out/usr/local/apache2/conf/ssl.crt/server.crt

本文来自电脑杂谈，转载请注明本文网址：
https://www.pc-fly.com/a/jisuanjixue/article-39784-6.html