[TOC] ## 配置 > [參考文檔](https://blog.csdn.net/wlmnzf/article/details/50244409) ### httpd.conf 取消注釋 ``` #LoadModule ssl_module modules/mod_ssl.so #Include conf/extra/httpd-mpm.conf #Include conf/extra/httpd-ssl.conf ``` ### httpd-ssl.conf 取消注釋 ``` SSLCertificateFile "c:/Apache24/conf/server.crt" SSLCertificateKeyFile "c:/Apache24/conf/server.key" SSLCACertificateFile "c:/Apache24/conf/ca.crt" SSLVerifyClient require SSLVerifyDepth 1 SSLEngine on ``` ### 生成證書 ``` #生成服務器端的私鑰(key文件) set OPENSSL_CONF=openssl.cnf openssl genrsa -des3 -out server.key 1024 # 生成server.csr openssl req -new -key server.key -out server.csr -config openssl.cnf # 對客戶端也作同樣的命令生成key及csr文件 openssl genrsa -des3 -out client.key 1024 openssl req -new -key client.key -out client.csr -config openssl.cnf # 生成ca證書 openssl req -new -x509 -keyout ca.key -out ca.crt -config openssl.cnf ``` 創建文件 ``` 在bin目錄下新建一個demoCA文件夾，進入它 新建newcerts文件夾，不需要進入 新建index.txt 新建serial，打開后輸入01保存即可 ``` ``` # 用生成的CA的證書為剛才生成的server.csr,client.csr文件簽名 openssl ca -in server.csr -out server.crt -cert ca.crt -keyfile ca.key -config openssl.cnf openssl ca -in client.csr -out client.crt -cert ca.crt -keyfile ca.key -config openssl.cnf ``` 第二條指令出現錯誤，進入demoCA，然后打開index.txt.attr，把它修改成`unique_subject = no`就可以了 生成一個ca.pfx,導入`打開IE瀏覽器-》工具-》Internet選項-》內容-》證書` `openssl pkcs12 -export -in ca.crt -inkey ca.key -out ca.pfx` ### 配置站點 ``` DocumentRoot "../your_htdocs" <Directory "../your_htdocs"> Options FollowSymLinks AllowOverride All Require all granted </Directory> ``` ## 錯誤 ### The commonName field needed to be supplied and was missing 修改 `openssl.cnf` ``` commonName = supplied //改為 commonName = optional ``` ### 2.SSLPassPhraseDialog builtin is not supported on Win32(key file C:/Apache24/conf/server.key) Windows不支持加密密鑰 `openssl rsa -in server.key -out server.key ` 直接替換server.key 即可,無需重新走流程 ### client denied by server configuration 配置文件