模板
教程
環境
性能
功能
管理
apache2整合weblogic 虛擬主機下的ssl配置
分四部分
1。應用目標和環境
2。apache2 weblogic openssl安裝
3。虛擬主機的配置
4。補遺或注解
一. 應用目標和環境
應用目標
1。jsp支持的webserver，只有一個ip,多個虛擬主機，其中有一個支持ssl的虛擬主機。
應用環境
1. os 為 solaris 9 和建議補丁
2. weblogic為8.1sp4 ，java為 1.4.1_06-b01
3. OpenSSL 0.9.7g
4. apache 2.0.54
二. apache2 weblogic openssl安裝
1. apache 2.0.54的安裝
略
2. weblogic 8.1 sp4的安裝
略
3. openssl的安裝
略
三. 虛擬主機的配置
1. 需要配置的虛擬主機
www 網站
bbs 論壇
diy 后臺及個人管理維護平臺
ssl 提供https傳輸的虛擬主機
2. 虛擬主機使用的ip
192.168.1.254
3. httpd.conf中的相關配置
......
ServerName [url]www.testmysite.com.cn[/url]
ServerRoot "/usr/local/apache2"
Listen 80
<IfDefine SSL>
LoadModule ssl_module modules/mod_ssl.so
</IfDefine>
# support weblogic
LoadModule weblogic_module modules/mod_wl_20.so
#
# load ssl.conf
<IfModule mod_ssl.c>
Include conf/ssl.conf
</IfModule>
#
# load VirtualHost
Include "conf/vhost.conf"
#
......
SSLRandomSeed connect builtin
<IfDefine SSL>
#
Listen 443
#
AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl .crl
#
SSLPassPhraseDialog builtin
#
SSLMutex default
</IfDefine>
#
NameVirtualHost 192.168.1.254:80
#
# Section 1: http virtualhost
<VirtualHost 192.168.1.254:80>
ServerAdmin [email]webmaster@testmysite.com[/email]
DocumentRoot "/web/webapp"
ServerName [url]www.testmysite.com[/url]
ErrorLog logs/testmysite-error_log
AddType application/x-httpd-php .php
AddType text/html .shtml
CustomLog logs/testmysite-access_log combined
TransferLog logs/testmysite-access_log
<IfModule mod_weblogic.c>
WebLogicHost 192.168.1.254
WebLogicPort 7001
MatchExpression *.jsp
MatchExpression *.do
MatchExpression *.jspa
MatchExpression /myhome/*
</IfModule>
<Directory "/web/webapp">
#php_flag engine on
Options FollowSymLinks MultiViews Includes
AddOutputFilter Includes .shtml
AddOutputFilter Includes .php
AllowOverride None
Allow from all
</Directory>
<Directory "/web/webapp/WEB-INF">
Order deny,allow
Deny from all
</Directory>
</VirtualHost>
<VirtualHost 192.168.1.254:80>
ServerAdmin [email]webmaster@testmysite.com[/email]
DocumentRoot "/web/bbs"
ServerName bbs.testmysite.com
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
CustomLog logs/bbs-access_log combined
ServerName bbs.testmysite.com
ServerAlias diy
ErrorLog logs/bbs-error_log
TransferLog logs/bbs-access_log
<IfModule mod_weblogic.c>
WebLogicHost 192.168.1.254
WebLogicPort 7001
MatchExpression *.jsp
MatchExpression *.jspa
MatchExpression *.do
</IfModule>
<Directory "/web/bbs">
Options FollowSymLinks MultiViews Includes
AddOutputFilter Includes html
AllowOverride None
Allow from all
</Directory>
<Directory "/web/bbs/WEB-INF">
Order deny,allow
Deny from all
</Directory>
</VirtualHost>
<VirtualHost 192.168.1.254:80>
ServerAdmin [email]webmaster@testmysite.com[/email]
DocumentRoot "/web/diy"
ServerName diy.testmysite.com
ErrorLog logs/diy-error_log
TransferLog logs/diy-access_log
<IfModule mod_weblogic.c>
WebLogicHost 192.168.1.254
WebLogicPort 7001
MatchExpression *.jsp
MatchExpression *.jspa
MatchExpression *.do
</IfModule>
<Directory "/web/diy">
Options FollowSymLinks MultiViews Includes
AddOutputFilter Includes html
AllowOverride None
Allow from all
</Directory>
<Directory "/web/diy/WEB-INF">
Order deny,allow
Deny from all
</Directory>
</VirtualHost>
# Section 2: https VirtualHost
<VirtualHost 192.168.1.254:443>
ServerName ssl.testmysite.com
DocumentRoot "/web/ssl"
CustomLog logs/ssl-access_log common
SSLEngine on
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
SSLCertificateFile conf/ssl.crt/server.crt
SSLCertificateKeyFile conf/ssl.key/server.key
<Files ~ "\.(cgi|shtml|phtml|php3?)$">
SSLOptions +StdEnvVars
</Files>
<Directory "/web/ssl">
SSLOptions +StdEnvVars
</Directory>
SetEnvIf User-Agent ".*MSIE.*" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
<IfModule mod_weblogic.c>
WebLogicHost 192.168.1.254
WebLogicPort 7001
MatchExpression *.jsp
MatchExpression *.do
MatchExpression *.jspa
MatchExpression /myhome/*
</IfModule>
<Directory "/web/ssl">
Options FollowSymLinks MultiViews Includes
AddOutputFilter Includes .shtml
AddOutputFilter Includes .php
AllowOverride None
Allow from all
</Directory>
<Directory "/web/webapp/WEB-INF">
Order deny,allow
Deny from all
</Directory>
</VirtualHost>
6.1 SSLEngine on
在虛擬主機中打開ssl支持,默認主服務主機和虛擬主機是禁用的。
6.2 SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
ssl協議握手協商時使用的密碼簇，支持所有握手密碼
6.3 SSLCertificateFile conf/ssl.crt/server.crt
服務器端PEM-encoded X.509認證文件
6.4 SSLCertificateKeyFile conf/ssl.key/server.key
服務器端PEM-encoded私匙文件
6.5 SSLOptions +StdEnvVars
配置各種運行時的SSL引擎選項， +StdEnvVars創建SSL與CGI&SSI相關的變量，僅用在CGI和SSI的頁面中。
四. 補遺或注解
1. 認證文件的認證方式
本例中采用的自認證的方式，就是說沒有去購買證書，如果是商業站點可以考慮購買證書。
2. 自認證文件的生成
a. 生成private Key文件
openssl genrsa -des3 -out server.key 1024
b. 創建服務器端的認證文件
openssl req -new -x509 -nodes -sha1 -days 365 -key server.key -out server.crt
在提示輸入common name的時候輸入域名：www.testmysite.com
c. 按照vhost.conf中的配置，存放b步驟中創建的文件
3. apache的啟動和關閉方式（SSL）
3.1 啟動
./apachectl startssl
會提示輸入創建server.key時的密碼，輸入正確才能啟動
3.2 關閉
./apachectl stop
3.3 為了測試方便可以關閉啟動時輸入密碼
a. 修改vhost.conf
#SSLCertificateKeyFile conf/ssl.key/server.key
SSLCertificateKeyFile conf/ssl.key/server.key.unsecure
b. server.key.unsecure的生成
openssl rsa -in server.key -out server.key.unsecure
4. ssl僅支持基于ip的虛擬主機
原文轉自：http://www.anti-gravitydesign.com
