1、确认是否安装ssl模块
是否有mod_ssl.so文件
2、生成证书和密钥
linux下步骤1：生成密钥命令：openssl genrsa 1024 > server.key说明：这是用128位rsa算法生成密钥，得到server.key文件步骤2: 生成证书请求文件命令：openssl req -new -key server.key > server.csr说明：这是用步骤1的密钥生成证书请求文件server.csr, 这一步提很多问题，一一输入步骤3: 生成证书命令：openssl req -x509 -days 365 -key server.key -in server.csr > server.crt说明：这是用步骤1,2的的密钥和证书请求生成证书server.crt，-days参数指明证书有效期，单位为
window下步骤1：生成密钥命令：openssl genrsa 1024 > server.key说明：这是用128位rsa算法生成密钥，得到server.key文件步骤2: 生成证书请求文件命令：openssl req -config D:work_softApache2.2confopenssl.cnf -new -key server.key > server.csr说明：这是用步骤1的密钥生成证书请求文件server.csr, 这一步提很多问题，一一输入步骤3: 生成证书命令：openssl req -config D:work_softApache2.2confopenssl.cnf -x509 -days 365 -key server.key -in server.csr > server.crt说明：这是用步骤1,2的的密钥和证书请求生成证书server.crt，-days参数指明证书有效期，单位为天
把得到的server.key和server.crt文件拷贝到apache的对应目录
3、配置apache
1、修改 /etc/apache2/sites-available/default-ssl文件
将其中的证书相关配置替换为
SSLCertificateFile /etc/apache2/ssl/server.crt
SSLCertificateKeyFile /etc/apache2/ssl/server.key
2、在/etc/apache2/sites-enable/目录下为刚才的default-ssl配置文件生成软连接(如果已经有就不要了)
$sudo ln -s ../sites-available/default-ssl 001-default-ssl
3、在/etc/apache2/mods-available下设置ssl.conf和ssl.load
ssl.conf
<IfModule mod_ssl.c>
# Pseudo Random Number Generator (PRNG):
# Configure one or more sources to seed the PRNG of the SSL library.
# The seed data should be of good random quality.
# WARNING! On some platforms /dev/random blocks if not enough entropy
# is available. This means you then cannot use the /dev/random device
# because it would lead to very long connection times (as long as
# it requires to make more entropy available). But usually those
# platforms additionally provide a /dev/urandom device which doesn't
# block. So, if available, use this one instead. Read the mod_ssl User
# Manual for more details.
#
SSLRandomSeed startup builtin
SSLRandomSeed startup file:/dev/urandom 512
SSLRandomSeed connect builtin
SSLRandomSeed connect file:/dev/urandom 512
##
## SSL Global Context
##
## All SSL configuration in this context applies both to
## the main server and all SSL-enabled virtual hosts.
##
#
# Some MIME-types for downloading Certificates and CRLs
#
AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl .crl
# Pass Phrase Dialog:
# Configure the pass phrase gathering process.
# The filtering dialog program (`builtin' is a internal
# terminal dialog) has to provide the pass phrase on stdout.
SSLPassPhraseDialog exec:/usr/share/apache2/ask-for-passphrase
# Inter-Process Session Cache:
# Configure the SSL Session Cache: First the mechanism
# to use and second the expiring timeout (in seconds).
# (The mechanism dbm has known memory leaks and should not be used).
#SSLSessionCache dbm:${APACHE_RUN_DIR}/ssl_scache
SSLSessionCache shmcb:${APACHE_RUN_DIR}/ssl_scache(512000)
SSLSessionCacheTimeout 300
# Semaphore:
# Configure the path to the mutual exclusion semaphore the
# SSL engine uses internally for inter-process synchronization.
# (Disabled by default, the global Mutex directive consolidates by default
# this)
#Mutex file:${APACHE_LOCK_DIR}/ssl_mutex ssl-cache
# SSL Cipher Suite:
# List the ciphers that the client is permitted to negotiate. See the
# ciphers(1) man page from the openssl package for list of all available
# options.
# Enable only secure ciphers:
SSLCipherSuite HIGH:!aNULL
# SSL server cipher order preference:
# Use server priorities for cipher algorithm choice.
# Clients may prefer lower grade encryption. You should enable this
# option if you want to enforce stronger encryption, and can afford
# the CPU cost, and did not override SSLCipherSuite in a way that puts
# insecure ciphers first.
# Default: Off
#SSLHonorCipherOrder on
# The protocols to enable.
# Available values: all, SSLv3, TLSv1, TLSv1.1, TLSv1.2
# SSL v2 is no longer supported
SSLProtocol all -SSLv3
# Allow insecure renegotiation with clients which do not yet support the
# secure renegotiation protocol. Default: Off
#SSLInsecureRenegotiation on
# Whether to forbid non-SNI clients to access name based virtual hosts.
# Default: Off
#SSLStrictSNIVHostCheck On
</IfModule>
# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
ssl.load
# Depends: setenvif mime socache_shmcb LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so
4、在/etc/apache2/mods-enabled下设置刚才配置文件的软连接
ln -s ../mods-available/ssl.conf ssl.conf
ln -s ../mods-available/ssl.load ssl.load
4、重启apache
apachectl configtest
apachectl restart
报错：
1、SSLSessionCache: 'shmcb' session cache not supported (known names: ). Maybe you need to load the appropriate socache module (mod_socache_shmcb?)
解决方法：加载mod_sochache_shmcb
在/etc/apache2/mods-enabled下
ln -s ../mods-available/socache_shmcb.load socache_shmcb.load
2、"Syntax error on line 80 of c:/apache/conf/extra/httpd-ssl.conf:ErrorLog takes one argument,The filename of the error log"或者"Syntax error on line 99 of c:/apache/conf/extra/httpd-ssl.conf:SSLCertificateFile takes one argument,SSL Server Certificate file ('/path/to/file' -PEM or DER encoded)"
解决方法：文件路径加双引号