说明：这里是Linux服务综合搭建文章的一部分，本文可以作为自建CA搭建https网站的参考。
注意：这里所有的标题都是根据主要的文章（Linux基础服务搭建综合）的顺序来做的。
如果需要查看相关软件版本和主机配置要求，请根据目录自行查看。
Linux服务综合搭建的文章目录
====================================================
5、foundation通过Rsyslog搭建集中日志服务器
8、rhel7 JAVA web环境搭建（使用Tomcat8整合httpd）
10、foundation配置kerberos和NTP服务以及安全的NFS挂载
====================================================
主机角色说明
9、foundation自建CA实现HTTPS
自建CA，并且实现https网站，域名为www.mei.com。
注意，证书请求时要生成www.mei.com的证书。
9.1 自建CA并颁发证书给foundation主机
9.1.1 自建CA
[root@foundation CA]# touch /etc/pki/CA/index.txt [root@foundation CA]# echo "01" >/etc/pki/CA/serial
#生成私钥
[root@foundation CA]# openssl genrsa -out /etc/pki/CA/private/cakey.pem 2048 Generating RSA private key, 2048 bit long modulus
...................+++
..................+++
e is 65537 (0x10001) #CA自签
[root@foundation CA]# openssl req -new -x509 -key /etc/pki/CA/private/cakey.pem -days 7300 -out /etc/pki/CA/cacert.pem
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:chongqing
Locality Name (eg, city) [Default City]:yubei
Organization Name (eg, company) [Default Company Ltd]:mei
Organizational Unit Name (eg, section) []:ops
Common Name (eg, your name or your server's hostname) []:foundation.mei.com
Email Address []:mail.mei.com
9.1.2 生成证书请求并签发
#生成私钥
[root@foundation CA]# openssl genrsa -out /etc/pki/tls/private/server.key 2048
Generating RSA private key, 2048 bit long modulus
....................................+++
....................................+++
e is 65537 (0x10001) #生成证书请求，注意我们要签发的是www.mei.com这个域名的证书
[root@foundation CA]# openssl req -new -key /etc/pki/tls/private/server.key -days 365 -out /etc/pki/tls/server.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:chongqing
Locality Name (eg, city) [Default City]:yubei
Organization Name (eg, company) [Default Company Ltd]:mei
Organizational Unit Name (eg, section) []:ops
Common Name (eg, your name or your server's hostname) []:www.mei.com
Email Address []: Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []: #签发证书
[root@foundation CA]# openssl ca -in /etc/pki/tls/server.csr -out /etc/pki/tls/certs/server.crt -days 365
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 2 (0x2)
Validity
Not Before: Jul 9 21:10:35 2019 GMT
Not After : Jul 8 21:10:35 2020 GMT
Subject:
countryName = cn
stateOrProvinceName = chongqing
organizationName = mei
organizationalUnitName = ops
commonName = www.mei.com
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
DB:0D:93:04:A2:A4:F4:AC:3D:24:0C:FF:00:8C:3E:23:15:66:20:1E
X509v3 Authority Key Identifier:
keyid:BB:E6:BE:EA:5A:9E:C6:1A:29:65:48:09:DB:4F:EE:36:AD:95:E5:2B Certificate is to be certified until Jul 8 21:10:35 2020 GMT (365 days)
Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
9.2 搭建HTTPS网站
这是使用8008端口作为网站端口，然后做网站重定向到https。
如果要做把PHP作为https发布，可以直接在打完LAMP环境后将PHP相关网页直接拷贝到https所在的站目录下，然后做重定向即可。
9.2.1 安装软件包和配置防火墙
1 [root@foundation CA]# yum install mod_ssl
2
3 [root@foundation CA]# firewall-cmd --permanent --add-service=https && firewall-cmd --reload
4
5 [root@foundation html]# firewall-cmd --permanent --add-port=8008/tcp --add-port=8008/udp
6 success
7 [root@foundation html]# firewall-cmd --reload
9.2.2 创建网站目录和生成相应的网页内容
创建网站目录
至于网站目录SELinux相关的问题由于前面配置时讲过，这里就不赘述了。
下面的index.html中的内容为字串：test
所有有关PHP的文件都是我从以前配置LAMP时的测试文件。如果仅仅是自己搭建一个PHP网站，可以自己写PHP测试文件的内容。
9.2.3 创建虚拟主机并做好配置
[root@foundation /]# cat /etc/httpd/conf.d/httpswww.conf
<VirtualHost *:443>
DocumentRoot "/web/www/httpswww/html"
ServerName www.mei.com
SSLEngine on
SSLProtocol all -SSLv2
SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
SSLCertificateFile /etc/pki/tls/certs/server.crt
SSLCertificateKeyFile /etc/pki/tls/private/server.key
<Directory /web/www>
AllowOverride None
Require all granted
</Directory>
<Directory /web/www/httpswww/html>
AllowOverride None
Require all granted
</Directory>
ErrorLog "logs/httpswww_error.log"
CustomLog "logs/httpswww_access.log" combined
</VirtualHost>
<VirtualHost *:8008>
ServerName www.mei.com
RewriteEngine On #开启重写引擎
#RewriteRule ^(/.*)$ https://%{HTTP_POST}$1 [redirect=301]
RewriteCond %{SERVER_PORT} !^443$ #重写
RewriteRule ^(.*)?$ https://%{SERVER_NAME}$1 [R=301,L] #重写的策略
</VirtualHost>
.3 测试
拷贝foundation中的CA证书到rhel7主机，可以把证书放到网站上*下载，这里就不做了，直接使用scp拷贝。
[root@foundation CA]# scp /etc/pki/CA/cacert.pem foundation@rhel7.mei.com:/home/foundation/
打开Firefox添加证书
选择import后找到刚才拷过来的证书文件双击，来到下面的界面，勾选一下选项。
输入http地址访问
看到下面的效果，并显示是https且证书安全，说明成功！
再测试一下我们的PHP内容：
能够跳到https，并且证书安全。
点击select能够正确查询到数据库中的内容，并显示证书是安全的，同时还是https
最后希望大家提意见、转发、评论和交流！！！