1. SSL certificate installation environment overview:
Operating System: CentOS 6.5 64-bit
Apache 2.2.15
WoSign free SSL certificate
2. Network environment requirements
http://api.ygt.cm can be accessed normally from the external network
3. Obtain the SSL certificate
After successfully applying for a certificate from WoSign, you will receive a password-protected compressed archive. Entering the certificate password and extracting it yields five files, as shown in Figure 0:
for Apache, for IIS, for Nginx, for Other Server, for Tomcat.
These are the different certificate formats. Apache requires the certificate in the for Apache format, as shown in Figure 1.
4. Extract the certificate files
Extracting the for Apache file reveals three files. These include the public key, private key, and certificate chain, as shown in Figure 2.
5. Locate the ssl.conf file in the conf.d directory under the Apache installation directory. If it does not exist, Apache has not compiled the SSL module, and you need to reinstall mod_ssl.
6. Run: yum install mod_ssl, as shown in Figure 3.
7. Upload the three files via FTP to the api.ygt.cm directory, as shown in Figure 4.0.
7.1. Copy the three files to the appropriate directories under /etc/httpd/, as shown in Figure 5.
7.2. Open the ssl.conf file in the conf.d directory under the Apache installation directory.
Locate the following configuration directives in the configuration file:
Modify the encryption protocols as follows, as shown in Figure 4:
SSLProtocol all -SSLv2 -SSLv3
7.3. Configure the server certificate public key to this path, as shown in Figure 6:
SSLCertificateFile /etc/httpd/conf/ssl.crt/api.ygt.cm.crt Certificate public key
7.4. Configure the server certificate private key to this path:
SSLCertificateKeyFile /etc/httpd/conf/ssl.key/api.ygt.cm.key Certificate private key
7.5. Configure the server certificate chain to this path:
SSLCertificateChainFile /etc/httpd/conf/ssl.crt/api.ygt.cm.root_bundle.crt Certificate chain
7.6. Edit /etc/httpd/conf.d/ssl.conf in the virtual host, as shown in Figure 7.
First, comment out all configurations between the following tags:
# <VirtualHost _default_:443>
# </VirtualHost>
7.7. Configure the virtual host by making the appropriate settings based on the original default virtual host configuration, as shown in Figure 7.1.
8. Run service httpd restart to restart the Apache server.
9. Restart error:
Starting httpd: httpd: Could not reliably determine the server’s fully qualified domain name, using 10.171.221.184 for ServerName
As shown in Figure 8.
10. Edit the httpd.conf file, as shown in Figure 9.
Find #ServerName www.example.com:80 and change it to: ServerName www.ygt.cm:80
11. Restart the Apache server again. The “Starting httpd: httpd: Could not reliably determine the server’s fully qualified domain name, using 10.171.221.184 for ServerName” error disappears;
as shown in Figure 9.1.
12. There is still this error:
[Mon Aug 31 15:15:25 2015] [warn] VirtualHost 121.40.99.104:443 overlaps with VirtualHost 121.40.99.104:443, the first has precedence, perhaps you need a NameVirtualHost directive
As shown in Figure 10.
13. Edit /etc/httpd/httpd.conf
NameVirtualHost Server public IP:80
14. Restart Apache; no errors are reported, as shown in Figure 11.
15. Check the web page and find that the API URL now supports HTTPS, as shown in Figures 12 and 12.1.
