2. 编辑配置文件 C:\UPUPW_AP5.3\Apache2\conf\httpd.conf ，

加载 mod_ssl.so 和 mod_socache_shmcb.so 模块，

启用 httpd-ssl.conf ，

注释掉 ssleay32.dll 和 libeay32.dll

 

3. 编辑配置文件 C:\UPUPW_AP5.3\Apache2\conf\conf\extra\httpd-ssl.conf ，根据实际情况修改主机名和证书路径。如本例的 ServerName 是 portal.anqun.org:443 ，证书存储路径是 C:\UPUPW_AP5.3\Apache2\conf\213466734260268.pem 和 C:\UPUPW_AP5.3\Apache2\conf\213466734260268.key

具体参考https://bbs.aliyun.com/read/309174.html

httpd-ssl.conf如下代码

#
# This is the Apache server configuration file providing SSL support.
# It contains the configuration directives to instruct the server how to
# serve pages over an https connection. For detailed information about these
# directives see <URL:http://httpd.apache.org/docs/2.4/mod/mod_ssl.html>
#
# Do NOT simply read the instructions in here without understanding
# what they do. They’re here only as hints or reminders. If you are unsure
# consult the online docs. You have been warned.
#
# Required modules: mod_log_config, mod_setenvif, mod_ssl,
# socache_shmcb_module (for default value of SSLSessionCache)

#
# Pseudo Random Number Generator (PRNG):
# Configure one or more sources to seed the PRNG of the SSL library.
# The seed data should be of good random quality.
# WARNING! On some platforms /dev/random blocks if not enough entropy
# is available. This means you then cannot use the /dev/random device
# because it would lead to very long connection times (as long as
# it requires to make more entropy available). But usually those
# platforms additionally provide a /dev/urandom device which doesn’t
# block. So, if available, use this one instead. Read the mod_ssl User
# Manual for more details.
#
#SSLRandomSeed startup file:/dev/random 512
#SSLRandomSeed startup file:/dev/urandom 512
#SSLRandomSeed connect file:/dev/random 512
#SSLRandomSeed connect file:/dev/urandom 512
#
# When we also provide SSL we have to listen to the
# standard HTTP port (see above) and to the HTTPS port
#
Listen 443

# SSL Cipher Suite:
# List the ciphers that the client is permitted to negotiate.
# See the mod_ssl documentation for a complete list.
SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5

# Speed-optimized SSL Cipher configuration:
# If speed is your main concern (on busy HTTPS servers e.g.),
# you might want to force clients to specific, performance
# optimized ciphers. In this case, prepend those ciphers
# to the SSLCipherSuite list, and enable SSLHonorCipherOrder.
# Caveat: by giving precedence to RC4-SHA and AES128-SHA
# (as in the example below), most connections will no longer
# have perfect forward secrecy – if the server’s key is
# compromised, captures of past or future traffic must be
# considered compromised, too.
#SSLCipherSuite RC4-SHA:AES128-SHA:HIGH:MEDIUM:!aNULL:!MD5
#SSLHonorCipherOrder on

# Pass Phrase Dialog:
# Configure the pass phrase gathering process.
# The filtering dialog program (`builtin’ is an internal
# terminal dialog) has to provide the pass phrase on stdout.
SSLPassPhraseDialog builtin

# Inter-Process Session Cache:
# Configure the SSL Session Cache: First the mechanism
# to use and second the expiring timeout (in seconds).
#SSLSessionCache “dbm:logs/ssl_scache”
SSLSessionCache “shmcb:logs/ssl_scache(512000)”
SSLSessionCacheTimeout 300

<VirtualHost _default_:443>
DocumentRoot “D:/web”
ServerName id.web.com:443
DirectoryIndex index.html index.htm index.php default.php app.php u.php
ErrorLog logs/id.web.com.log
CustomLog logs/id.web.com.log \
“%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \”%r\” %b”
SSLEngine on
SSLCertificateFile “conf/214793581969046.pem”
SSLCertificateKeyFile “conf/214793518969046.key”
<Directory “D:/web”>
SSLOptions +StdEnvVars
AllowOverride All
Require all granted
</Directory>
<FilesMatch “\.(shtml|phtml|php)$”>
SSLOptions +StdEnvVars
</FilesMatch>
BrowserMatch “MSIE [2-5]” \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0

</VirtualHost>

另在httpd-vhosts.conf可以添加如下代码设置强制http跳转到https

<Directory “D:/web”>
Options FollowSymLinks
AllowOverride All
Require all granted
RewriteEngine on
RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^(.*)?$ https://%{SERVER_NAME}/$1 [L,R=301]
</Directory>