- A+
所属分类：linux技术
1、httpd简介？
http是Apache超文本传输协议服务器的主程序。它是一个独立的后台进程，能够处理请求的子进程和线程。
http常用用的两个版本是httpd-2.2和httpd-2.4
- CentOS6系列的默认httpd版本是httpd-2.2版本的rpm包
- CentOS7系列的默认httpd版本是httpd-2.4版本的rpm包
2、httpd服务特点
| 名称 | 特点 |
|---|---|
| 高度模块化 | core + modules，核心加模块，想要什么功能添加什么模块； |
| DSO | Dynamic Shared Object，动态共享库； |
| MPM | Multipath processing Modules 多路处理模块。 |
3、 httpd的工作模型
- prefork：两级进程模型，父进程管理子进程，每个进程响应一个请求
# 工作模型 一个主进程： 负责生成子进程及回收子进程 负责创建套接字、接受请求，并将其派发给某子进程进行处理 n个子进程： 每个子进程处理一个请求 # 注意： 会预先生成几个空闲进程，随时等待用于响应用户请求，最大不会超过1024个 - worker：三级进程模型，父进程管理子进程，子进程通过线程响应用户请求，每个线程处理一个用户请求
# 工作模型 一个主进程： 负责生成子进程、创建套接字、接受请求，并将其派发给某子进程进行处理 多个子进程： 每个子进程负责生成多个线程 每个线程： 负责响应用户请求 - event：两级模型，父进程管理子进程，子进程通过事件驱动event-driven机制直接响应n个请求
# 工作模型： 一个主进程： 负责生成子进程、创建套接字、接受请求，并将其派发给某子进程进行处理 子进程： 基于事件驱动机制直接响应多个请求 4、httpd的配置文件
| 文件/目录 | 对应的功能 |
|---|---|
| /var/log/httpd/access.log | 访问日志 |
| /var/log/httpd/error_log | 错误日志 |
| /var/www/html/ | 站点文档目录 |
| /usr/lib64/httpd/modules/ | 模块文件路径 |
| /etc/httpd/conf/httpd.conf | 主配置文件 |
| /etc/httpd/conf.modules.d/*.conf | 模块配置文件 |
| /etc/httpd/conf.d/*.conf | 辅助配置文件 |
5、httpd自带的工具程序
| 工具 | 功能 |
|---|---|
| htpasswd | basic认证基于文件实现时，用到的帐号密码生成工具 |
| apachectl | httpd自带的服务控制脚本，支持start，stop，restart |
| apxs | 由httpd-devel包提供的，扩展httpd使用第三方模块的工具 |
| rotatelogs | 日志滚动工具 |
| suexec | 访问某些有特殊权限配置的资源时，临时切换至指定用户运行的工具 |
| ab | apache benchmark，httpd的压力测试工具 |
6、httpd常用配置
6.1 安装httpd服务
[root@localhost ~]# dnf install -y httpd //用dnf安装httpd服务 [root@localhost ~]# systemctl status httpd //服务默认是未开启的 ● httpd.service - The Apache HTTP Server Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; vendor pres> Active: inactive (dead) Docs: man:httpd.service(8) [root@localhost ~]# systemctl stop firewalld //开启服务前关闭防火墙 [root@localhost ~]# systemctl start httpd //开启httpd服务 [root@localhost ~]# systemctl status httpd //查看服务是否开启成功 ● httpd.service - The Apache HTTP Server Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; vendor pres> Active: active (running) since Thu 2022-07-21 21:16:35 CST; 14s ago Docs: man:httpd.service(8) Main PID: 15207 (httpd) Status: "Running, listening on: port 80" Tasks: 213 (limit: 11202) Memory: 24.8M CGroup: /system.slice/httpd.service ├─15207 /usr/sbin/httpd -DFOREGROUND ├─15208 /usr/sbin/httpd -DFOREGROUND ├─15209 /usr/sbin/httpd -DFOREGROUND ├─15210 /usr/sbin/httpd -DFOREGROUND └─15211 /usr/sbin/httpd -DFOREGROUND 用浏览器输入IP地址打开httpdde测试页面
6.2 访问控制法则
| 法则 | 功能 |
|---|---|
| Require all granted | 允许所有主机访问 |
| Require all deny | 拒绝所有主机访问 |
| Require ip IPADDR | 授权指定来源地址的主机访问 |
| Require not ip IPADDR | 拒绝指定来源地址的主机访问 |
| Require host HOSTNAME | 授权指定来源主机名的主机访问 |
| Require not host HOSTNAME | 拒绝指定来源主机名的主机访问 |
| IPADDR的类型 | HOSTNAME的类型 |
|---|---|
| IP：192.168.1.1 Network/mask：192.168.1.0/255.255.255.0 Network/Length：192.168.1.0/24 Net：192.168 | FQDN：特定主机的全名 DOMAIN：指定域内的所有主机 |
注意：httpd-2.4版本在配置文件加入Requirt才是默认是拒绝所有主机访问的，所以安装以后必须做显示授权访问
配置示例： 允许除了IP192.168.111.1以外的所有主机访问
[root@localhost ~]# vim /etc/httpd/conf/httpd.conf ...... # # Controls who can get stuff from this server. # Require all granted </Directory> <Directory "/var/www/html/Tanke"> <RequireAll> Require not 192.168.111.1 Require all granted </RequireAll> </Directory> # # DirectoryIndex: sets the file that Apache will serve if a directory # is requested. # ...... [root@localhost ~]# httpd -t AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using localhost.localdomain. Set the 'ServerName' directive globally to suppress this message Syntax OK [root@localhost ~]# vim /etc/httpd/conf/httpd.conf //把#ServerName www.example.com:80前的#删掉 # # ServerName gives the name and port that the server uses to identify itself. # This can often be determined automatically, but we recommend you specify # it explicitly to prevent problems during startup. # # If your host doesn't have a registered DNS name, enter its IP address here. # #ServerName www.example.com:80 [root@localhost ~]# httpd -t Syntax OK 6.3 虚拟主机
虚拟主机有三种：
- 相同IP不同端口
- 不同IP相同端口
- 相同IP相同端口不同域名
httpd服务如何配置？
- 先在全局范围内找*vhosts.conf文件
- 把*vhosts.conf文件复制到当前路径中
相同IP不同端口
[root@localhost ~]# vim /etc/httpd/conf.d/httpd-vhosts.conf ...... <VirtualHost *:80> DocumentRoot "/var/www/html/Tanke" ServerName www.Tanke.com ErrorLog "/var/log/httpd/www.Tanke1.com-error_log" CustomLog "/var/log/httpd/www.Tanke1.com-access_log" common </VirtualHost> Listen 81 <VirtualHost *:81> DocumentRoot "/var/www/html/Feiji" ServerName www.Feiji.com ErrorLog "/var/log/httpd/www.Feiji1.com-error_log" CustomLog "/var/log/httpd/www.Feiji1.com-access_log" common </VirtualHost> ...... [root@localhost ~]# httpd -t Syntax OK [root@localhost ~]# systemctl restart httpd [root@localhost ~]# ss -anlt State Recv-Q Send-Q Local Address:Port Peer Address:Port Process LISTEN 0 128 0.0.0.0:22 0.0.0.0:* LISTEN 0 128 *:80 *:* LISTEN 0 128 *:81 *:* LISTEN 0 128 [::]:22 [::]:* 不同IP相同端口
[root@localhost ~]# vim /etc/httpd/conf.d/httpd-vhosts.conf ...... <VirtualHost 192.168.111.135:80> DocumentRoot "/var/www/html/Tanke" ServerName www.Tanke.com ErrorLog "/var/log/httpd/www.Tanke1.com-error_log" CustomLog "/var/log/httpd/www.Tanke1.com-access_log" common </VirtualHost> <VirtualHost 192.168.111.136:80> DocumentRoot "/var/www/html/Feiji" ServerName www.Feiji.com ErrorLog "/var/log/httpd/www.Feiji1.com-error_log" CustomLog "/var/log/httpd/www.Feiji1.com-access_log" common </VirtualHost> ...... [root@localhost ~]# httpd -t Syntax OK [root@localhost ~]# ip a //查看是否存在IP192.168.111.136 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 00:0c:29:bb:22:82 brd ff:ff:ff:ff:ff:ff inet 192.168.111.135/24 brd 192.168.111.255 scope global dynamic noprefixroute ens160 valid_lft 1537sec preferred_lft 1537sec inet6 fe80::3d5c:b9d6:55f:48e9/64 scope link noprefixroute valid_lft forever preferred_lft forever [root@localhost ~]# ip addr add 192.168.111.136/24 dev ens160 //添加ＩＰ [root@localhost ~]# ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 00:0c:29:bb:22:82 brd ff:ff:ff:ff:ff:ff inet 192.168.111.135/24 brd 192.168.111.255 scope global dynamic noprefixroute ens160 valid_lft 1463sec preferred_lft 1463sec inet 192.168.111.136/24 scope global secondary ens160 valid_lft forever preferred_lft forever inet6 fe80::3d5c:b9d6:55f:48e9/64 scope link noprefixroute valid_lft forever preferred_lft forever [root@localhost ~]# systemctl restart httpd ／／重启ｈｔｔｐｄ服务 相同IP相同端口不同域名
[root@localhost ~]# vim /etc/httpd/conf.d/httpd-vhosts.conf ...... <VirtualHost *:80> DocumentRoot "/var/www/html/Tanke" ServerName www.Tanke.com ErrorLog "/var/log/httpd/www.Tanke1.com-error_log" CustomLog "/var/log/httpd/www.Tanke1.com-access_log" common </VirtualHost> <VirtualHost *:80> DocumentRoot "/var/www/html/Feiji" ServerName www.Feiji.com ErrorLog "/var/log/httpd/www.Feiji1.com-error_log" CustomLog "/var/log/httpd/www.Feiji1.com-access_log" common </VirtualHost> ...... [root@localhost ~]# httpd -t Syntax OK [root@localhost ~]# systemctl restart httpd 主机名解析
Linux 和MAC系统中修改 /etc/host
windows主机名解析 在C:windowssystem32driversetchosts找到文件无法修改，需要把文件拖到桌面修改，添加解析，再放回原位
7、配置https步骤
https（全称：Hyper Text Transfer Protocol over SecureSocket Layer），是以安全为目标的 http 通道，在 http 的基础上通过传输加密和身份认证保证了传输过程的安全性。
1. mod_ssl模块
mod_ssl 模块可以实现https加密认证。
//安装mod_ssl模块 [root@localhost ~]# dnf install -y mod_ssl a).CACA生成一对密钥
[root@localhost ~]# mkdir /etc/pki/CA [root@localhost ~]# cd /etc/pki/CA [root@localhost CA]# mkdir private [root@localhost CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048) #生成密钥 Generating RSA private key, 2048 bit long modulus (2 primes) ....+++++ ....................................................+++++ e is 65537 (0x010001) [root@localhost CA]# openssl rsa -in private/cakey.pem -pubout #提取公钥 writing RSA key -----BEGIN PUBLIC KEY----- MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2vmOLM61l3syZOvzhO3O 9YzRUTF8IuGVv3F2ASWfUuvYTwq9Q7C5xxqaCOSR73iieQU9mkrtv98a8AoY/Oyd 9fehZbrMxgDUFL7skcRxhYpacYeLfhnDlMLCU73ilVa4K2ZSm4MNLJ6DKDzgOozu wzOTNvvy7wrkHXyMDt4M0DOFc051sPwT4ncBQQKcHjDpi9A8iCAgWTbInNXvLjHg FV2E4HxPlhgzNwf99D01JJVK8qZSeL+aj0gYlmpBvh60czHfi28nqp8qqZocmUXf BDUHK27usf8s3Pmdi/9I1mwGYPOQoH/SzTC3ce9RTd2inzSaQCMdbZe7pmp4rPW2 rwIDAQAB -----END PUBLIC KEY----- b). CA生成自签署证书
[root@localhost CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 365 #生成自签署证书 You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:cn State or Province Name (full name) []:hb Locality Name (eg, city) [Default City]:wh Organization Name (eg, company) [Default Company Ltd]:zsl Organizational Unit Name (eg, section) []:mxx Common Name (eg, your name or your server's hostname) []:www.Tanke1.com Email Address []:123@qq.com [root@localhost CA]# openssl x509 -text -in cacert.pem #读出cacert.pem证书的内容 Certificate: Data: Version: 3 (0x2) Serial Number: 76:a0:c6:d4:e7:7a:4d:dc:21:1b:71:ba:25:8e:74:f3:1b:41:5b:2a Signature Algorithm: sha256WithRSAEncryption Issuer: C = cn, ST = hb, L = wh, O = zsl, OU = mxx, CN = www.Tanke1.com, emailAddress = 123@qq.com Validity Not Before: Jul 21 15:31:42 2022 GMT Not After : Jul 21 15:31:42 2023 GMT Subject: C = cn, ST = hb, L = wh, O = zsl, OU = mxx, CN = www.Tanke1.com, emailAddress = 123@qq.com Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public-Key: (2048 bit) Modulus: 00:da:f9:8e:2c:ce:b5:97:7b:32:64:eb:f3:84:ed: ce:f5:8c:d1:51:31:7c:22:e1:95:bf:71:76:01:25: 9f:52:eb:d8:4f:0a:bd:43:b0:b9:c7:1a:9a:08:e4: 91:ef:78:a2:79:05:3d:9a:4a:ed:bf:df:1a:f0:0a: 18:fc:ec:9d:f5:f7:a1:65:ba:cc:c6:00:d4:14:be: ec:91:c4:71:85:8a:5a:71:87:8b:7e:19:c3:94:c2: c2:53:bd:e2:95:56:b8:2b:66:52:9b:83:0d:2c:9e: 83:28:3c:e0:3a:8c:ee:c3:33:93:36:fb:f2:ef:0a: e4:1d:7c:8c:0e:de:0c:d0:33:85:73:4e:75:b0:fc: 13:e2:77:01:41:02:9c:1e:30:e9:8b:d0:3c:88:20: 20:59:36:c8:9c:d5:ef:2e:31:e0:15:5d:84:e0:7c: 4f:96:18:33:37:07:fd:f4:3d:35:24:95:4a:f2:a6: 52:78:bf:9a:8f:48:18:96:6a:41:be:1e:b4:73:31: df:8b:6f:27:aa:9f:2a:a9:9a:1c:99:45:df:04:35: 07:2b:6e:ee:b1:ff:2c:dc:f9:9d:8b:ff:48:d6:6c: 06:60:f3:90:a0:7f:d2:cd:30:b7:71:ef:51:4d:dd: a2:9f:34:9a:40:23:1d:6d:97:bb:a6:6a:78:ac:f5: b6:af Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Key Identifier: 8F:33:2D:51:A9:40:12:AC:BA:56:09:42:A1:CC:38:E3:4C:2B:79:DF X509v3 Authority Key Identifier: keyid:8F:33:2D:51:A9:40:12:AC:BA:56:09:42:A1:CC:38:E3:4C:2B:79:DF X509v3 Basic Constraints: critical CA:TRUE Signature Algorithm: sha256WithRSAEncryption 22:a1:8f:18:0d:53:a7:1f:59:41:cc:f1:b7:04:0e:9e:9c:23: 2b:ab:e7:47:d0:1c:39:de:e9:b4:99:72:44:ec:1d:40:7c:71: 73:d6:9c:98:d4:03:92:9a:5e:83:60:52:53:db:08:b9:e0:a0: 6b:98:7d:e5:13:0e:6a:3e:04:0f:0c:09:40:bb:1d:94:61:f8: 09:57:d2:d3:6e:32:b7:e5:02:ed:47:88:b7:3a:13:e9:a2:45: 0a:5d:b4:fd:40:96:fb:8f:0a:9d:8b:b4:a6:12:a4:14:b0:95: ee:66:df:3f:3f:a1:bf:cd:e9:ad:7b:48:d5:67:11:4d:22:98: 4e:e3:b5:31:18:41:5d:ee:39:9f:ae:89:ba:69:76:11:3d:82: 37:09:02:69:3e:c2:26:c5:17:8e:97:a3:e4:10:bc:a2:8a:e3: 83:be:83:05:91:59:82:29:fa:34:d8:0d:31:7c:37:3e:28:48: 96:3c:04:38:d1:43:55:da:c5:de:65:ef:bb:3d:db:e8:66:50: 9f:7d:cf:77:4f:d9:55:c9:69:8e:c2:fa:ea:8f:8a:50:5a:c8: da:b1:c5:50:60:fb:74:60:30:3c:01:ce:3e:c5:6c:f6:e2:04: d1:ca:63:70:e8:84:90:b8:32:96:67:22:d2:7d:15:47:34:07: c1:2a:47:70 -----BEGIN CERTIFICATE----- MIIDzzCCAregAwIBAgIUdqDG1Od6TdwhG3G6JY508xtBWyowDQYJKoZIhvcNAQEL BQAwdzELMAkGA1UEBhMCY24xCzAJBgNVBAgMAmhiMQswCQYDVQQHDAJ3aDEMMAoG A1UECgwDenNsMQwwCgYDVQQLDANteHgxFzAVBgNVBAMMDnd3dy5UYW5rZTEuY29t MRkwFwYJKoZIhvcNAQkBFgoxMjNAcXEuY29tMB4XDTIyMDcyMTE1MzE0MloXDTIz MDcyMTE1MzE0MlowdzELMAkGA1UEBhMCY24xCzAJBgNVBAgMAmhiMQswCQYDVQQH DAJ3aDEMMAoGA1UECgwDenNsMQwwCgYDVQQLDANteHgxFzAVBgNVBAMMDnd3dy5U YW5rZTEuY29tMRkwFwYJKoZIhvcNAQkBFgoxMjNAcXEuY29tMIIBIjANBgkqhkiG 9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2vmOLM61l3syZOvzhO3O9YzRUTF8IuGVv3F2 ASWfUuvYTwq9Q7C5xxqaCOSR73iieQU9mkrtv98a8AoY/Oyd9fehZbrMxgDUFL7s kcRxhYpacYeLfhnDlMLCU73ilVa4K2ZSm4MNLJ6DKDzgOozuwzOTNvvy7wrkHXyM Dt4M0DOFc051sPwT4ncBQQKcHjDpi9A8iCAgWTbInNXvLjHgFV2E4HxPlhgzNwf9 9D01JJVK8qZSeL+aj0gYlmpBvh60czHfi28nqp8qqZocmUXfBDUHK27usf8s3Pmd i/9I1mwGYPOQoH/SzTC3ce9RTd2inzSaQCMdbZe7pmp4rPW2rwIDAQABo1MwUTAd BgNVHQ4EFgQUjzMtUalAEqy6VglCocw440wred8wHwYDVR0jBBgwFoAUjzMtUalA Eqy6VglCocw440wred8wDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOC AQEAIqGPGA1Tpx9ZQczxtwQOnpwjK6vnR9AcOd7ptJlyROwdQHxxc9acmNQDkppe g2BSU9sIueCga5h95RMOaj4EDwwJQLsdlGH4CVfS024yt+UC7UeItzoT6aJFCl20 /UCW+48KnYu0phKkFLCV7mbfPz+hv83prXtI1WcRTSKYTuO1MRhBXe45n66Juml2 ET2CNwkCaT7CJsUXjpej5BC8oorjg76DBZFZgin6NNgNMXw3PihIljwEONFDVdrF 3mXvuz3b6GZQn33Pd0/ZVclpjsL66o+KUFrI2rHFUGD7dGAwPAHOPsVs9uIE0cpj cOiEkLgylmci0n0VRzQHwSpHcA== -----END CERTIFICATE----- [root@localhost CA]# mkdir certs newcerts crl [root@localhost CA]# touch index.txt && echo 01 > serial c).客户端（例如httpd服务器）生成密钥
[root@localhost CA]# cd /etc/httpd && mkdir ssl && cd ssl [root@localhost ssl]# (umask 077;openssl genrsa -out httpd.key 2048) Generating RSA private key, 2048 bit long modulus (2 primes) ...+++++ ...........................................................................+++++ e is 65537 (0x010001) d).客户端生成证书签署请求
[root@localhost ssl]# openssl req -new -key httpd.key -days 365 -out httpd.csr Ignoring -days; not generating a certificate You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:cn State or Province Name (full name) []:hb Locality Name (eg, city) [Default City]:wh Organization Name (eg, company) [Default Company Ltd]:zsl Organizational Unit Name (eg, section) []:mxx Common Name (eg, your name or your server's hostname) []:www.Tanke1.com Email Address []:123@qq.com Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: e).CA签署客户端提交上来的证书
[root@localhost ssl]# openssl ca -in httpd.csr -out httpd.crt -days 365 Using configuration from /etc/pki/tls/openssl.cnf Check that the request matches the signature Signature ok Certificate Details: Serial Number: 1 (0x1) Validity Not Before: Jul 21 15:35:07 2022 GMT Not After : Jul 21 15:35:07 2023 GMT Subject: countryName = cn stateOrProvinceName = hb organizationName = zsl organizationalUnitName = mxx commonName = www.Tanke1.com emailAddress = 123@qq.com X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: EA:D9:52:5A:E7:84:C2:09:1A:15:5B:4D:F2:77:23:F0:1D:C1:F9:D0 X509v3 Authority Key Identifier: keyid:8F:33:2D:51:A9:40:12:AC:BA:56:09:42:A1:CC:38:E3:4C:2B:79:DF Certificate is to be certified until Jul 21 15:35:07 2023 GMT (365 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated 2. 在ssl.conf 中配置证书的位置
[root@localhost ~]# cd /etc/httpd/conf.d/ [root@localhost conf.d]# vim ssl.conf ...... //把#DocumentRoot "/var/www/html/Feiji" #ServerName www.Feiji1.com:443#号删除并指定其使用目录路径 <VirtualHost _default_:443> # General setup for the virtual host, inherited from global configuration DocumentRoot "/var/www/html/Feiji" ServerName www.Feiji1.com:443 //配置证书的路径 SSLCertificateFile /etc/httpd/ssl/httpd.crt # Server Private Key: # If the key is not combined with the certificate, use this # directive to point at the key file. Keep in mind that if # you've both a RSA and a DSA private key you can configure # both in parallel (to also allow the use of DSA ciphers, etc.) # ECC keys, when in use, can also be configured in parallel SSLCertificateKeyFile /etc/httpd/ssl/httpd.key ...... 3. 检查配置文件是否有语法错误
[root@localhost conf.d]# httpd -t Syntax OK 4. 重启服务
[root@localhost conf.d]# systemctl restart httpd [root@localhost conf.d]# ss -anlt State Recv-Q Send-Q Local Address:Port Peer Address:Port Process LISTEN 0 128 0.0.0.0:22 0.0.0.0:* LISTEN 0 128 *:443 *:* LISTEN 0 128 *:80 *:* LISTEN 0 128 [::]:22 [::]:* 
