[TOC] ## 配置 > [参考文档](https://blog.csdn.net/wlmnzf/article/details/50244409) ### httpd.conf 取消注释 ``` #LoadModule ssl_module modules/mod_ssl.so #Include conf/extra/httpd-mpm.conf #Include conf/extra/httpd-ssl.conf ``` ### httpd-ssl.conf 取消注释 ``` SSLCertificateFile "c:/Apache24/conf/server.crt" SSLCertificateKeyFile "c:/Apache24/conf/server.key" SSLCACertificateFile "c:/Apache24/conf/ca.crt" SSLVerifyClient require SSLVerifyDepth 1 SSLEngine on ``` ### 生成证书 ``` #生成服务器端的私钥(key文件) set OPENSSL_CONF=openssl.cnf openssl genrsa -des3 -out server.key 1024 # 生成server.csr openssl req -new -key server.key -out server.csr -config openssl.cnf # 对客户端也作同样的命令生成key及csr文件 openssl genrsa -des3 -out client.key 1024 openssl req -new -key client.key -out client.csr -config openssl.cnf # 生成ca证书 openssl req -new -x509 -keyout ca.key -out ca.crt -config openssl.cnf ``` 创建文件 ``` 在bin目录下新建一个demoCA文件夹，进入它 新建newcerts文件夹，不需要进入 新建index.txt 新建serial，打开后输入01保存即可 ``` ``` # 用生成的CA的证书为刚才生成的server.csr,client.csr文件签名 openssl ca -in server.csr -out server.crt -cert ca.crt -keyfile ca.key -config openssl.cnf openssl ca -in client.csr -out client.crt -cert ca.crt -keyfile ca.key -config openssl.cnf ``` 第二条指令出现错误，进入demoCA，然后打开index.txt.attr，把它修改成`unique_subject = no`就可以了 生成一个ca.pfx,导入`打开IE浏览器-》工具-》Internet选项-》内容-》证书` `openssl pkcs12 -export -in ca.crt -inkey ca.key -out ca.pfx` ### 配置站点 ``` DocumentRoot "../your_htdocs" <Directory "../your_htdocs"> Options FollowSymLinks AllowOverride All Require all granted </Directory> ``` ## 错误 ### The commonName field needed to be supplied and was missing 修改 `openssl.cnf` ``` commonName = supplied //改为 commonName = optional ``` ### 2.SSLPassPhraseDialog builtin is not supported on Win32(key file C:/Apache24/conf/server.key) Windows不支持加密密钥 `openssl rsa -in server.key -out server.key ` 直接替换server.key 即可,无需重新走流程 ### client denied by server configuration 配置文件