申請(qǐng)的證書(shū)金句，都需要驗(yàn)證DNS或驗(yàn)證網(wǎng)站檩赢。
本地測(cè)試無(wú)法驗(yàn)證了吕嘀，https總是提示“證書(shū)錯(cuò)誤”。
如何讓瀏覽器認(rèn)為本地站點(diǎn)是安全的贞瞒，避免每次訪問(wèn)提示“沒(méi)有加密”偶房？
安裝一個(gè)自簽名證書(shū)。
1 下載openssl军浆。?
http://slproweb.com/products/Win32OpenSSL.html
到這里下載一個(gè)windows版本的（1.1.1d）棕洋，有32/64位的，有正常幾十M的乒融，也有l(wèi)ight版本3M左右的掰盘。
比如?Win64OpenSSL_Light-1_1_1d.exe 就是64位的 light 版，需要安裝赞季。
其實(shí)愧捕，apache 安裝包(httpd-2.4.37-o102q-x64-vc14-r2.zip)解壓，就有openssl（1.0.2q）申钩，但需要配置文件openssl.cnf支持次绘。
2 制作并安裝CA。
OpenSSL> genrsa -out ca.key 1024
Generating RSA private key, 1024 bit long modulus (2 primes).+++++......+++++ e is 65537 (0x010001)
OpenSSL> req -new -key ca.key -out ca.csr
You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value,If you enter '.', the field will be left blank.
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:Shanxi
Locality Name (eg, city) []:xian
Organization Name (eg, company) [Internet Widgits Pty Ltd]:CAmk
Organizational Unit Name (eg, section) []:.
Common Name (e.g. server FQDN or YOUR name) []:CA localhost
Email Address []:.
Please enter the following 'extra' attributes to be sent with your certificate request
A challenge password []:.
An optional company name []:.
OpenSSL> x509 -req -in ca.csr -signkey ca.key -days 36000 -out ca.crt
Signature ok
subject=C = CN, ST = Shanxi, L = xian, O = CAmk, CN = CA localhost
Getting Private key
OpenSSL>
3 簽發(fā)服務(wù)器證書(shū)
OpenSSL> genrsa -out server.key 1024
Generating RSA private key, 1024 bit long modulus (2 primes)..................+++++.............................................+++++e is 65537 (0x010001)
OpenSSL> req -new -key server.key -out server.csr//這里有個(gè)錯(cuò)誤，退出重新啟動(dòng)openssl可以解決邮偎。
problem creating object tsa_policy1=1.2.3.4.1
11840:error:08064066:object identifier routines:OBJ_create:oid exists:crypto\objects\obj_dat.c:698:
error in req
OpenSSL> quit
c:\Program Files\OpenSSL-Win64\bin>openssl
OpenSSL> req -new -key server.key -out server.csr
You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value,If you enter '.', the field will be left blank.
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:Shanxi
Locality Name (eg, city) []:xian
Organization Name (eg, company) [Internet Widgits Pty Ltd]:qmgj
Organizational Unit Name (eg, section) []:.
Common Name (e.g. server FQDN or YOUR name) []:localhost
Email Address []:.
Please enter the following 'extra' attributes to be sent with your certificate request
A challenge password []:.
An optional company name []:.
OpenSSL> x509 -req -CA ca.crt -CAkey ca.key -CAcreateserial -days 36000 -in server.csr -out server.crt
Signature ok
subject=C = CN, ST = Shanxi, L = xian, O = qmgj, CN = localhost
Getting CA Private Key
OpenSSL>
4 安裝CA到受信任的機(jī)構(gòu)
找到ca.crt管跺，雙擊安裝，安裝到“受信任的根證書(shū)頒發(fā)機(jī)構(gòu)”
也可以打開(kāi)certmgr.msc查看安裝結(jié)果禾进。
5 把服務(wù)器證書(shū)記錄到apache
httpd.conf中以下注釋放開(kāi)：
LoadModule ssl_module modules/mod_ssl.so
Include conf/extra/httpd-ahssl.conf
httpd-ahssl.conf中登記服務(wù)器證書(shū)
SSLCertificateFile "${SRVROOT}/conf/server.crt"
SSLCertificateKeyFile "${SRVROOT}/conf/server.key"
復(fù)制服務(wù)器證書(shū)到上述指定位置
server.crt,?server.key
6 重啟apache服務(wù)豁跑，重啟瀏覽器。
啟動(dòng)service.msc泻云，重啟服務(wù)贩绕。
一定要重啟瀏覽器。雖然有的瀏覽器不用重啟也可以壶愤。
