ssl - 如何安装: OpenSSL + WAMP

Question

这里有人有关于如何在我的本地开发机器上获取 SSL 的清晰详细的步骤吗？我已经在 c:\wamp 上安装了最新版本的 WAMP (2.2c)。我在网上找到的说明在大多数情况下似乎已经过时，并且缺乏正确完成工作所需的详细信息。

Answer 1

指南:WampServer 2.5 中的 Openssl

先决条件:通常不需要安装 openssl(它与 Wamp 捆绑在一起)。例如 Apache 2.4.9 包括 1.0.1g。

系统变量:

• 打开 Windows 系统面板(“WIN+Q”搜索:system)> 高级系统设置 > 高级 > 环境变量
• 在系统变量中添加一个名为 OPENSSL_CONF 的新条目，其值为 openssl.cnf 的路径(通常类似于 C:\wamp\bin\apache\apache2.4.9\conf\openssl.cnf)

openssl 文件夹结构:

• 在 C:\wamp\bin\apache\apache#.#.#\conf 中创建以下文件夹结构:

  ..demoCA|-----certs|-----crl|-----newcerts|-----private

Configuring openssl.cnf:

• I've followed Neil C. Obremski advice and cleared the following defaults:
  • countryName_default (was "AU")
  • stateOrProvinceName_default (was "Some-State")
  • 0.organizationName_default (was "Internet Widgits Pty Ltd")
  • organizationalUnitName_default (was already empty)

Creating the certificate:

• From command line browse to C:\wamp\bin\apache\apache#.#.#\bin\ and call "openssl req -new -out cacert.csr -keyout cacert.pem". If prompted enter a password and after that the DN informations like below.

  Loading 'screen' into random state - doneGenerating a 1024 bit RSA private key.......................++++++....++++++writing new private key to 'cacert.pem'Enter PEM pass phrase: my_secret_passVerifying - Enter PEM pass phrase: my_secret_pass`-----You are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank.`-----Country Name (2 letter code) []:State or Province Name (full name) []:Locality Name (eg, city) []:Organization Name (eg, company) []:Organizational Unit Name (eg, section) []:Common Name (e.g. server FQDN or YOUR name) []:localEmail Address []:Please enter the following 'extra' attributesto be sent with your certificate requestA challenge password []:An optional company name []:C:\wamp\bin\apache\apache2.4.9\bin>

• In the same console window now use "openssl rsa -in cacert.pem -out cacert.key" and if asked enter the password previously entered.

  Enter pass phrase for cacert.pem: my_secret_passwriting RSA key

• Remove the ".rnd" file in C:\wamp\bin\apache\apache2.4.9\bin

• Still in the same window call "openssl x509 -in cacert.csr -out cacert.cert -req -signkey cacert.key -days 365". If you experience the following error "unable to write 'random state'". This is a known bug! To workaround this call "set RANDFILE=.rnd" and retry the previous command.

Congrats you are now the owner of a self signed certificate!

I've placed the built files (they are currently in bin folder) according this Site:

• cacert.pem, cacert.key in C:\wamp\bin\apache\apache#.#.#\conf\demoCA\private
• cacert.cert, cacert.csr in C:\wamp\bin\apache\apache#.#.#\conf\demoCA\certs

In httpd.conf enable SLL (search for "#Include conf/extra/httpd-ssl.conf") + alter the following entries in httpd-ssl.conf:

SSLSessionCache        "shmcb:C:/wamp/logs/ssl_scache(512000)"
DocumentRoot "C:/wamp/www"
#ErrorLog
#TransferLog
SSLCertificateFile "C:/wamp/bin/apache/apache2.4.9/conf/demoCA/certs/cacert.cert"
SSLCertificateKeyFile "C:/wamp/bin/apache/apache2.4.9/conf/demoCA/private/cacert.key"
CustomLog "C:/wamp/logs/ssl_request.log" \

现在通过调用 httpd -t 测试您的 Apache 安装。如果您收到以下错误“SSLSessionCache:不支持‘shmcb’ session 缓存(已知名称:)。也许您需要加载适当的 socache 模块(mod_socache_shmcb？)。”在 httpd.conf 中启用以下条目“LoadModule socache_shmcb_module modules/mod_socache_shmcb.so”

Wamp 现在配置了 https 支持:-)

我还在 httpd.conf 中使用以下配置启用了“LoadModule status_module modules/mod_status.so”:

<IfModule status_module>

ExtendedStatus On
<Location /server-status>
    SetHandler server-status
</Location>

</IfModule>

您现在可以在这里检查您的服务器状态

https://localhost/server-status/

Apache/2.4.9 (Win64) OpenSSL/1.0.1g PHP/5.5.12 服务器在 localhost 端口 443

注意事项:

• 我在尝试让它在我的机器上运行时制作了这个教程(这是我第一次尝试在 windows/wamp 上使用 OpenSSL)。
• 本指南不适用于生产系统!
• 您可能需要根据您的 openssl.cnf 更改一些内容，例如名称
• 我的目的不是制作最好的教程，而是简单地记下让 SSL 在 WAMP 中工作所需的所有更改。
• 确保为您的 x509 证书设置正确的天数
• 我终于知道为什么 NSA 可以通过如此复杂的过程轻松侵入服务器:D
• 由于 Wamp 将 apache 与 OpenSSL 捆绑在一起，因此单独安装它可能更好？