Jin's Blog

为了防止我天朝功夫网的侵害，要给twitter的代理添上SSL，因为是自己用，就省得花钱去买SSL证书了，来弄个自签名的：

SSL的配置是参照 http://www.debian-administration.org/articles/284 ，下面把主要步骤简化一下，翻译过来：

1. 安装openssl

> apt-get install openssl

2. 创建工作文件夹，home目录就好。之后的操作都在此文件夹中进行

mkdir CA
cd CA
mkdir newcerts private

3. 创建证书数据库

echo '01' > serial
touch index.txt

4. 自定义openssl配置文件

创建openssl.conf，内容如下(黑体部分自己要修改一下)：

#
# OpenSSL configuration file.
# 

# Establish working directory. 

dir = . 

[ ca ]
default_ca = CA_default 

[ CA_default ]
serial = $dir/serial
database = $dir/index.txt
new_certs_dir = $dir/newcerts
certificate = $dir/cacert.pem
private_key = $dir/private/cakey.pem
default_days = 365
default_md = md5
preserve = no
email_in_dn = no
nameopt = default_ca
certopt = default_ca
policy = policy_match 

[ policy_match ]
countryName = match
stateOrProvinceName = match
organizationName = match
organizationalUnitName = optional
commonName = supplied
emailAddress = optional 

[ req ]
default_bits = 1024 # Size of keys
default_keyfile = key.pem # name of generated keys
default_md = md5 # message digest algorithm
string_mask = nombstr # permitted characters
distinguished_name = req_distinguished_name
req_extensions = v3_req 

[ req_distinguished_name ]
# Variable name   Prompt string
#----------------------   ----------------------------------
0.organizationName = Organization Name (company)
organizationalUnitName = Organizational Unit Name (department, division)
emailAddress = Email Address
emailAddress_max = 40
localityName = Locality Name (city, district)
stateOrProvinceName = State or Province Name (full name)
countryName = Country Name (2 letter code)
countryName_min = 2
countryName_max = 2
commonName = Common Name (hostname, IP, or your name)
commonName_max = 64 

# Default values for the above, for consistency and less typing.
# Variable name   Value
#------------------------------   ------------------------------
0.organizationName_default = The Sample Company
localityName_default = Metropolis
stateOrProvinceName_default = New York
countryName_default = US 

[ v3_ca ]
basicConstraints = CA:TRUE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer:always 

[ v3_req ]
basicConstraints = CA:FALSE
subjectKeyIdentifier = hash

5. 创建CA证书和私钥

#openssl req -new -x509 -extensions v3_ca -keyout private/cakey.pem \
-out cacert.pem -days 3650 -config ./openssl.cnf

需要创建验证密码，把这个记下来

writing new private key to 'private/cakey.pem'
Enter PEM pass phrase:demo 
Verifying password - Enter PEM pass phrase:demo

创建过程中会要求输入一些信息，这里的这个Common Name不是很重要。

Organization Name (company) [The Sample Company]:
Organizational Unit Name (department, division) []:CA Division
Email Address []:ca@sample.com 
Locality Name (city, district) [Metropolis]:
State or Province Name (full name) [New York]:
Country Name (2 letter code) [US]:
Common Name (hostname, IP, or your name) []:TSC Root CA 

6.创建认证请求

openssl req -new -nodes -out req.pem -config ./openssl.cnf

此步骤中Common Name一定要填上要认证的网址

Organizational Unit Name (department, division) :Mail Server 
Email Address :postmaster@sample.com 
Common Name (hostname, IP, or your name) :mail.sample.com

7. 给证书签名

openssl ca -out cert.pem -config ./openssl.cnf -infiles req.pem

输入刚才的CA密码

Enter PEM pass phrase:demo 

然后两次 ‘y’ 确认之后，签名成功

8. 给证书加密

mv cert.pem tmp.pem
openssl x509 -in tmp.pem -out cert.pem

9. 有些程序需要将key和证书在一个文件中，可以这样合并

cat key.pem cert.pem >key-cert.pem

10. 把key.pem和cert.pem移动到合适的地方，然后在Apache中配置虚拟主机（/etc/apache2/sites-available/）

<VirtualHost xxx.xxx.xxx.xxx:443>
    ServerAdmin xxxxx@gmail.com
    ServerName mail.sample.com
    DocumentRoot /var/www/sample.com/public_html/mail
    ErrorLog /var/www/sample.com/logs/mail_ssl_error.log
    CustomLog /var/www/sample.com/logs/mail_ssl_access.log combined
    SSLEngine On
    SSLCertificateFile /var/www/sample.com/ssl/cert.pem
    SSLCertificateKeyFile /var/www/sample.com/ssl/key.pem
</VirtualHost>

11. 若是多个主机共用一个IP，则可在ports.conf中添加上

NameVirtualHost xxx.xxx.xxx.xxx:443

12. 重新加载Apache配置即可

/etc/init.d/apache2 reload

13. Stunnel的配置为：

stunnel -p /etc/ssl/certs/key-cert.pem

通过这个简要的步骤，自签名的SSL就配置成功了，如果需要更详细的内容，还是看原文吧～ http://www.debian-administration.org/articles/284

更新：强制使用https访问的方法

如果要强制使用https方式来访问网站，则可以在虚拟主机的配置中（/etc/apache2/sites-available/），找到网站的http访问配置，在其中添加这么一段：

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

这样就将所有http访问转向了https。
———————————
VPN也是个必需品，联通3G和小区宽带都不支持PPTP，所以要配一个L2TP的，http://www.vpsyou.com/l2tp-vpn/ 这里有个一键安装脚本，很方便：

wget http://mirror.zeddicus.com/auto-l2tp/1.2/ubuntu/l2tp.sh
chmod +x l2tp.sh
./l2tp.sh