# cd /etc/httpd/conf.d/
# diff /etc/httpd/conf.d/ssl.conf /etc/httpd/conf.d/ssl.conf.org
Result:
105,106c105
< #SSLCertificateFile /etc/pki/tls/certs/localhost.crt
< SSLCertificateFile /etc/pki/tls/certs/ca.crt
---
> SSLCertificateFile /etc/pki/tls/certs/localhost.crt
113,114c112
< #SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
< SSLCertificateKeyFile /etc/pki/tls/private/ca.key
---
> SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
Command:
Result:
Generating RSA private key, 2048 bit long modulus
........................................................................................+++
..........+++
e is 65537 (0x10001)
Command:
# sudo openssl req -new -key ca.key -out ca.csr
Result:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]: US
State or Province Name (full name) []: SOMEWHERE1
Locality Name (eg, city) [Default City]: SOMEWHERE2
Organization Name (eg, company) [Default Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []: www.myserver.com
Email Address []:admin@myserver.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []: PASSWORD
An optional company name []:
Command:
# sudo openssl x509 -req -days 365 -in ca.csr -signkey ca.key -out ca.crt
Result:
Signature ok
subject=/C=US/ST=SOMEWHERE1/L=SOMEWHERE2/O=Default Company Ltd/CN=www.myserver.com/emailAddress=admin@myserver.com
Getting Private key
Command:
# sudo cp ca.crt /etc/pki/tls/certs
# sudo cp ca.key /etc/pki/tls/private/ca.key
# sudo cp ca.csr /etc/pki/tls/private/ca.csr
Command:
# diff /etc/httpd/conf.d/ssl.conf /etc/httpd/conf.d/ssl.conf.org
Result:
105,106c105
< #SSLCertificateFile /etc/pki/tls/certs/localhost.crt
< SSLCertificateFile /etc/pki/tls/certs/ca.crt
---
> SSLCertificateFile /etc/pki/tls/certs/localhost.crt
113,114c112
< #SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
< SSLCertificateKeyFile /etc/pki/tls/private/ca.key
---
> SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
Command:
# apachectl restart
Result:
[Fri Sep 01 05:21:33 2017] [warn] module ssl_module is already loaded, skipping
Command:
# sudo mkdir -p /var/www/html/ssl
# sudo mkdir -p /etc/httpd/sites-available
# sudo mkdir -p /etc/httpd/sites-enabled
# apachectl restart
# vi httpd.conf
# diff httpd.conf httpd.conf.bkup20170901
Result:
217d216
< #LoadModule ssl_module modules/mod_ssl.so
1012,1021d1010
<
< #Listen 443
< #<VirtualHost *:443>
< # ServerName www.myserver.com
< # SSLEngine on
< # SSLCertificateFile "/path/to/www.example.com.cert"
< # SSLCertificateKeyFile "/path/to/www.example.com.key"
< #</VirtualHost>
<
< IncludeOptional sites-enabled/*.conf
Command:
# cat ssl.conf
Result:
<VirtualHost *:443>
ServerAdmin admin@myserver.com
DocumentRoot "/var/www/html/ssl/"
ServerName Myserver
ServerAlias myserver
ErrorLog /var/www/html/ssl/error.log
<Directory "/var/www/html/ssl/">
DirectoryIndex index.html index.php
Options FollowSymLinks
AllowOverride All
Require all granted
</Directory>
</VirtualHost>
Command:
# sudo ln -s /etc/httpd/sites-available/ssl.conf /etc/httpd/sites-enabled/ssl.conf
# apachectl restart
Result:
apachectl: Configuration syntax error, will not run "restart":
Syntax error on line 1021 of /etc/httpd/conf/httpd.conf:
Invalid command 'IncludeOptional', perhaps misspelled or defined by a module not included in the server configuration
Command:
# diff httpd.conf httpd.conf.bkup20170901
Result:
217d216
< #LoadModule ssl_module modules/mod_ssl.so
1012,1021d1010
<
< #Listen 443
< #<VirtualHost *:443>
< # ServerName www.myserver.com
< # SSLEngine on
< # SSLCertificateFile "/path/to/www.example.com.cert"
< # SSLCertificateKeyFile "/path/to/www.example.com.key"
< #</VirtualHost>
<
< Include sites-enabled/
Command:
# apachectl restart
Result:
[Fri Sep 01 05:42:50 2017] [warn] _default_ VirtualHost overlap on port 443, the first has precedence
Reference:
http://www.techrepublic.com/article/how-to-enable-https-on-apache-centos/