APACHE 服務器 搭建HTTPS網站教程
2024-08-27 18:27:03
供稿：網友
由于百度和谷歌等搜索引擎提倡開啟HTTPS安全傳輸的鏈接方式。錯新源碼網近日也做了HTTPS鏈接方式。錯新源碼網采用的是upupw
apache版的服務器軟件。那么今天分享一下upupw apache版的服務器軟件如何開啟HTTPS鏈接。廢話不多說，直接上教程。。。。
首先到這里下在upupw apache服務器套件https://down.vevb.com/software/33477.html
然后解壓到您指定的分區里面比如D:/UPUPW/
第一步：
復制UPUPW目錄下面/Apache2/bin/目錄下面的 libeay32.dll，openssl.exe，ssleay32.dll這三個文件到您的PHP目錄里。
注：原版的UPUPW APACHE版的服務器套件，不論您怎么配置，即使您配置的都正確如果不復制這三個文件也啟動不了Apache服務。所以這三個文件目前為止必須復制到PHP目錄替換PHP目錄里面的相同文件名的文件。
第二步：
上面的三個文件復制好之后
打開Apache2/conf/目錄下面的httpd.conf文件
找到這兩行
#LoadModule ssl_module modules/mod_ssl.so
#Include conf/extra/httpd-ssl.conf
去掉前面的#號，修改成
LoadModule ssl_module modules/mod_ssl.so
Include conf/extra/httpd-ssl.conf
需要注意的是下面這兩行代碼
Listen 80
Include conf/httpd-listen.conf
如果這兩行代碼前面有#也請去掉。
然后保存
第三步
然后在打開Apache2/conf/目錄下面的httpd-listen.conf文件
您會看到這樣的文字
#Listen 81
#Listen 8080
我們增加一行代碼
listen 443
變成
#Listen 81
#Listen 8080
listen 443
解釋一下，#listen 81和#listen 8080不在服務器端口檢測中
增加listen 443是為了讓服務器對443端口進行檢測和鏈接
如果您不開啟443端口的檢測即使您配置正確HTTPS也不能鏈接
修改好之后后保存
第四步
接下來我們在打開Apache2/conf/extra目錄下面的httpd-ssl.conf文件
#
# This is the Apache server configuration file providing SSL support.
# It contains the configuration directives to instruct the server how to
# serve pages over an https connection. For detailed information about these
# directives see <URL:http://httpd.apache.org/docs/2.4/mod/mod_ssl.html>
#
# Do NOT simply read the instructions in here without understanding
# what they do. They're here only as hints or reminders. If you are unsure
# consult the online docs. You have been warned.
#
# Required modules: mod_log_config, mod_setenvif, mod_ssl,
# socache_shmcb_module (for default value of SSLSessionCache)
#
# Pseudo Random Number Generator (PRNG):
# Configure one or more sources to seed the PRNG of the SSL library.
# The seed data should be of good random quality.
# WARNING! On some platforms /dev/random blocks if not enough entropy
# is available. This means you then cannot use the /dev/random device
# because it would lead to very long connection times (as long as
# it requires to make more entropy available). But usually those
# platforms additionally provide a /dev/urandom device which doesn't
# block. So, if available, use this one instead. Read the mod_ssl User
# Manual for more details.
#
#SSLRandomSeed startup file:/dev/random 512
#SSLRandomSeed startup file:/dev/urandom 512
#SSLRandomSeed connect file:/dev/random 512
#SSLRandomSeed connect file:/dev/urandom 512
#
# When we also provide SSL we have to listen to the
# standard HTTP port (see above) and to the HTTPS port
#
Listen 443
# SSL Cipher Suite:
# List the ciphers that the client is permitted to negotiate.
# See the mod_ssl documentation for a complete list.
SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
# Speed-optimized SSL Cipher configuration:
# If speed is your main concern (on busy HTTPS servers e.g.),
# you might want to force clients to specific, performance
# optimized ciphers. In this case, prepend those ciphers
# to the SSLCipherSuite list, and enable SSLHonorCipherOrder.
# Caveat: by giving precedence to RC4-SHA and AES128-SHA
# (as in the example below), most connections will no longer
# have perfect forward secrecy - if the server's key is
# compromised, captures of past or future traffic must be
# considered compromised, too.
#SSLCipherSuite RC4-SHA:AES128-SHA:HIGH:MEDIUM:!aNULL:!MD5
#SSLHonorCipherOrder on
# Pass Phrase Dialog:
# Configure the pass phrase gathering process.
# The filtering dialog program (`builtin' is an internal
# terminal dialog) has to provide the pass phrase on stdout.
SSLPassPhraseDialog builtin
# Inter-Process Session Cache:
# Configure the SSL Session Cache: First the mechanism
# to use and second the expiring timeout (in seconds).
#SSLSessionCache "dbm:logs/ssl_scache"
SSLSessionCache "shmcb:logs/ssl_scache(512000)"
SSLSessionCacheTimeout 300
<VirtualHost _default_:443>
DocumentRoot "sslroot/"
ServerName www.example.com:443
ServerAlias example.com
ServerAdmin webmaster@example.com
DirectoryIndex index.html index.htm index.php default.php app.php u.php
ErrorLog logs/example_error.log
CustomLog logs/example_access.log /
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x /"%r/" %b"
SSLEngine on
SSLCertificateFile "conf/server.crt"
SSLCertificateKeyFile "conf/server.key"
<FilesMatch "/.(shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
BrowserMatch "MSIE [2-5]" /
nokeepalive ssl-unclean-shutdown /
downgrade-1.0 force-response-1.0
</VirtualHost>
這是原版的httpd-ssl.conf文件內容 上面有個Listen 443對443端口檢測的代碼 我們把這段代碼刪除了
如果您不想刪除這段代碼那么httpd-listen.conf這個文件中的對443端口進行檢測的代碼也必須注釋掉 在前面增加#號。。。
如果是原版的httpd-listen.conf文件 我們不需要做第三步的修改。。。
接下來我們增加HTTPS鏈接的主機：修改這段代碼
<VirtualHost _default_:443>
DocumentRoot "sslroot/"
ServerName www.example.com:443
ServerAlias example.com
ServerAdmin webmaster@example.com
DirectoryIndex index.html index.htm index.php default.php app.php u.php
ErrorLog logs/example_error.log
CustomLog logs/example_access.log /
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x /"%r/" %b"
SSLEngine on
SSLCertificateFile "conf/server.crt"
SSLCertificateKeyFile "conf/server.key"
<FilesMatch "/.(shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
BrowserMatch "MSIE [2-5]" /
nokeepalive ssl-unclean-shutdown /
downgrade-1.0 force-response-1.0
</VirtualHost>
修改成：
NameVirtualHost *:443
SSLStrictSNIVHostCheck off
<VirtualHost _default_:443>
DocumentRoot "D:/web/" （注：D:/web/這是您的網站目錄。修改成您的網站目錄。必須修改。）
ServerName www.survivalescaperooms.com:443 （注：www.survivalescaperooms.com:443這是您的網站域名。修改成您的網站域名。）
ServerAlias www.survivalescaperooms.com （注：www.survivalescaperooms.com:443這是您的網站域名。修改成您的網站域名。必須修改。）
ServerAdmin admin@vevb.com （注：admin@vevb.com這是您的網站管理員郵箱。修改成您的網站管理員郵箱。可以不修改。）
SSLEngine on
SSLProtocol all -SSLv2
SSLCipherSuite ALL:!DH:!EXPORT:!RC4:+HIGH:+MEDIUM:!aNULL:!eNULL
SSLCertificateFile "D:/UPUPW_AP/Apache2/conf/Apache/www.crt" （注：www.crt是您申請的Apache版本的SSL證書文件和目錄結構。可以修改目錄結構和證書文件名。文件名要求越短越好）
SSLCertificateKeyFile "D:/UPUPW_AP/Apache2/conf/Apache/www.key"
（注：www.key是您申請的Apache版本的SSL證書密匙文件和目錄結構?？梢孕薷哪夸浗Y構和證書密匙文件名。文件名要求越短越好）
SSLCertificateChainFile
"D:/UPUPW_AP/Apache2/conf/Apache/root_bundle.crt"
（注：root_bundle.crt是您申請的Apache版本的SSL證書文件和目錄結構?？梢孕薷哪夸浗Y構和證書文件名。特別注意這個證書文件名root_bundle.crt不可以用www_bundle.crt這樣的文件名。我測試www_bundle.crt這樣的文件名不可以，啟動不了Apache服務。必須是root_bundle.crt或者root_bundle1.crt，root_bundle2.crt這樣的文件名稱）
<FilesMatch "/.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory "D:/web/"> （注：D:/web/這也是您的網站目錄。修改成您的網站目錄）
Options FollowSymLinks
AllowOverride All
Order allow,deny
Allow from all
</Directory>
</VirtualHost>
以上配置文件中（注：D:/web/這是您的網站目錄。修改成您的網站目錄。必須修改。）這樣的字符和解釋請您在修改好之后全部刪除。否則啟動不了Apache服務。
修改好之后后保存
以下復制我的httpd-ssl.conf文件內容以供您參考修改：
#
# This is the Apache server configuration file providing SSL support.
# It contains the configuration directives to instruct the server how to
# serve pages over an https connection. For detailed information about these
# directives see <URL:http://httpd.apache.org/docs/2.4/mod/mod_ssl.html>
#
# Do NOT simply read the instructions in here without understanding
# what they do. They're here only as hints or reminders. If you are unsure
# consult the online docs. You have been warned.
#
# Required modules: mod_log_config, mod_setenvif, mod_ssl,
# socache_shmcb_module (for default value of SSLSessionCache)
#
# Pseudo Random Number Generator (PRNG):
# Configure one or more sources to seed the PRNG of the SSL library.
# The seed data should be of good random quality.
# WARNING! On some platforms /dev/random blocks if not enough entropy
# is available. This means you then cannot use the /dev/random device
# because it would lead to very long connection times (as long as
# it requires to make more entropy available). But usually those
# platforms additionally provide a /dev/urandom device which doesn't
# block. So, if available, use this one instead. Read the mod_ssl User
# Manual for more details.
#
#SSLRandomSeed startup file:/dev/random 512
#SSLRandomSeed startup file:/dev/urandom 512
#SSLRandomSeed connect file:/dev/random 512
#SSLRandomSeed connect file:/dev/urandom 512
#
# When we also provide SSL we have to listen to the
# standard HTTP port (see above) and to the HTTPS port
#
# SSL Cipher Suite:
# List the ciphers that the client is permitted to negotiate.
# See the mod_ssl documentation for a complete list.
SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
# Speed-optimized SSL Cipher configuration:
# If speed is your main concern (on busy HTTPS servers e.g.),
# you might want to force clients to specific, performance
# optimized ciphers. In this case, prepend those ciphers
# to the SSLCipherSuite list, and enable SSLHonorCipherOrder.
# Caveat: by giving precedence to RC4-SHA and AES128-SHA
# (as in the example below), most connections will no longer
# have perfect forward secrecy - if the server's key is
# compromised, captures of past or future traffic must be
# considered compromised, too.
#SSLCipherSuite RC4-SHA:AES128-SHA:HIGH:MEDIUM:!aNULL:!MD5
#SSLHonorCipherOrder on
# Pass Phrase Dialog:
# Configure the pass phrase gathering process.
# The filtering dialog program (`builtin' is an internal
# terminal dialog) has to provide the pass phrase on stdout.
SSLPassPhraseDialog builtin
# Inter-Process Session Cache:
# Configure the SSL Session Cache: First the mechanism
# to use and second the expiring timeout (in seconds).
#SSLSessionCache "dbm:logs/ssl_scache"
SSLSessionCache "shmcb:logs/ssl_scache(512000)"
SSLSessionCacheTimeout 300
NameVirtualHost *:443
SSLStrictSNIVHostCheck off
#第一個子域名www.survivalescaperooms.com主機配置
<VirtualHost _default_:443>
DocumentRoot "D:/www/"
ServerName www.survivalescaperooms.com:443
ServerAlias www.survivalescaperooms.com
ServerAdmin you@example.com
SSLEngine on
SSLProtocol all -SSLv2
SSLCipherSuite ALL:!DH:!EXPORT:!RC4:+HIGH:+MEDIUM:!aNULL:!eNULL
SSLCertificateFile "D:/UPUPW_AP/Apache2/conf/Apache/www.crt"
SSLCertificateKeyFile "D:/UPUPW_AP/Apache2/conf/Apache/www.key"
SSLCertificateChainFile "D:/UPUPW_AP/Apache2/conf/Apache/root_bundle.crt"
<FilesMatch "/.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory "D:/www/">
Options FollowSymLinks
AllowOverride All
Order allow,deny
Allow from all
</Directory>
</VirtualHost>
#第二個以down.vevb.com的主機配置，注意<VirtualHost *:443>這里與第一個主機不同但是和第三個主機相同。
<VirtualHost *:443>
DocumentRoot "D:/down"
ServerName down.vevb.com:443
ServerAlias down.vevb.com
ServerAdmin you@example.com
SSLEngine on
SSLProtocol all -SSLv2
SSLCipherSuite ALL:!DH:!EXPORT:!RC4:+HIGH:+MEDIUM:!aNULL:!eNULL
SSLCertificateFile "D:/UPUPW_AP/Apache2/conf/down/down.crt"
SSLCertificateKeyFile "D:/UPUPW_AP/Apache2/conf/down/down.key"
SSLCertificateChainFile "D:/UPUPW_AP/Apache2/conf/down/root_bundle2.crt"
<FilesMatch "/.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory "D:/down">
Options FollowSymLinks
AllowOverride All
Order allow,deny
Allow from all
</Directory>
</VirtualHost>
#第三個以bbs.vevb.com的主機配置，注意<VirtualHost *:443>這里與第一個主機不同但是和第二個主機相同。
<VirtualHost *:443>
DocumentRoot "D:/bbs"
ServerName bbs.vevb.com:443
ServerAlias bbs.vevb.com
ServerAdmin you@example.com
SSLEngine on
SSLProtocol all -SSLv2
SSLCipherSuite ALL:!DH:!EXPORT:!RC4:+HIGH:+MEDIUM:!aNULL:!eNULL
SSLCertificateFile "D:/UPUPW_AP/Apache2/conf/bbs/bbs.crt"
SSLCertificateKeyFile "D:/UPUPW_AP/Apache2/conf/bbs/bbs.key"
SSLCertificateChainFile "D:/UPUPW_AP/Apache2/conf/bbs/root_bundle3.crt"
<FilesMatch "/.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory "D:/bbs">
Options FollowSymLinks
AllowOverride All
Order allow,deny
Allow from all
</Directory>
</VirtualHost>
復制以上這段代碼到您的httpd-ssl.conf文件中并且修改響應的網站目錄和域名之后就可以使用了。。如果你只有一個主機或者兩個主機可以刪除<VirtualHost *:443>。。。。。</VirtualHost>的內容
同時不論是單主機還是多主機 都可以使用我給出的方法。。。。
按照推理，所有apache服務器都應該符合本教材，只是目錄結構的變化存在差異
