Apache 配置多个https协议（ssl加密）站点
工作中经常会遇到多个站点实现https访问，并指向同一个网页，本文将详解如何在Centos 环境下配置Apache多站点实现HTTPS访问。
准备工作
OS：CentOS release 6.8 (Final)
Web：Apache
安装Apache
1、安装Apache
[root@node1 ~]# yum install httpd -y
2、启动服务
[root@node1 ~]# service? httpd start
Starting httpd:??????????????????????????????????????????? [? OK? ]
[root@node1 ~]#
3、修改测试页面
[root@node1 ~]# cat /var/www/html/index.html
<h1>
Apache Test Page~
</h1>
4、测试访问
Apache 配置多个HTTPS站点
实现HTTPS访问
1、安装SSL模块
[root@node1 ~]# yum install mod_ssl -y? #mod_ssl模块，是apache的https传输安全ssl支持模块，必须安装
2、检测
[root@node1 ~]# cd /etc/httpd/modules/
[root@node1 modules]# ll | grep ssl
-rwxr-xr-x 1 root root 181872 Oct 20? 2017 mod_ssl.so
3、上传证书文件
这里我们可以到各大厂商去申请免费证书，可满足个人网站的需求，如企业网站，建议购买企业收费证书；
[root@node1 ~]# cd /etc/httpd/??? #证书文件通常也可放到linux的/etc/pki/tls/certs目录下
[root@node1 httpd]# mkdir ssl/default
[root@node1 httpd]# cd ssl/default
[root@node1 default]# rz
[root@node1 default]# ll
total 12
-rw-r--r-- 1 root root 1683 Apr 13 22:26 1_root_bundle.crt
-rw-r--r-- 1 root root 2008 Apr 13 22:26 2_domaintest.cn.crt
-rw-r--r-- 1 root root 1678 Apr 13 22:26 3_domaintest.cn.key
[root@node1 default]#
4、修改配置
[root@node1 ~]# cd /etc/httpd/conf.d/
[root@node1 conf.d]# ls
README? ssl.conf? welcome.conf
[root@node1 conf.d]# vim ssl.conf?? #安装mod_ssl模块后，该ssl.conf会自动生成，里面有配置443虚拟主机的案例文件参见附件给出了mod_ssl的原始文件
LoadModule ssl_module modules/mod_ssl.so
Listen 443
<VirtualHost *:443>
??? DocumentRoot "/var/www/html"
??? ServerName domaintest.cn
??? SSLEngine on
??? SSLCertificateFile /etc/httpd/ssl/default/2_domaintest.cn.crt
??? SSLCertificateKeyFile /etc/httpd/ssl/default/3_domaintest.cn.key
??? SSLCertificateChainFile /etc/httpd/ssl/default/1_root_bundle.crt
</VirtualHost>
配置文件参数?说明
LoadModule?加载SSL模块
Listen?监听443端口
DocumentRoot?网页目录
ServerName?站点域名
SSLEngine on?启用SSL功能
SSLCertificateFile?证书文件
SSLCertificateKeyFile?私钥文件
SSLCertificateChainFile?证书链文件
5、重启服务
[root@node1 ~]# httpd -t
Syntax OK
可以先试用httpd -t 检测一下配置文件是否正确，然后再重启服务；
[root@node1 ~]# service? httpd restart
Stopping httpd:??????????????????????????????????????????? [? OK? ]
Starting httpd:??????????????????????????????????????????? [? OK? ]
6、检测端口是否监听
[root@node1 conf.d]# ss -ntl
State????? Recv-Q Send-Q?????? Local Address:Port???????? Peer Address:Port
LISTEN???? 0????? 128????????????????????? *:80????????????????????? *:*????
LISTEN???? 0????? 128????????????????????? *:22????????????????????? *:*????
LISTEN???? 0????? 100????????????? 127.0.0.1:25????????????????????? *:*????
LISTEN???? 0????? 128????????????????????? *:443???????????????????? *:*????
[root@node1 conf.d]#
7、测试访问
建议使用google浏览器进行测试访问，f12查看，会显示“This page is secure (valid HTTPS).”，说明证书配置正确；
Apache 配置多个HTTPS站点
配置多个HTTPS站点
1、上传证书文件
[root@node1 ~]# cd /etc/httpd/ssl/
[root@node1 ssl]# mkdir web
[root@node1 ssl]# cd web/
[root@node1 web]# rz
2、修改配置文件修改的是ssl.conf
LoadModule ssl_module modules/mod_ssl.so
Listen 443
NameVirtualHost *:443 #配置多个https站点，该行一定要加入
# 第一个虚拟主机
<VirtualHost *:443>
DocumentRoot "/var/www/html"
ServerName domaintest.cn
SSLEngine on
SSLCertificateFile /etc/httpd/ssl/default/2_domaintest.cn.crt
SSLCertificateKeyFile /etc/httpd/ssl/default/3_domaintest.cn.key
SSLCertificateChainFile /etc/httpd/ssl/default/1_root_bundle.crt
</VirtualHost>
#第二个虚拟主机
<VirtualHost *:443>
DocumentRoot "/var/www/html"
ServerName web.domaintest.cn
SSLEngine on
SSLCertificateFile /etc/httpd/ssl/web/2_web.domaintest.cn.crt
SSLCertificateKeyFile /etc/httpd/ssl/web/3_web.domaintest.cn.key
SSLCertificateChainFile /etc/httpd/ssl/web/1_root_bundle.crt
</VirtualHost>
3、重启服务
[root@node1 conf.d]# service? httpd restart
Stopping httpd:??????????????????????????????????????????? [? OK? ]
Starting httpd:??????????????????????????????????????????? [? OK? ]
[root@node1 conf.d]#
4、测试访问
Apache 配置多个HTTPS站点
Apache 配置多个HTTPS站点
到这里，Apache多站点https就实现了~
附件1：yum安装mod_ssl模块后生成的配置完成2个https网站的ssl文件/etc/httpd/conf.d/ssl.conf文件：
#
# This is the Apache server configuration file providing SSL support.
# It contains the configuration directives to instruct the server how to
# serve pages over an https connection. For detailing information about these
# directives see <URL:http://httpd.apache.org/docs/2.2/mod/mod_ssl.html>
#
# Do NOT simply read the instructions in here without understanding
# what they do.? They're here only as hints or reminders.? If you are unsure
# consult the online docs. You have been warned.?
#
LoadModule ssl_module modules/mod_ssl.so
#
# When we also provide SSL we have to listen to the
# the HTTPS port in addition.
#
Listen 443
NameVirtualHost *:443
##
##? SSL Global Context
##
##? All SSL configuration in this context applies both to
##? the main server and all SSL-enabled virtual hosts.
##
#?? Pass Phrase Dialog:
#?? Configure the pass phrase gathering process.
#?? The filtering dialog program (`builtin' is a internal
#?? terminal dialog) has to provide the pass phrase on stdout.
SSLPassPhraseDialog? builtin
#?? Inter-Process Session Cache:
#?? Configure the SSL Session Cache: First the mechanism
#?? to use and second the expiring timeout (in seconds).
SSLSessionCache???????? shmcb:/var/cache/mod_ssl/scache(512000)
SSLSessionCacheTimeout? 300
#?? Semaphovre:
#?? Configure the path to the mutual exclusion semaphore the
#?? SSL engine uses internally for inter-process synchronization.
SSLMutex default
#?? Pseudo Random Number Generator (PRNG):
#?? Configure one or more sources to seed the PRNG of the
#?? SSL library. The seed data should be of good random quality.
#?? WARNING! On some platforms /dev/random blocks if not enough entropy
#?? is available. This means you then cannot use the /dev/random device
#?? because it would lead to very long connection times (as long as
#?? it requires to make more entropy available). But usually those
#?? platforms additionally provide a /dev/urandom device which doesn't
#?? block. So, if available, use this one instead. Read the mod_ssl User
#?? Manual for more details.
SSLRandomSeed startup file:/dev/urandom? 256
SSLRandomSeed connect builtin
#SSLRandomSeed startup file:/dev/random? 512
#SSLRandomSeed connect file:/dev/random? 512
#SSLRandomSeed connect file:/dev/urandom 512
#
# Use "SSLCryptoDevice" to enable any supported hardware
# accelerators. Use "openssl engine -v" to list supported
# engine names.? NOTE: If you enable an accelerator and the
# server does not start, consult the error logs and ensure
# your accelerator is functioning properly.
#
SSLCryptoDevice builtin
#SSLCryptoDevice ubsec
##
## SSL Virtual Host Context
##
<VirtualHost *:443>
# General setup for the virtual host, inherited from global configuration
DocumentRoot "/var/www/html/qiangshangkeji/web/web/weixinpronew.qiangshangkeji.com"
ServerName weixinpro.qiangshangkeji.com:443
# 添加 SSL 协议支持协议，去掉不安全的协议
SSLProtocol all -SSLv2 -SSLv3
# 修改加密套件如下
SSLCipherSuite HIGH:!RC4:!MD5:!aNULL:!eNULL:!NULL:!DH:!EDH:!EXP:+MEDIUM
SSLHonorCipherOrder on
# 证书公钥配置
SSLCertificateFile /etc/pki/tls/certs/public.pem
# 证书私钥配置
SSLCertificateKeyFile /etc/pki/tls/certs/215024286030114.key
# 证书链配置，如果该属性开头有 '#'字符，请删除掉
SSLCertificateChainFile /etc/pki/tls/certs/chain.pem
</VirtualHost>???
<VirtualHost *:443>
# General setup for the virtual host, inherited from global configuration
DocumentRoot "/var/www/html/qiangshangkeji/web/web/weixin.qiangshangkeji.com"
ServerName weixin.qiangshangkeji.com:443
# 添加 SSL 协议支持协议，去掉不安全的协议
SSLProtocol all -SSLv2 -SSLv3
# 修改加密套件如下
SSLCipherSuite HIGH:!RC4:!MD5:!aNULL:!eNULL:!NULL:!DH:!EDH:!EXP:+MEDIUM
SSLHonorCipherOrder on
# 证书公钥配置
SSLCertificateFile /etc/pki/tls/certs/weixin.qiangshangkeji.com/public.pem
# 证书私钥配置
SSLCertificateKeyFile /etc/pki/tls/certs/weixin.qiangshangkeji.com/215024163410114.key
# 证书链配置，如果该属性开头有 '#'字符，请删除掉
SSLCertificateChainFile /etc/pki/tls/certs/weixin.qiangshangkeji.com/chain.pem
</VirtualHost>???
附件2：yum安装mod_ssl模块后生成的配置完成 ssl文件/etc/httpd/conf.d/ssl.conf文件原始文件：
#
# This is the Apache server configuration file providing SSL support.
# It contains the configuration directives to instruct the server how to
# serve pages over an https connection. For detailing information about these
# directives see <URL:http://httpd.apache.org/docs/2.2/mod/mod_ssl.html>
#
# Do NOT simply read the instructions in here without understanding
# what they do.? They're here only as hints or reminders.? If you are unsure
# consult the online docs. You have been warned.?
#
LoadModule ssl_module modules/mod_ssl.so
#
# When we also provide SSL we have to listen to the
# the HTTPS port in addition.
#
Listen 443
NameVirtualHost *:443
##
##? SSL Global Context
##
##? All SSL configuration in this context applies both to
##? the main server and all SSL-enabled virtual hosts.
##
#?? Pass Phrase Dialog:
#?? Configure the pass phrase gathering process.
#?? The filtering dialog program (`builtin' is a internal
#?? terminal dialog) has to provide the pass phrase on stdout.
SSLPassPhraseDialog? builtin
#?? Inter-Process Session Cache:
#?? Configure the SSL Session Cache: First the mechanism
#?? to use and second the expiring timeout (in seconds).
SSLSessionCache???????? shmcb:/var/cache/mod_ssl/scache(512000)
SSLSessionCacheTimeout? 300
#?? Semaphovre:
#?? Configure the path to the mutual exclusion semaphore the
#?? SSL engine uses internally for inter-process synchronization.
SSLMutex default
#?? Pseudo Random Number Generator (PRNG):
#?? Configure one or more sources to seed the PRNG of the
#?? SSL library. The seed data should be of good random quality.
#?? WARNING! On some platforms /dev/random blocks if not enough entropy
#?? is available. This means you then cannot use the /dev/random device
#?? because it would lead to very long connection times (as long as
#?? it requires to make more entropy available). But usually those
#?? platforms additionally provide a /dev/urandom device which doesn't
#?? block. So, if available, use this one instead. Read the mod_ssl User
#?? Manual for more details.
SSLRandomSeed startup file:/dev/urandom? 256
SSLRandomSeed connect builtin
#SSLRandomSeed startup file:/dev/random? 512
#SSLRandomSeed connect file:/dev/random? 512
#SSLRandomSeed connect file:/dev/urandom 512
#
# Use "SSLCryptoDevice" to enable any supported hardware
# accelerators. Use "openssl engine -v" to list supported
# engine names.? NOTE: If you enable an accelerator and the
# server does not start, consult the error logs and ensure
# your accelerator is functioning properly.
#
SSLCryptoDevice builtin
#SSLCryptoDevice ubsec
##
## SSL Virtual Host Context
##
<VirtualHost *:443>
# General setup for the virtual host, inherited from global configuration
DocumentRoot "/var/www/html/qiangshangkeji/web/web/weixin.qiangshangkeji.com"
ServerName weixin.qiangshangkeji.com:443
# Use separate log files for the SSL virtual host; note that LogLevel
# is not inherited from httpd.conf.
ErrorLog logs/ssl_error_log
TransferLog logs/ssl_access_log
LogLevel warn
#?? SSL Engine Switch:
#?? Enable/Disable SSL for this virtual host.
SSLEngine on
#?? SSL Protocol support:
# List the enable protocol levels with which clients will be able to
# connect.? Disable SSLv2 access by default:
SSLProtocol all -SSLv2
#?? SSL Cipher Suite:
# List the ciphers that the client is permitted to negotiate.
# See the mod_ssl documentation for a complete list.
SSLCipherSuite DEFAULT:!EXP:!SSLv2:!DES:!IDEA:!SEED:+3DES
#?? Server Certificate:
# Point SSLCertificateFile at a PEM encoded certificate.? If
# the certificate is encrypted, then you will be prompted for a
# pass phrase.? Note that a kill -HUP will prompt again.? A new
# certificate can be generated using the genkey(1) command.
#SSLCertificateFile /etc/pki/tls/certs/localhost.crt
SSLCertificateFile? /etc/pki/tls/certs/server.crt
#?? Server Private Key:
#?? If the key is not combined with the certificate, use this
#?? directive to point at the key file.? Keep in mind that if
#?? you've both a RSA and a DSA private key you can configure
#?? both in parallel (to also allow the use of DSA ciphers, etc.)
#SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
SSLCertificateKeyFile /etc/pki/tls/private/server.key
#?? Server Certificate Chain:
#?? Point SSLCertificateChainFile at a file containing the
#?? concatenation of PEM encoded CA certificates which form the
#?? certificate chain for the server certificate. Alternatively
#?? the referenced file can be the same as SSLCertificateFile
#?? when the CA certificates are directly appended to the server
#?? certificate for convinience.
#SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt
SSLCertificateChainFile /etc/pki/tls/certs/server.crt
#?? Certificate Authority (CA):
#?? Set the CA certificate verification path where to find CA
#?? certificates for client authentication or alternatively one
#?? huge file containing all of them (file must be PEM encoded)
#SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt
#?? Client Authentication (Type):
#?? Client certificate verification type and depth.? Types are
#?? none, optional, require and optional_no_ca.? Depth is a
#?? number which specifies how deeply to verify the certificate
#?? issuer chain before deciding the certificate is not valid.
#SSLVerifyClient require
#SSLVerifyDepth? 10
#?? Access Control:
#?? With SSLRequire you can do per-directory access control based
#?? on arbitrary complex boolean expressions containing server
#?? variable checks and other lookup directives.? The syntax is a
#?? mixture between C and Perl.? See the mod_ssl documentation
#?? for more details.
#<Location />
#SSLRequire (??? %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \
#??????????? and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
#??????????? and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
#??????????? and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
#??????????? and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20?????? ) \
#?????????? or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
#</Location>
#?? SSL Engine Options:
#?? Set various options for the SSL engine.
#?? o FakeBasicAuth:
#???? Translate the client X.509 into a Basic Authorisation.? This means that
#???? the standard Auth/DBMAuth methods can be used for access control.? The
#???? user name is the `one line' version of the client's X.509 certificate.
#???? Note that no password is obtained from the user. Every entry in the user
#???? file needs this password: `xxj31ZMTZzkVA'.
#?? o ExportCertData:
#???? This exports two additional environment variables: SSL_CLIENT_CERT and
#???? SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
#???? server (always existing) and the client (only existing when client
#???? authentication is used). This can be used to import the certificates
#???? into CGI scripts.
#?? o StdEnvVars:
#???? This exports the standard SSL/TLS related `SSL_*' environment variables.
#???? Per default this exportation is switched off for performance reasons,
#???? because the extraction step is an expensive operation and is usually
#???? useless for serving static content. So one usually enables the
#???? exportation for CGI and SSI requests only.
#?? o StrictRequire:
#???? This denies access when "SSLRequireSSL" or "SSLRequire" applied even
#???? under a "Satisfy any" situation, i.e. when it applies access is denied
#???? and no other module can change it.
#?? o OptRenegotiate:
#???? This enables optimized SSL connection renegotiation handling when SSL
#???? directives are used in per-directory context.
#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
<Files ~ "\.(cgi|shtml|phtml|php3?)$">
??? SSLOptions +StdEnvVars
</Files>
<Directory "/var/www/cgi-bin">
??? SSLOptions +StdEnvVars
</Directory>
#?? SSL Protocol Adjustments:
#?? The safe and default but still SSL/TLS standard compliant shutdown
#?? approach is that mod_ssl sends the close notify alert but doesn't wait for
#?? the close notify alert from client. When you need a different shutdown
#?? approach you can use one of the following variables:
#?? o ssl-unclean-shutdown:
#???? This forces an unclean shutdown when the connection is closed, i.e. no
#???? SSL close notify alert is send or allowed to received.? This violates
#???? the SSL/TLS standard but is needed for some brain-dead browsers. Use
#???? this when you receive I/O errors because of the standard approach where
#???? mod_ssl sends the close notify alert.
#?? o ssl-accurate-shutdown:
#???? This forces an accurate shutdown when the connection is closed, i.e. a
#???? SSL close notify alert is send and mod_ssl waits for the close notify
#???? alert of the client. This is 100% SSL/TLS standard compliant, but in
#???? practice often causes hanging connections with brain-dead browsers. Use
#???? this only for browsers where you know that their SSL implementation
#???? works correctly.
#?? Notice: Most problems of broken clients are also related to the HTTP
#?? keep-alive facility, so you usually additionally want to disable
#?? keep-alive for those clients, too. Use variable "nokeepalive" for this.
#?? Similarly, one has to force some clients to use HTTP/1.0 to workaround
#?? their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
#?? "force-response-1.0" for this.
SetEnvIf User-Agent ".*MSIE.*" \
???????? nokeepalive ssl-unclean-shutdown \
???????? downgrade-1.0 force-response-1.0
#?? Per-Server Logging:
#?? The home of a custom SSL log file. Use this when you want a
#?? compact non-error SSL logfile on a virtual host basis.
CustomLog logs/ssl_request_log \
????????? "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
</VirtualHost>?????????????????????????????????
案例：
#用于建筑行业招聘求职小程序,customlog配置访问日志的目录，也就是https的来自443端口的访问目录，经过实际测试即使来自https的访问，记录的协议类型也是HTTP/1.1,与http一样，因此可以配置与80端口不同的访问日志目录来区分来自https的访问。
<VirtualHost *:443>
# General setup for the virtual host, inherited from global configuration
DocumentRoot "/newdata/web/web/zhaopin.qiangshangkeji.com"
ServerName zhaopin.qiangshangkeji.com:443
ErrorLog logs/zhaopin.qiangshangkeji.com-error_log
CustomLog logs/zhaopin.qiangshangkeji.com-access_log common
# 添加 SSL 协议支持协议，去掉不安全的协议
SSLProtocol all -SSLv2 -SSLv3
# 修改加密套件如下
SSLCipherSuite HIGH:!RC4:!MD5:!aNULL:!eNULL:!NULL:!DH:!EDH:!EXP:+MEDIUM
SSLHonorCipherOrder on
# 证书公钥配置
SSLCertificateFile /etc/pki/tls/certs/zhaopin.qiangshangkeji.com/2602582_zhaopin.qiangshangkeji.com_public.crt
# 证书私钥配置
SSLCertificateKeyFile /etc/pki/tls/certs/zhaopin.qiangshangkeji.com/2602582_zhaopin.qiangshangkeji.com.key
# 证书链配置，如果该属性开头有 '#'字符，请删除掉
SSLCertificateChainFile /etc/pki/tls/certs/zhaopin.qiangshangkeji.com/2602582_zhaopin.qiangshangkeji.com_chain.crt
