【IT168 服务器学院】apache2整合weblogic 虚拟主机下的ssl配置修订版
修订的部分：
1. soloris系统上默认的openssl不在PATH变量里面，所以修订文档中执行openssl之前都把找到openssl的执行路径加上了。
2. 增加了solaris系统启用ssl的两个常见错误的解决方法。
apache2整合weblogic 虚拟主机下的ssl配置
分四部分
1。应用目标和环境
2。apache2 weblogic openssl安装
3。虚拟主机的配置
4。补遗或注解
一. 应用目标和环境
应用目标
1。jsp支持的webserver，只有一个ip,多个虚拟主机，其中有一个支持ssl的虚拟主机。
应用环境
1. os 为 solaris 9 和建议补丁
2. weblogic为8.1sp4 ，java为 1.4.1_06-b01
3. OpenSSL 0.9.7g
4. apache 2.0.54
二. apache2 weblogic openssl安装
1. apache 2.0.54的安装
略
2. weblogic 8.1 sp4的安装
略
3. openssl的安装
略
三. 虚拟主机的配置
1. 需要配置的虚拟主机
www 网站
bbs 论坛
diy 后台及个人管理维护平台
ssl 提供https传输的虚拟主机
sso 单点登陆
cis 卡拉蜂接口
2. 虚拟主机使用的ip
192.168.1.254
3. httpd.conf中的相关配置
......
ServerName www.colorme.com.cn
ServerRoot "/usr/local/apache2"
Listen 80
<IfDefine SSL>
LoadModule ssl_module modules/mod_ssl.so
</IfDefine>
# support weblogic
LoadModule weblogic_module modules/mod_wl_20.so
#
# load ssl.conf
<IfModule mod_ssl.c>
Include conf/ssl.conf
</IfModule>
#
# load VirtualHost
Include "conf/vhost.conf"
#
......
4. ssl.conf配置
SSLRandomSeed startup builtin
SSLRandomSeed connect builtin
<IfDefine SSL>
#
Listen 443
#
AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl .crl
#
SSLPassPhraseDialog builtin
#
SSLMutex default
</IfDefine>
5. vhost.conf配置
#
NameVirtualHost 192.168.1.254:80
#
# Section 1: http virtualhost
<VirtualHost 192.168.1.254:80>
ServerAdmin webmaster@colorme.com
DocumentRoot "/web/webapp"
ServerName www.colorme.com
ErrorLog logs/colorme-error_log
AddType application/x-httpd-php .php
AddType text/html .shtml
CustomLog logs/colorme-access_log combined
TransferLog logs/colorme-access_log
<IfModule mod_weblogic.c>
WebLogicHost 192.168.1.254
WebLogicPort 7001
MatchExpression *.jsp
MatchExpression *.do
MatchExpression *.jspa
MatchExpression /myhome/*
</IfModule>
<Directory "/web/webapp">
#php_flag engine on
Options FollowSymLinks MultiViews Includes
AddOutputFilter Includes .shtml
AddOutputFilter Includes .php
AllowOverride None
Allow from all
</Directory>
<Directory "/web/webapp/WEB-INF">
Order deny,allow
Deny from all
</Directory>
</VirtualHost>
<VirtualHost 192.168.1.254:80>
ServerAdmin webmaster@colorme.com
DocumentRoot "/web/bbs"
ServerName bbs.colorme.com
LogFormat "%h %l %u %t "%r" %>s %b "%{Referer}i" "%{User-Agent}i"" combined
CustomLog logs/bbs-access_log combined
ServerName bbs.colorme.com
ServerAlias diy
ErrorLog logs/bbs-error_log
TransferLog logs/bbs-access_log
<IfModule mod_weblogic.c>
WebLogicHost 192.168.1.254
WebLogicPort 7001
MatchExpression *.jsp
MatchExpression *.jspa
MatchExpression *.do
</IfModule>
<Directory "/web/bbs">
Options FollowSymLinks MultiViews Includes
AddOutputFilter Includes html
AllowOverride None
Allow from all
</Directory>
<Directory "/web/bbs/WEB-INF">
Order deny,allow
Deny from all
</Directory>
</VirtualHost>
<VirtualHost 192.168.1.254:80>
ServerAdmin webmaster@colorme.com
DocumentRoot "/web/diy"
ServerName diy.colorme.com
ErrorLog logs/diy-error_log
TransferLog logs/diy-access_log
<IfModule mod_weblogic.c>
WebLogicHost 192.168.1.254
WebLogicPort 7001
MatchExpression *.jsp
MatchExpression *.jspa
MatchExpression *.do
</IfModule>
<Directory "/web/diy">
Options FollowSymLinks MultiViews Includes
AddOutputFilter Includes html
AllowOverride None
Allow from all
</Directory>
<Directory "/web/diy/WEB-INF">
Order deny,allow
Deny from all
</Directory>
</VirtualHost>
# Section 2: https VirtualHost
<VirtualHost 192.168.1.254:443>
ServerName ssl.colorme.com
DocumentRoot "/web/ssl"
CustomLog logs/ssl-access_log common
SSLEngine on
SSLCipherSuite ALL:!ADH:! EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
SSLCertificateFile conf/ssl.crt/server.crt
SSLCertificateKeyFile conf/ssl.key/server.key
<Files ~ ".(cgi|shtml|phtml|php3?)$">
SSLOptions +StdEnvVars
</Files>
<Directory "/web/ssl">
SSLOptions +StdEnvVars
</Directory>
SetEnvIf User-Agent ".*MSIE.*"
nokeepalive ssl-unclean-shutdown
downgrade-1.0 force-response-1.0
<IfModule mod_weblogic.c>
WebLogicHost 192.168.1.254
WebLogicPort 7001
MatchExpression *.jsp
MatchExpression *.do
MatchExpression *.jspa
MatchExpression /myhome/*
</IfModule>
<Directory "/web/ssl">
Options FollowSymLinks MultiViews Includes
AddOutputFilter Includes .shtml
AddOutputFilter Includes .php
AllowOverride None
Allow from all
</Directory>
<Directory "/web/webapp/WEB-INF">
Order deny,allow
Deny from all
</Directory>
</VirtualHost>
6. 相关条目的说明
6.1 SSLEngine on
在虚拟主机中打开ssl支持,默认主服务主机和虚拟主机是禁用的。
6.2 SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
ssl协议握手协商时使用的密码簇，支持所有握手密码
6.3 SSLCertificateFile conf/ssl.crt/server.crt
服务器端PEM-encoded X.509认证文件
6.4 SSLCertificateKeyFile conf/ssl.key/server.key
服务器端PEM-encoded私匙文件
6.5 SSLOptions +StdEnvVars
配置各种运行时的SSL引擎选项， +StdEnvVars创建SSL与CGI&SSI相关的变量，仅用在CGI和SSI的页面中。
四. 补遗或注解
1. 认证文件的认证方式
本例中采用的自认证的方式，就是说没有去购买证书，如果是商业站点可以考虑购买证书。
2. 自认证文件的生成
a. 生成private Key文件
# LD_LIBRARY_PATH=/usr/openwin/lib:/usr/local/ssl/lib;export LD_LIBRARY_PATH
# PATH=$PATH:/usr/local/ssl/bin; export PATH
# LD_LIBRARY_PATH=/usr/openwin/lib:/usr/local/ssl/lib;export LD_LIBRARY_PATH
# /usr/local/ssl/bin/openssl genrsa -des3 -out server.key 1024
openssl genrsa -des3 -out server.key 1024
b. 创建服务器端的认证文件
openssl req -new -x509 -nodes -sha1 -days 365 -key server.key -out server.crt
在提示输入common name的时候输入域名：www.colorme.com
c. 按照vhost.conf中的配置，存放b步骤中创建的文件
存放位置
conf/ssl.key/server.key
conf/ssl.crt/server.crt
3. apache的启动和关闭方式（SSL）
3.1 启动
./apachectl startssl
会提示输入创建server.key时的密码，输入正确才能启动
3.2 关闭
./apachectl stop
3.3 为了测试方便可以关闭启动时输入密码
a. 修改vhost.conf
#SSLCertificateKeyFile conf/ssl.key/server.key
SSLCertificateKeyFile conf/ssl.key/server.key.unsecure
b. server.key.unsecure的生成
openssl rsa -in server.key -out server.key.unsecure
4. SSL类型的虚拟主机只用用于基于ip的虚拟主机
5. 基于测试，hosts文件的修改
192.168.1.254 www.colorme.com
192.168.1.254 ssl.colorme.com
6. 基于正式站点
相应的二级域名必须有Cname
file vhost.c, line 190, assertion "rv == APR_SUCCESS" failed
7. bug
7.1 死锁bug的解决方法
故障现象如下：
[warn] (45)Deadlock situation detected/avoided: ap_proxy: couldn''t create the lock
在ssl.conf增加下面的配置可以解决
AcceptMutex pthread
SSLMutex sem
7.2 bug 27525
故障现象：
bash-2.05# ../bin/apachectl startssl
[Sun Nov 20 14:52:44 2005] [crit] [Sun Nov 20 14:52:44 2005] file vhost.c, line 190, assertion "rv == APR_SUCCESS" failed
解决方法1：
Essentially the same problem as bug 27525 -- edit /etc/nsswitch.conf and add
"dns" to the end of the hosts: line to fix it.
解决方法2：
删除ssl.conf中的默认的ssl虚拟主机
Bug 37488 has been added to the database
