且构网

分享程序员开发的那些事...
且构网 - 分享程序员编程开发的那些事

SSL:无法加载CA证书文件/etc/pki/tls/certs/ca-bundle.crt

更新时间:2021-10-12 05:47:05

我解决了我的问题,并且正在做一个文件的目的,如果任何其他人有类似的问题。有很多问题需要解决。

I solved my issue and am doing a post for documentation purposes, in case anyone else has similar issues. There was a couple of issues I had to resolve to fix this.

PHP安装

我的 /etc/apache2/httpd.conf 引用我的默认osx php安装而不是我的家brew安装php。解决方案是编辑httpd.conf并指向正确的安装。

My /etc/apache2/httpd.conf referenced my default osx php install instead of my home brew install of php. Solution was to edit the httpd.conf and point it to the right install.

#LoadModule php5_module /usr/local/opt/php53/libexec/apache2/libphp5.so
LoadModule php5_module /usr/local/Cellar/php53/5.3.29_4/libexec/apache2/libphp5.so

您可以使用home brew通过以下命令创建类似的php设置:

You can create a similar setup of php using home brew by the following commands:

brew install homebrew/php/php53
brew install homebrew/php/php53-igbinary --build-from-source
brew install homebrew/php/php53-intl
brew install homebrew/php/php53-mcrypt
brew install homebrew/php/php53-memcached
brew install homebrew/php/php53-mongo
brew install homebrew/php/php53-xdebug

创建CA证书捆绑文件

系统正在寻找 /etc/pki/tls/certs/ca-bundle.cert ,这是linux上的标准路径,但不是在osx上。我们通过生成文件来解决这个问题。

The system is looking for /etc/pki/tls/certs/ca-bundle.cert which is a standard path on linux, but not on osx. We get around this by generating the file.

我使用 keytool 产生了 .keystore 对我的别名使用 jboss 。为了构建ca文件,我们需要使用pem格式,因此我们需要在导出语句中添加-rfc。以下是命令:

I generated the .keystore file using keytool and used jboss for my alias. In order to build the ca bundle file, we need it to be in the pem format, so we need to add the -rfc to our export statement. Below are the commands:

cd /usr/local/jboss-eap-6.4/standalone/configuration
keytool -export -alias jboss -file local-sbx.dev.yourcompany.com.crt -keystore .keystore -rfc

在您拥有该文件后,您可以将其发布并验证该文件是否具有 BEGIN CERTIFICATE END CERTIFICATE 东西在里面。如果是这样,它的格式正确。

After you have the file, you can cat it out and verify that the file has the BEGIN CERTIFICATE and END CERTIFICATE stuff in it. If so, its in the right format.

最后,创建目录结构,移动证书的行为就像捆绑(这只是一堆的证书彼此附加),然后重新启动apache: p>

Lastly, create the directory structure, move the cert to act like the bundle (which is just a bunch of certs appended to each other) and then restart apache:

mkdir -p /etc/pki/tls/certs/
sudo cp local-sbx.dev.yourcompany.com.crt /etc/pki/tls/certs/ca-bundle.crt
sudo apachectl restart