嗨，我在运行 ubuntu 14.04 的 Linux 实例服务器上。我设置了一个网站，后来我意识到它需要 https 而不仅仅是 http。因此，首先我创建了一个自签名证书。通过传递以下命令
sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/apache2/ssl/apache.key -out /etc/apache2/ssl/apache.crt
完成所有步骤后，当我在前面添加 https:// 时，我仍然无法访问我的网站，并且只能在 http:// 上工作。我感觉在使用 sudo 创建密钥时，以 root 身份创建，而 www-data 无法识别它。我检查了我的 ssl 错误日志，它不断重复这两件事。
[ssl:warn] [pid 29081] AH01906: RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[ssl:warn] [pid 29081] AH01909: RSA certificate configured for 52.24.182.161:443 does NOT include an ID which matches the server name
我被困在这一点上，我只想使用自签名证书，我的网站可以使用 https://
<IfModule mod_ssl.c>
<VirtualHost _default_:443>
ServerAdmin webmaster@localhost
ServerName 52.24.182.161
DocumentRoot /var/www/html/website
ErrorLog ${APACHE_LOG_DIR}/website-ssl-error.log
CustomLog ${APACHE_LOG_DIR}/website-ssl-access.log combined
SSLEngine on
SSLCertificateFile /etc/apache2/ssl/apache.crt
SSLCertificateKeyFile /etc/apache2/ssl/apache.key
<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory /usr/lib/cgi-bin>
SSLOptions +StdEnvVars
</Directory>
BrowserMatch "MSIE [2-6]" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
# MSIE 7 and newer should be able to use keepalive
BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
</VirtualHost>
我的输出openssl x509 -noout -text -in /etc/apache2/ssl/apache.crt
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 17752245544736062623 (0xf65ca5447b80fc9f)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=GB, ST=London, L=London city, O=Hom, OU=Digital, CN=sgurung
Validity
Not Before: Oct 18 15:47:58 2016 GMT
Not After : Oct 18 15:47:58 2017 GMT
Subject: C=GB, ST=London, L=London city, O=Hom, OU=Digital, CN=sgurung
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:96:e5:4f:f9:c6:fc:4c:62:7d:ef:a1:64:1d:9a:
1a:79:c2:bb:1d:38:54:88:c3:c8:b6:74:45:49:ec:
b6:ca:fd:eb:94:0b:13:0b:cc:0d:2c:a4:45:77:0c:
07:6f:20:01:9a:21:61:77:fa:3d:6b:3d:4e:6d:ef:
7d:5a:85:82:9f:11:82:78:70:50:82:97:9d:c6:ae:
b5:8a:fc:a3:3d:51:db:92:66:70:3d:86:76:f0:95:
29:cc:20:f4:a5:50:b4:30:82:d7:7b:ff:36:87:90:
42:63:c9:d0:75:29:7a:7b:a3:78:7d:80:4b:af:19:
d1:15:90:ff:06:1a:4c:fb:ef:83:ee:56:b9:dd:1f:
74:9c:e7:d7:7a:11:7e:74:c2:55:e3:3e:86:f5:fe:
a5:f2:94:3e:21:0a:01:62:0e:a7:7d:32:b6:a5:16:
e8:cd:46:de:c5:ea:c4:be:88:42:f6:bf:72:75:96:
a8:82:f4:e1:31:4c:a8:62:ac:54:d2:bc:5c:42:21:
d9:29:a7:c7:73:a2:12:31:04:bf:37:08:4e:55:2f:
46:13:d8:0c:4b:8c:73:ad:eb:f1:8a:92:85:c9:22:
28:04:de:91:71:d6:7f:ca:43:08:ad:f4:72:24:a9:
f1:e4:12:fa:d8:97:50:e5:a9:9f:91:2d:db:2b:4e:
90:03
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Key Identifier:
35:50:60:0B:18:C6:A4:6C:74:4D:6B:9A:A2:4C:5F:57:16:93:56:60
X509v3 Authority Key Identifier:
keyid:35:50:60:0B:18:C6:A4:6C:74:4D:6B:9A:A2:4C:5F:57:16:93:56:60
X509v3 Basic Constraints:
CA:TRUE
Signature Algorithm: sha256WithRSAEncryption
46:8f:75:06:48:8c:0a:c6:45:d0:f6:26:99:eb:7a:e2:31:e6:
4a:76:7f:ba:af:30:ed:d8:04:39:e5:26:94:23:bf:38:1c:28:
df:1f:d2:63:b7:36:bb:3e:aa:9a:1b:35:c0:db:73:98:5a:6a:
41:3a:64:6e:53:33:c1:92:63:7c:3a:3a:1e:1c:9b:ed:55:eb:
dd:eb:cb:50:a4:56:19:46:8f:8b:55:e6:97:0d:b0:53:07:b1:
e6:8f:4b:6a:a1:ba:dd:d1:1e:14:9a:49:f9:b0:fd:40:0f:e3:
a5:7f:fd:ab:d3:fc:ff:e0:3d:5c:46:91:f4:b4:7d:fb:56:f6:
3a:ec:64:ac:18:1b:d5:10:ec:c9:7c:c4:3f:7c:98:4a:80:ed:
66:84:d8:12:e3:ff:38:9b:03:51:67:89:ba:33:af:88:5c:c4:
cd:47:e8:3f:46:2a:ee:c4:a3:b7:96:55:23:80:d5:ed:34:ef:
3c:7c:6c:ad:1b:dc:4d:69:00:27:85:87:f8:96:92:c0:d0:51:
b4:47:9e:4f:36:d9:70:b7:55:b8:60:bf:99:b7:e3:4d:b0:8c:
47:8a:d0:a1:41:76:97:d6:dc:a3:a5:43:b4:aa:c3:6c:f1:e9:
8b:45:7f:a4:9f:e9:73:73:af:49:ed:32:1c:06:fd:f8:23:36:
22:5b:74:3c
netstat -tlpn 输出
(No info could be read for "-p": geteuid()=1000 but you should be root.)
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN -
tcp6 0 0 :::80 :::* LISTEN -
tcp6 0 0 :::22 :::* LISTEN -
tcp6 0 0 :::443 :::* LISTEN -
答案1
答案在日志中：
AH01906: RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
和：
AH01909: RSA certificate configured for 52.24.182.161:443 does NOT include an ID which matches the server name
首先，您正在运行 Web 服务器。Web 服务器是终端实体（使用证书的实体），而不是认证机构（制造证书的实体）。
其次，您在浏览器中输入的 DNS 名称必须与证书中的名称匹配。该名称可以是 CommonName (CN) 或列在 SubjectAlternateName (SAN) 字段中。
要修复第一个问题，请找出 OpenSSL 配置文件所在的位置，使用以下命令：
$ openssl version -a | grep OPENSSLDIR
OPENSSLDIR: "/etc/pki/tls"
以上内容是在 Fedora 机器上执行的，因此路径可能与您不同。该目录中应该有一个名为 的文件openssl.cnf。使用您最喜欢的编辑器（显然我们都有最喜欢的编辑器）编辑它，然后找到以下行：
basicConstraints=CA:TRUE
#删除此行，或者通过在前面添加井号 ( ) 符号来禁用它：
#basicConstraints=CA:TRUE
这应该可以消除 CA 证书错误消息。
要解决第二个问题，只需确保运行 OpenSSL 时输入的 CommonName (CN) 是您将在浏览器中输入的 DNS 名称（而不是 URL，并且不包含 https://）。有更复杂的解决方案涉及 SubjectAlternateName，但这个应该可以解决您的问题。
答案2
终于解决了。非常感谢@Danel B。由于我使用的是 Amazon EC2 实例服务器，在初始启动实例时，我没有将规则配置为 https，规则仅允许 http。因此，在 Amazon 控制台上添加规则network and security group解决了问题