且构网

分享程序员开发的那些事...
且构网 - 分享程序员编程开发的那些事

SSL:无法加载CA证书文件/etc/pki/tls/certs/ca-bundle.crt

更新时间:2021-10-12 05:51:59

我解决我的问题,我做了文档目的后,如果任何人有类似的问题。有几个问题我必须解决,以解决这个问题。

I solved my issue and am doing a post for documentation purposes, in case anyone else has similar issues. There was a couple of issues I had to resolve to fix this.

PHP安装

我的 /etc/apache2/httpd.conf 引用我的默认的OSX的PHP安装,而不是我的家庭酿造的安装PHP的。解决方法是编辑httpd.conf并将其指向正确的安装。

My /etc/apache2/httpd.conf referenced my default osx php install instead of my home brew install of php. Solution was to edit the httpd.conf and point it to the right install.

#LoadModule php5_module /usr/local/opt/php53/libexec/apache2/libphp5.so
LoadModule php5_module /usr/local/Cellar/php53/5.3.29_4/libexec/apache2/libphp5.so

您可以通过以下命令使用家酿PHP创建一个类似的设置:

You can create a similar setup of php using home brew by the following commands:

brew install homebrew/php/php53
brew install homebrew/php/php53-igbinary --build-from-source
brew install homebrew/php/php53-intl
brew install homebrew/php/php53-mcrypt
brew install homebrew/php/php53-memcached
brew install homebrew/php/php53-mongo
brew install homebrew/php/php53-xdebug

创建CA证书包文件

该系统寻找 /etc/pki/tls/certs/ca-bundle.cert 这是在Linux上的标准路径,但不能在OSX。我们解决这个问题通过生成的文件。

The system is looking for /etc/pki/tls/certs/ca-bundle.cert which is a standard path on linux, but not on osx. We get around this by generating the file.

我生成使用密钥工具的.keystore 文件,并使用的JBoss 我的别名。为了建立CA包文件,我们需要它在PEM格式,所以我们需要将-rfc添加到我们的出口声明。下面是命令:

I generated the .keystore file using keytool and used jboss for my alias. In order to build the ca bundle file, we need it to be in the pem format, so we need to add the -rfc to our export statement. Below are the commands:

cd /usr/local/jboss-eap-6.4/standalone/configuration
keytool -export -alias jboss -file local-sbx.dev.yourcompany.com.crt -keystore .keystore -rfc

在你的文件,你可以猫出来,并验证该文件的 BEGIN CERTIFICATE END CERTIFICATE 的东西在里面。如果是这样,其以正确的格式。

After you have the file, you can cat it out and verify that the file has the BEGIN CERTIFICATE and END CERTIFICATE stuff in it. If so, its in the right format.

最后,创建目录结构,移动证书到像束(这只是一堆附加到对方的证书),然后重启apache:

Lastly, create the directory structure, move the cert to act like the bundle (which is just a bunch of certs appended to each other) and then restart apache:

mkdir -p /etc/pki/tls/certs/
sudo cp local-sbx.dev.yourcompany.com.crt /etc/pki/tls/certs/ca-bundle.crt
sudo apachectl restart