制作证书：

生成三个证书 server.crt 、server-ca.crt、server.key

安装openssl

tar -xzvf openssl-1.0.2h.tar.gz

cd openssl-1.0.2h

./config -fPIC enable-shared

make depend

make && make install

make clean && make distclean

#openssl类库做软连接

ln -s /usr/local/ssl//lib/*.so.* /usr/lib64

ln -s /usr/local/ssl//lib/*.so.* /usr/lib

安装apache

apache依赖包安装不详细说明，

tar xvzf httpd-2.4.18.tar.gz

cd httpd-2.4.18

./configure \

--prefix=/usr/local/cp-httpd-2.4.18 \

--with-apr=/usr/local/cp-apr-1.5.2 \

--with-apr-util=/usr/local/cp-apr-util-1.5.4 \

--with-apr-iconv=/usr/local/cp-apr-iconv-1.2.1 \

--with-ssl=/usr/local/ssl \

--enable-so \

--enable-ssl \

--enable-mods-shared=all \

--enable-cache \

--enable-disk-cache \

--enable-file-cache \

--enable-mem-cache

make && make install

make clean && make distclean

配置apache的ssl

httpd.conf中配置

#启用ssl模块

sed -i 's:#LoadModule ssl_module modules/mod_ssl.so:LoadModule ssl_module modules/mod_ssl.so:' /usr/local/httpd/conf/httpd.conf

sed -i 's:#LoadModule socache_shmcb_module modules/mod_socache_shmcb.so:LoadModule socache_shmcb_module modules/mod_socache_shmcb.so:' /usr/local/httpd/conf/httpd.conf

sed -i 's:#Include conf/extra/httpd-ssl.conf:Include conf/extra/httpd-ssl.conf:' /usr/local/httpd/conf/httpd.conf

httpd-ssl.conf配置

sed -i 's:#SSLCertificateChainFile "/usr/local/httpd/conf/server-ca.crt":SSLCertificateChainFile "/usr/local/httpd/conf/server-ca.crt":' /usr/local/httpd/conf/extra/httpd-ssl.conf

拷贝server.crt 、server-ca.crt、server.key到/usr/local/httpd/conf目录下

apache结合openssl安装过程中出现的错误

1、apache错误提示libz.a: could not read symbols: Bad value”

重新安装openssl 加上-fPIC和enable-shared参数

./config -fPIC --prefix=/usr/local/openssl1.0.1 enable-shared

2、apache的httpd.conf缺乏LoadModule ssl_module modules/mod_ssl.so解决方法

原因是上一次编译的缓存存，需要清除掉才能重新生成执行

make clean && make distclean

3、httpd: Syntax error on line 129 of /usr/local/cp-httpd-2.4.18/conf/httpd.conf: Cannot load modules/mod_ssl.so into server: libssl.so.1.0.0: cannot open shared object file: No such file or directory

ln -s /usr/local/ssl/lib/*.so /usr/lib64

ln -s /usr/local/ssl//lib/*.so.* /usr/lib

这个问题比较奇怪，命名在httpd安装中指定了--enable-ssl和--with-ssl=/usr/local/openssl/还是无法生效，httpd只在/usr/lib64查找libssl.so.1.0.0，因此需要做个软连接处理。

配置rewrite规则实现访问http自动跳转到https

实现方法是定义一个.htaccess放在httdocs中，内容为：

Options +FollowSymlinks

RewriteEngine On

RewriteCond %{SERVER_PORT} !^443$

RewriteRule ^.*$ https://%{SERVER_NAME}%{REQUEST_URI} [L,R]

RewriteCond %{REQUEST_FILENAME} !-d

RewriteCond %{REQUEST_FILENAME} !-f

RewriteRule ^(.*)$ index.php/$1 [QSA,PT,L]

ErrorDocument 404 /404.html

ErrorDocument 403 /404.html

特别说明：

apache重新编译不会覆盖原有的httpd.conf文件，因此如果原有没有编译ssl的话，httpd.conf中必须手工加上mod_ssl.so模块配置