您好，我在運行 ubuntu 14.04 的 Linux 實例伺服器上。我有一個網站設置，後來我意識到需要 https 而不僅僅是 http。首先，我建立了一個自簽名憑證。透過傳遞下面的命令
sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/apache2/ssl/apache.key -out /etc/apache2/ssl/apache.crt
完成所有步驟後，當我在前面添加 https:// 且僅適用於 http:// 時，我仍然無法訪問我的網站。我有一種感覺，在使用作為根創建的 sudo 創建密鑰時，www-data 無法識別它。我檢查了我的 ssl 錯誤日誌，它不斷重複這兩件事。
[ssl:warn] [pid 29081] AH01906: RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[ssl:warn] [pid 29081] AH01909: RSA certificate configured for 52.24.182.161:443 does NOT include an ID which matches the server name
我被困在這一點上，我只想使用自簽名憑證和我的網站使用 https:// 進行工作
<IfModule mod_ssl.c>
<VirtualHost _default_:443>
ServerAdmin webmaster@localhost
ServerName 52.24.182.161
DocumentRoot /var/www/html/website
ErrorLog ${APACHE_LOG_DIR}/website-ssl-error.log
CustomLog ${APACHE_LOG_DIR}/website-ssl-access.log combined
SSLEngine on
SSLCertificateFile /etc/apache2/ssl/apache.crt
SSLCertificateKeyFile /etc/apache2/ssl/apache.key
<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory /usr/lib/cgi-bin>
SSLOptions +StdEnvVars
</Directory>
BrowserMatch "MSIE [2-6]" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
# MSIE 7 and newer should be able to use keepalive
BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
</VirtualHost>
我的輸出openssl x509 -noout -text -in /etc/apache2/ssl/apache.crt
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 17752245544736062623 (0xf65ca5447b80fc9f)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=GB, ST=London, L=London city, O=Hom, OU=Digital, CN=sgurung
Validity
Not Before: Oct 18 15:47:58 2016 GMT
Not After : Oct 18 15:47:58 2017 GMT
Subject: C=GB, ST=London, L=London city, O=Hom, OU=Digital, CN=sgurung
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:96:e5:4f:f9:c6:fc:4c:62:7d:ef:a1:64:1d:9a:
1a:79:c2:bb:1d:38:54:88:c3:c8:b6:74:45:49:ec:
b6:ca:fd:eb:94:0b:13:0b:cc:0d:2c:a4:45:77:0c:
07:6f:20:01:9a:21:61:77:fa:3d:6b:3d:4e:6d:ef:
7d:5a:85:82:9f:11:82:78:70:50:82:97:9d:c6:ae:
b5:8a:fc:a3:3d:51:db:92:66:70:3d:86:76:f0:95:
29:cc:20:f4:a5:50:b4:30:82:d7:7b:ff:36:87:90:
42:63:c9:d0:75:29:7a:7b:a3:78:7d:80:4b:af:19:
d1:15:90:ff:06:1a:4c:fb:ef:83:ee:56:b9:dd:1f:
74:9c:e7:d7:7a:11:7e:74:c2:55:e3:3e:86:f5:fe:
a5:f2:94:3e:21:0a:01:62:0e:a7:7d:32:b6:a5:16:
e8:cd:46:de:c5:ea:c4:be:88:42:f6:bf:72:75:96:
a8:82:f4:e1:31:4c:a8:62:ac:54:d2:bc:5c:42:21:
d9:29:a7:c7:73:a2:12:31:04:bf:37:08:4e:55:2f:
46:13:d8:0c:4b:8c:73:ad:eb:f1:8a:92:85:c9:22:
28:04:de:91:71:d6:7f:ca:43:08:ad:f4:72:24:a9:
f1:e4:12:fa:d8:97:50:e5:a9:9f:91:2d:db:2b:4e:
90:03
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Key Identifier:
35:50:60:0B:18:C6:A4:6C:74:4D:6B:9A:A2:4C:5F:57:16:93:56:60
X509v3 Authority Key Identifier:
keyid:35:50:60:0B:18:C6:A4:6C:74:4D:6B:9A:A2:4C:5F:57:16:93:56:60
X509v3 Basic Constraints:
CA:TRUE
Signature Algorithm: sha256WithRSAEncryption
46:8f:75:06:48:8c:0a:c6:45:d0:f6:26:99:eb:7a:e2:31:e6:
4a:76:7f:ba:af:30:ed:d8:04:39:e5:26:94:23:bf:38:1c:28:
df:1f:d2:63:b7:36:bb:3e:aa:9a:1b:35:c0:db:73:98:5a:6a:
41:3a:64:6e:53:33:c1:92:63:7c:3a:3a:1e:1c:9b:ed:55:eb:
dd:eb:cb:50:a4:56:19:46:8f:8b:55:e6:97:0d:b0:53:07:b1:
e6:8f:4b:6a:a1:ba:dd:d1:1e:14:9a:49:f9:b0:fd:40:0f:e3:
a5:7f:fd:ab:d3:fc:ff:e0:3d:5c:46:91:f4:b4:7d:fb:56:f6:
3a:ec:64:ac:18:1b:d5:10:ec:c9:7c:c4:3f:7c:98:4a:80:ed:
66:84:d8:12:e3:ff:38:9b:03:51:67:89:ba:33:af:88:5c:c4:
cd:47:e8:3f:46:2a:ee:c4:a3:b7:96:55:23:80:d5:ed:34:ef:
3c:7c:6c:ad:1b:dc:4d:69:00:27:85:87:f8:96:92:c0:d0:51:
b4:47:9e:4f:36:d9:70:b7:55:b8:60:bf:99:b7:e3:4d:b0:8c:
47:8a:d0:a1:41:76:97:d6:dc:a3:a5:43:b4:aa:c3:6c:f1:e9:
8b:45:7f:a4:9f:e9:73:73:af:49:ed:32:1c:06:fd:f8:23:36:
22:5b:74:3c
netstat -tlpn 輸出
(No info could be read for "-p": geteuid()=1000 but you should be root.)
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN -
tcp6 0 0 :::80 :::* LISTEN -
tcp6 0 0 :::22 :::* LISTEN -
tcp6 0 0 :::443 :::* LISTEN -
答案1
答案在日誌中：
AH01906: RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
和：
AH01909: RSA certificate configured for 52.24.182.161:443 does NOT include an ID which matches the server name
首先，您正在運行一個網頁伺服器。 Web 伺服器是最終實體（使用憑證的實體）而不是憑證授權單位（產生憑證的實體）。
其次，您在瀏覽器中輸入的 DNS 名稱必須與憑證中的名稱相符。這可以是 CommonName (CN)，也可以是在SubjectAlternateName (SAN) 欄位中列出的。
要解決第一個問題，請找出 OpenSSL 設定檔所在的位置，方法是：
$ openssl version -a | grep OPENSSLDIR
OPENSSLDIR: "/etc/pki/tls"
上面是在 Fedora 盒子上，因此路徑可能與您不同。在該目錄中應該有一個名為openssl.cnf.用你最喜歡的編輯器編輯它（顯然我們都有最喜歡的）並找到這樣的行：
basicConstraints=CA:TRUE
刪除此行，或在前面加上哈希 ( #) 符號來停用它：
#basicConstraints=CA:TRUE
這應該會消除 CA 證書錯誤訊息。
要解決第二個問題，只需確保您在執行 OpenSSL 時輸入的 CommonName (CN) 是您將在瀏覽器中輸入的 DNS 名稱（不是 URL，也不包含 https://）。還有更複雜的解決方案涉及SubjectAlternateName，但這個解決方案應該可以解決您的問題。
答案2
終於解決了這個問題。非常感謝@丹尼爾B。由於我使用的是 Amazon EC2 執行個體伺服器，因此在執行個體的初始啟動過程中，我沒有將規則配置為 https，該規則僅允許 http。因此，在亞馬遜控制台上添加規則network and security group解決了問題