https环境

2020-04-17  本文已影响0人  16325

开发中的一个需求，需要https环境中测试。原来开发环境只有一个jboss。
生产环境有F5，在F5上配置的证书，并卸载证书，F5后边是apache-jboss。到apache的时候已经是http请求了，所以开发环境也要经过两次跳转。开发环境使用nginx-apache-jboss这种结构。nginx上配置证书。

安装nginx

一、安装编译工具及库文件

yum -y install make zlib zlib-devel gcc-c++ libtool openssl openssl-devel

二、首先要安装 PCRE

pcre-config --version

./configure
make && make install

三、安装nginx

./configure --prefix=/usr/local/webserver/nginx --with-http_stub_status_module --with-http_ssl_module --with-pcre=/usr/local/src/pcre-8.35
make
make install

/usr/local/webserver/nginx/sbin/nginx -v

四、Nginx 配置
openssl genrsa -out server.key 4096
openssl req -new -key server.key -out server.csr
按提示输入一系列的参数
Country Name (2 letter code) [AU]:CN ISO国家代码（只支持两位字符） 
State or Province Name (full name) [Some-State]:XX所在省份 
Locality Name (eg, city) []:XX所在城市
Organization Name (eg, company):XXXXX公司名称
Organizational Unit Name (eg, section) []:XXXXX组织名称
Common Name (eg, YOUR name) []:[X](http://kedou.com/)XX申请证书的域名 
Email Address []:admin@[admin.com](http://admin.com/) 管理员邮箱
Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: 交换密钥
An optional company name []: 

注：Common Name必须(?)和httpd.conf中server name必须一致，否则apache不能(?)启动 （启动apache时错误提示为：RSA server certificate CommonName (CN) `Kedou' does NOT match server name!? ）

openssl req -x509 -days 3650 -key server.key -in server.csr -out server.crt

方法二：

openssl genrsa -out ca.key 4096
openssl req -new -x509 -days 3650 -key ca.key -out ca.crt
openssl genrsa -out server.key 4096
openssl req -new -out server.csr -key server.key
按提示输入一系列的参数
Country Name (2 letter code) [AU]:CN ISO国家代码（只支持两位字符） 
State or Province Name (full name) [Some-State]:XX所在省份 
Locality Name (eg, city) []:XX所在城市
Organization Name (eg, company):XXXXX公司名称
Organizational Unit Name (eg, section) []:XXXXX组织名称
Common Name (eg, YOUR name) []:[X](http://kedou.com/)XX申请证书的域名 
Email Address []:admin@[admin.com](http://admin.com/) 管理员邮箱
Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: 交换密钥
An optional company name []: 
openssl ca -in server.csr -out server.crt -cert ca.crt -keyfile ca.key

查看conf目录下是否正常生成了server.key server.csr server.crt三个文件
以上两种方式本质上是一样的，都是自己充当认证服务器，完成证书认证得到自签名的证书，可以认为方法一是方法二的简写方式。

http {
   server {
        listen       80;
        server_name  dev.test.com 10.221.10.1;
        return 302 https://$server_name$request_uri;
   }
    # HTTPS server
    server {
        listen       443 ssl;
        server_name  10.221.10.1 dev.test.com;
        ssl_certificate      /opt/app/nginx-1.16.1/certs/current/server.crt;
        ssl_certificate_key  /opt/app/nginx-1.16.1/certs/current/server.key;
        location /busi/ {
           proxy_pass http://10.221.10.2:80$request_uri;
           proxy_redirect http://10.221.10.2 https://dev.test.com;
        }
        location /cas/ {
            proxy_pass http://10.221.10.2:80$request_uri;
            proxy_redirect http://10.221.10.2 https://dev.test.com;
        }
      }
}

以上，将/busi 和 /cas的请求都转发到apache（10.221.10.2）身上。

    proxy_connect_timeout   300;
    proxy_send_timeout      300;
    proxy_read_timeout      300;
    proxy_buffer_size       16k;
    proxy_buffers           4 64k;
    proxy_busy_buffers_size 128k;
    proxy_temp_file_write_size 128k;
五、Nginx 启动

/usr/local/webserver/nginx/sbin/nginx

/usr/local/webserver/nginx/sbin/nginx -s reload # 重新载入配置文件
/usr/local/webserver/nginx/sbin/nginx -s reopen # 重启 Nginx
/usr/local/webserver/nginx/sbin/nginx -s stop # 停止 Nginx

安装apache

一、安装必须软件
二、安装apache

./configure --prefix=/usr/local/apache2 --with-apr=/usr/local/apr/ --with-apr-util=/usr/local/apr/ --with-pcre=/usr/local/pcre-8.36

三、配置apache
<VirtualHost *:80>
    DocumentRoot "/DATA/httpd-2.2.34/htdocs"
    ServerName 10.221.10.2
    DirectoryIndex /test/index.html
   <Directory "/webdocs">
    AllowOverride None
    Options None
    Order allow,deny
    Allow from all
   </Directory>
</VirtualHost>

LoadModule proxy_ajp_module modules/proxy/mod_proxy_ajp.so
LoadModule advertise_module modules/mod_cluster/mod_advertise.so
LoadModule manager_module modules/mod_cluster/mod_manager.so
LoadModule slotmem_module modules/mod_cluster/mod_slotmem.so
LoadModule proxy_cluster_module modules/mod_cluster/mod_proxy_cluster.so

# MOD_CLUSTER_ADDS
# Adjust to you hostname and subnet.
<IfModule manager_module>
  Listen 10.221.10.2:6666
  NameVirtualHost 10.221.10.2:6666
  ManagerBalancerName myCluster
  Maxcontext 300
  Maxnode 100
  Maxhost 100
  <VirtualHost 10.221.10.2:6666>
    <Directory />
     Order deny,allow
     Deny from all
     Allow from 10.221
     Allow from 172.29
    </Directory>
    KeepAliveTimeout 300
    MaxKeepAliveRequests 0
    ServerAdvertise off
    #ServerAdvertise on http://@IP@:6666
    #AdvertiseFrequency 5
    #AdvertiseSecurityKey secret
    #AdvertiseGroup @ADVIP@:23364
    EnableMCPMReceive

    <Location /mod_cluster_manager>
       SetHandler mod_cluster-manager
       AuthType Basic
       AuthName "MCM"
       AuthUserFile /etc/modclusterpassword
       Require user admin
       Order deny,allow
       Deny from all
       Allow from 10.221
       Allow from 127.0.0.1
    </Location>

  </VirtualHost>
</IfModule>

安装jboss

一、下载安装
二、配置jboss

-Djboss.mod_cluster.proxyList=10.221.10.2:6666

程序访问限制

keytool -import -keystore "/opt/app/jboss-eap-6.4/jdk1.8.0_144/jre/lib/security/cacerts" -file ./server.crt -alias mycas -trustcacerts

可能要求输入密码，默认密码是: changeit

总结

上一篇下一篇

猜你喜欢

热点阅读