Categories
木有技术

Apache服务器配置WoSign(沃通)SSL证书

参考文献
使用沃通签了一份SSL证书,其实配置的过程挺简单的,看参考文献基本能搞定。需要注意的是,本教程只开启了HTTPS站点的访问,并不强制跳转HTTP到HTTPS
我的服务器是Ubuntu+Apache,按照apt-get安装的apache2应该在这个/etc/apache2 目录下
可以看到目录大概是这个结构:

total 80
-rw-r--r-- 1 root root 7114 Dec 31 05:57 apache2.conf
drwxr-xr-x 2 root root 4096 Dec 31 05:31 conf-available
drwxr-xr-x 2 root root 4096 Dec 31 05:31 conf-enabled
-rw-r--r-- 1 root root 1782 May 20 2015 envvars
-rw-r--r-- 1 root root 31063 May 20 2015 magic
drwxr-xr-x 2 root root 12288 Apr 28 07:03 mods-available
drwxr-xr-x 2 root root 4096 May 24 11:17 mods-enabled
-rw-r--r-- 1 root root 320 May 20 2015 ports.conf
drwxr-xr-x 2 root root 4096 Dec 31 05:56 sites-available
drwxr-xr-x 2 root root 4096 May 24 11:27 sites-enabled

其中sites-available目录下应该有个默认的https配置的,我这边就有个default-ssl.conf ,然后参考本文最开始提供的参考文献链接,编辑这个文件,做这么几步:

  1. 配置公钥:修改字段SSLCertificateFile conf/ssl/test.wosign.com.crt ,SSLCertificateFile字段后面的文件地址是你存储的公钥文件(以我的站为例,wosign发给我的压缩包里有for Apache.zip,压缩包里面就有个 _boweihe.me.crt);
  2. 配置私钥:修改字段SSLCertificateKeyFile conf/ssl/test.wosign.com.key 同理,自行修改私钥文件地址(私钥文件后缀是.key)
  3. 配置服务器证书链:找到以#SSLCertificateChainFile 开头的一行,删除行开头的#号注释,并修改字段对应值为你的证书链文件(1_root_bundle.crt)地址,如SSLCertificateChainFile conf/ssl/1_root_bundle.crt

然后需要启用这个HTTPS站点(配置文件的其他内容修改可以参考你自己本身已经启用的http站的,可能要注意的是webroot要保持一致什么的),启用的命令很简单

a2ensite default-ssl

后面的default-ssl是你刚才修改的default-ssl.conf文件的名字,如果你起了另外的名字,那相应修改。命令执行成功后,会提示

To activate the new configuration, you need to run:
  service apache2 reload

照着做就行了,重新加载下apache服务:

service apache2 reload

至此你的站就可以用https协议访问了,如图
https
可能遇到的问题是,站点里部分资源是非HTTPS协议的,这时候图表就不能变绿了。比如我使用了七牛云的静态文件缓存,还得去人工提交一下申请,开通HTTPS静态资源访问的协议。

Categories
木有技术 生活琐碎

StartSSL被拒申诉感慨…HTTPS证书不好搞

之前一周都在申请startSSL证书,原因不言而喻,当然是因为它免费。
之前看过好多教程:https://www.google.com.hk/search?client=aff-6655&forid=1&ie=utf-8&oe=utf-8&hl=zh-cn&q=startssl%E6%95%99%E7%A8%8B&gws_rd=ssl
务必注意,如果开VPN之类的代理的,请把代理关掉再刷新网页,申请页面会判断IP地址的,根据你IP地址识别的国家地区会自动帮你填写好
然后就按部就班申请,填写个人信息。可是始终收到拒信,尼玛我真的是填了所有的个人信息啊!换了邮箱也不行:

Thank you for registering with StartSSL™ (www.startssl.com).
Unfortunately we could not validate the personal information you provided during the registration process. This means, that the details you submitted are most likely not correct or incomplete. Please note, that you must provide your complete and correct *personal, private* details during registration for an account. You may try it again by following our terms and conditions.
Attention: If you represent a business, company or other organization, you may provide those details at the StartSSL™ Control Panel after successful enrollment. See also http://www.startssl.com/?app=25#1 and following FAQ items for more information.
Thank you!
StartCom Ltd.
StartSSL™ Certification Authority

然后实在没办法,我就写邮件申诉。直接回复它发来的邮件即可(个人信息已隐去):

Dear CertMaster,

    I have recently tried to register your SSL account for several times, with both my office address at XXXXX University in China and my personal home address. I guarantee that the information I provided is detailed and correct. How ever I still received your rejection over and over again.
    The SSL certificate will be used to maintain my personal web page, for the purpose of satisfying the mandatory requirement of HTTPS protocol in Amazon Mechanical Turk. The website will be gathering data from crowds in order to support further data analysis of my current project. I sincerely hope that you could read again my application and approve it.
E-mail accounts used for application: XXXXXX
Honestly and respectfully,
XXXXXX He

没办法,按照实情来写,确实是要做MTurk没办法。
过不久就有回复了:

Please register once again with your complete personal details!

然后我重新注册了一遍,填写的自己家的地址,精确到门牌号,单元,房间了!注册完之后果然有人工审核的给我回复:

To XXXXX He,
This electronic mail message was created by StartCom’s Administration Personnel:
Thank you for registering with StartSSL. Please provide us with your legal full name.
Best Regards
XXXXX
StartCom Ltd.
StartSSL™ Certification Authority

意思是:我的名字不合法?我突然想到了我的姓氏…尼玛真是悲剧,估计就是这个让管理员误解了吧..于是乎澄清:

To XXX,

   “XXXHe” is my legal full name, the family name is “He”. Reference link: XXXXXX.
   Thank you for your patience! Sorry for the trouble brought by Chinese Pinyin, I can provide photo of my passport if you would like.
Best Regards,
Bowei

然后过不久就申请通过了。事实证明果然是姓氏的拼音He导致的误解。

Thank you for the clarification! Your account has been approved.

论威妥玛拼音的重要性!!!!!