[PHP] 利用Openssl實作ssl網頁加密－Foxbrush

From: http://joe01032002.pixnet.net/blog/post/92665237-%E3%80%90php%E3%80%91%E5%88%A9%E7%94%A8openssl%E5%AF%A6%E4%BD%9Cssl%E7%B6%B2%E9%A0%81%E5%8A%A0%E5%AF%86

--------------------------------------------------------

一般的網頁伺服器架設起來之後

往往都是沒有作加密的動作

在網際網路的傳輸上都是以明碼做傳輸

以下為利用wireshark擷取封包實例

noly80-1

此為80port且為加密的網頁傳輸情形

可以看到完全都是明碼

443nossl-2

而此為將網頁的通訊port改為443而未做ssl加密傳輸情形

可以看到只有port轉向443輸出，仍然是明碼傳輸

ssl加密-1

而此為利用openssl製做加密憑證來進行ssl加密

可以看到傳輸都是利用編碼加密過的方式來做加密

在此可以看出來是得實做ssl加密才會稍微安全一點

單單轉換傳輸的port到443不會有加密的效果

而實做的方式如下

至appserv官方網站下載appserv

安裝過程就不贅述，完成後可看到此畫面

開啟C:\AppServ\Apache2.2\conf內的httpd.conf

將LoadModule ssl_module modules/mod_ssl.so這行前面的#註解拿掉並存檔

接著可在C:\AppServ\Apache2.2\bin資料夾底下看見openssl.exe

開啟後輸入genrsa -out server.key 1024產生rsa私鑰

輸入req -new -out server.csr -key server.key -config ../conf/openssl.cnf產生簽署申請

Country Name為國籍鍵入TW

State or Province Name為省份鍵入Taiwan

Locality Name為所在地

Organization Name為組織名稱

Organizational Unit Name為組織內單位

Common Name為domain name

Email Address為管理者的電子信箱

剩餘兩項可不填入

鍵入genrsa -out ca.key 1024產生ca的rsa私鑰

鍵入req -new -x509 -days 365 -key ca.key -out ca.crt -config ../conf/openssl.cnf利用ca私鑰產生簽署憑證

下面的參數同上面設定

接著於C:\AppServ\Apache2.2\bin資料夾內新建demoCA資料夾

接著於demoCA資料夾內新增newcerts資料夾與index.txt跟serial檔案

並利用記事本開啟serial後鍵入01後存檔

利用ca替網站簽署認證

鍵入ca -in server.csr -out server.crt -cert ca.crt -keyfile ca.key -config ../conf/openssl.cnf

接著將C:\AppServ\Apache2.2\bin底下的server.crt與server.key兩個檔案

複製至C:\AppServ\Apache2.2\conf資料夾底下

接著於httpd.conf內新增此兩行

#Virtual host with SSL

Include C:\Appserv\Apache2.2\conf\extra\http-vhost-ssl.conf

並存檔

並於C:\Appserv\Apache2.2\conf\extra\內新增http-vhost-ssl.conf檔案

輸入以下內容：

## SSL Global Context
#
# When we also provide SSL we have to listen to the
# standard HTTP port (see above) and to the HTTPS port
#
# Note: Configurations that use IPv6 but not IPv4-mapped addresses need two
# Listen directives: "Listen [::]:443" and "Listen 0.0.0.0:443"
#
Listen 443
##
## SSL Global Context
##
## All SSL configuration in this context applies both to
## the main server and all SSL-enabled virtual hosts.
##
#
# Some MIME-types for downloading Certificates and CRLs
#
AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl .crl
# Pass Phrase Dialog:
# Configure the pass phrase gathering process.
# The filtering dialog program (`builtin' is a internal
# terminal dialog) has to provide the pass phrase on stdout.
#SSLPassPhraseDialog builtin
# Inter-Process Session Cache:
# Configure the SSL Session Cache: First the mechanism
# to use and second the expiring timeout (in seconds).
#SSLSessionCache "dbm:/usr/local/apache/logs/ssl_scache"
#SSLSessionCache "shmcb:/usr/local/apache/logs/ssl_scache(512000)"
#SSLSessionCacheTimeout 300
# Semaphore:
# Configure the path to the mutual exclusion semaphore the
# SSL engine uses internally for inter-process synchronization.
#SSLMutex "file:/usr/local/apache/logs/ssl_mutex"

# Virtual Hosts
NameVirtualHost *:80
NameVirtualHost *:443
ServerAdmin xxx@gmail.com <---電子信箱
DocumentRoot "C:\AppServ\www" <---網站根目錄
ServerName xxx.xxx.org <---網站domain

# Secure Shell ver.
ServerAdmin xxx@gmail.com <---電子信箱
DocumentRoot "C:\AppServ\www" <---網站根目錄
ServerName xxx.xxx.org:443 <---網站domain
#SSL Engine Switch:
#Enable/Disable SSL for this virtual host.
SSLEngine on
# Server Private Key:
# If the key is not combined with the certificate, use this
# directive to point at the key file. Keep in mind that if
# you've both a RSA and a DSA private key you can configure
# both in parallel (to also allow the use of DSA ciphers, etc.)
SSLCertificateFile C:\AppServ\Apache2.2\conf\server.crt <---server.crt路徑
SSLCertificateKeyFile C:\AppServ\Apache2.2\conf\server.key <---server.key路徑

然後存檔

接著重新啟動Apache伺服器