（1）客户端发送可供选择的加密方式，并向服务器请求证书
（2）服务器端发送证书以及选定的加密方式给客户端
（3）客户端取得证书并进行证书验证；
如果新人给其发证书的CA；
（a）验证证书来源的合法性；用CA的公钥解密证书上的数字签名；
（b）验证证书的内容的合法性；完整性验证；
（c）检查证书的有效期限，是否过期；
（d）检查证书是否被吊销；
（e）证书中拥有者的名字，与访问的目标主机要一致；
(4）客户端生成临时会话密钥（对称密钥），并使用服务器端的公钥加密此数据发送给服务器，完成密钥交换；
（5）服务器使用此密钥加密用户请求的资源，响应给客户端；
需要注意的是，SSL会话是基于IP地址创建的；所以单IP的主机上，仅可以使用一个https虚拟主机；
配置过程：
（1）为服务器申请数字证书；一般我们使用私建CA发证书
（a）在172.16.20.244上创建私有CA
1、生产密钥对，创建私钥，公钥不需处理
[root@localhost CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048)Generating RSA private key, 2048 bit long modulus..........+++..............+++e is 65537 (0x10001)[root@localhost CA]#
2、生成自签证书
[root@localhost CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 3655You are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank.-----Country Name (2 letter code) [XX]:CN // 这里需要输入证书的相关信息，需要注意的是State or Province Name (full name) []:Beijing // 这里输入的信息要和http服务器生成证书请求Locality Name (eg, city) [Default City]:Beijing // 部分保持一致，因为这是私建CAOrganization Name (eg, company) [Default Company Ltd]:Gump Ltd Organizational Unit Name (eg, section) []:OpsCommon Name (eg, your name or your server's hostname) []:ca.gump.comEmail Address []:caadmin@gump.com [root@localhost CA]#
3、在签署证书之前，需要手动创建两个文件，具体细节请参考openssl篇
[root@localhost CA]# touch /etc/pki/CA/index.txt[root@localhost CA]# touch /etc/pki/CA/serial[root@localhost CA]# echo 01 > /etc/pki/CA/serial
（2）在http服务器172.16.20.242上生成证书请求
（a）先生成密钥，保存到应用此证书的服务的配置文件目录下，https会话的建立以及数据传输过程中，都需要用到这个密钥
[root@localhost ~]# mkdir /etc/httpd/ssl[root@localhost ~]# cd /etc/httpd/ssl[root@localhost ssl]# (umask 077;openssl genrsa -out httpd.key 1024)Generating RSA private key, 1024 bit long modulus.......++++++..........++++++e is 65537 (0x10001)[root@localhost ssl]#
（b）根据密钥生成证书申请请求
[root@localhost ssl]# openssl req -new -key httpd.key -out httpd.csrYou are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank.-----Country Name (2 letter code) [XX]:CNState or Province Name (full name) []:BeijingLocality Name (eg, city) [Default City]:BeijingOrganization Name (eg, company) [Default Company Ltd]:Gump LtdOrganizational Unit Name (eg, section) []:OpsCommon Name (eg, your name or your server's hostname) []:web1.gump.comEmail Address []:web1admin@gump.comPlease enter the following 'extra' attributesto be sent with your certificate requestA challenge password []: // 这里的密码和名字没有必要的情况下可以An optional company name []: // 直接忽略[root@localhost ssl]#
这里可以看到的是，密钥和证书请求都存放在之前创建好的/etc/httpd/ssl/目录下
[root@localhost ssl]# pwd/etc/httpd/ssl[root@localhost ssl]# lshttpd.csr httpd.key[root@localhost ssl]#
（3）将http服务器172.16.20.242上的证书申请请求发送至CA服务器172.16.20.244上完成证书签署
172.16.20.242：
[root@localhost ssl]# scp httpd.csr root@172.16.20.244:/tmp/The authenticity of host '172.16.20.244 (172.16.20.244)' can't be established.ECDSA key fingerprint is bc:9c:21:b5:a6:4d:ef:b6:f3:00:94:80:b4:7f:18:f5.Are you sure you want to continue connecting (yes/no)? yesWarning: Permanently added '172.16.20.244' (ECDSA) to the list of known hosts.root@172.16.20.244's password: httpd.csr 100% 696 0.7KB/s 00:00 [root@localhost ssl]#
172.16.20.244：
[root@localhost CA]# openssl ca -in /tmp/httpd.csr -out certs/web1.gump.com.crt -days 365Using configuration from /etc/pki/tls/openssl.cnfCheck that the request matches the signatureSignature okCertificate Details: Serial Number: 1 (0x1) Validity Not Before: Aug 21 13:20:11 2017 GMT Not After : Aug 21 13:20:11 2018 GMT Subject: countryName = CN stateOrProvinceName = Beijing organizationName = Gump Ltd organizationalUnitName = Ops commonName = web1.gump.com emailAddress = webadmin@gump.com X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: 23:C2:7E:52:B5:AB:E8:A1:06:53:38:7A:39:F0:EB:E3:1C:B3:1F:76 X509v3 Authority Key Identifier: keyid:EB:31:34:C3:C5:7C:E4:BB:EE:C3:7C:11:5E:F1:70:5C:88:E5:87:D8Certificate is to be certified until Aug 21 13:20:11 2018 GMT (365 days)Sign the certificate? [y/n]:y1 out of 1 certificate requests certified, commit? [y/n]yWrite out database with 1 new entriesData Base Updated[root@localhost CA]#
（4）将签署完成的证书web1.gump.com.crt传输给http服务器172.16.20.242
[root@localhost CA]# scp certs/web1.gump.com.crt root@172.16.20.242:/etc/httpd/ssl/The authenticity of host '172.16.20.242 (172.16.20.242)' can't be established.RSA key fingerprint is 5a:10:33:a2:bf:5b:06:82:25:01:fb:c2:74:93:34:95.Are you sure you want to continue connecting (yes/no)? yesWarning: Permanently added '172.16.20.242' (RSA) to the list of known hosts.root@172.16.20.242's password: web1.gump.com.crt 100% 3858 3.8KB/s 00:00 [root@localhost CA]#
（5）安装ssl模块
[root@localhost CA]# yum install mod_ssl -y
（6）配置ssl文件/etc/httpd/conf.d/ssl.conf
一般需要修改以下配置项
DocumentRoot // 根路径，需要和httpd.conf中的根路径一致
ServerName // 服务器名，需要和签署的证书的服务器名一致
SSLCertfifcateFile // 证书文件存放目录
SSLCertificateKeyFile // 密钥文件存目录
如果是应用到虚拟主机上，则同时也需要修改以下配置项
<VirtualHost _default_:443>
这里的default即默认虚拟主机的IP地址，因为SSL会话是基于IP地址创建的，所以有多个地址，需要填写默认地址
[root@localhost CA]# vim /etc/httpd/conf.d/ssl.confDocumentRoot /www/htdocsServerName web1.gump.comSSLCertificateFile /etc/httpd/ssl/web1.gump.com.crtSSLCertificateKeyFile /etc/httpd/ssl/httpd.key
（7）配置完成后，需要重新载入http配置文件才能生效，而新增的ssl模块则是动态加载，无需重启服务即可生效
测试配置效果
# openssl s_client [-connect host:port] [-cert filename] [-CApath directory] [-CAfile filename] 目标主机名 服务器端证书 CA证书目录 CA证书文件名[root@localhost CA]# openssl s_client -connect 172.16.20.244:443 -CApath /etc/pki/CA/casert.pem
也可以直接用浏览器端测试，在浏览器地址栏中输入：https://172.16.20.242，如果可以成功访问，说明配置成功。
写的比较潦草，如有遗漏错误和争议之处，欢迎大家的批评指正和讨论，谢谢。
https简单配置
原文地址：http://blog.51cto.com/11367661/2047999