智能机器人（07）：安全证书配置
一、启用 ssl
二、获得证书
三、自建证书
四、服务器的证书部署
五、客户端的证书设置
十、在做一份
对于传输密码或私密信息的http明文没有可靠性可言，需要https，为此需要制作ssl证书。
商业的权威机构用ca来证明某个.crt公钥属于特定组织或个人。.crt证书网站部署的证书文件。.key的私钥可以解密用.crt公钥加密后的信息（小心保管）。而.csr包含了.crt的公钥信息，供网站向CA发起认证请求，中间文件。
一、启用 ssl
$ sudo a2enmod ssl
这条命令相当于做软链接：
$ sudo ln -s /etc/apache2/mods-available/ssl.load /etc/apache2/mods-enabled
$ sudo ln -s /etc/apache2/mods-available/ssl.conf /etc/apache2/mods-enabled
对应的停用是：
$ sudo a2dismod ssl
二、获得证书
这个有自签名的和商业购买的两种方式。 大多数浏览器会对自签署的证书报警，可以从价格比较便宜的Comodo购买， 为了购买先产生自己的私钥和请求文件:
$ openssl req -new -newkey rsa:2048 -nodes -keyout mykey.key -out mycsr.csr
然后发送给 Comodo 购买证书：
Root CA Certificate – AddTrustExternalCARoot.crt
Intermediate CA Certificate – COMODORSAAddTrustCA.crt
Intermediate CA Certificate – COMODORSADomainValidationSecureServerCA.crt
Your PositiveSSL Certificate – mycrt.crt
三、自建证书
3.1 创建CA签名
$ sudo openssl genrsa -des3 -out zdh2.key 1024
如果不使用密码去除-des3选项
3.2、创建CSR
$ sudo openssl req -new -key zdh2.key -out zdh2.csr
3.3、自己签发证书
$ sudo openssl x509 -req -days 3650 -in zdh2.csr -signkey zdh2.key -out zdh2.crt
3.4、或者一步完成：
$ sudo openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout /etc/apache2/ssl/zdh2.key -out /etc/apache2/ssl/zdh2.crt
上面的： openssl，命令行工具；req，证书类型；-x509，需要生成自签名证书文件，而不是证书请求文件；-nodes，不需要密码保护.key文件，否则每次apache都会提示输入密码；
-days 3650，证书有效期；-newkey rsa:2048: 同时生成rsa私钥和证书；-keyout，命名私钥文件；-out，命名证书文件。
四、服务器的证书部署
4.1、复制到某个目录
$ sudo mkdir /etc/apache2/ssl
$ sudo cp zdh.crt /etc/apache2/ssl …..
4.2、修改配置文件
以上步骤后/etc/apache2/sites-available/目录下会在/etc/apache2/sites-enabled/下有软链接，修改它：
$ sudo vim ……sites-enabled/default-ssl.conf
在段中保证以下内容：
SSLEngine On
SSLOptions +StrictRequire ???
SSLCertificateFile /etc/ssl/certs/zdh.crt
SSLCertificateKeyFile /etc/ssl/private/zdh.key
4.3、监听端口
检查/etc/apache2/ports.conf文件中443>(ssl的端口)
已经监听:
Listen 443
4.4、此时启动apache会提示输密码，如果不想的话在httpd.conf修改IfModule ssl_module 配置：
“SSLPassPhraseDialog exec:/home/admin/xxx/conf/apache_pass.sh”
而 apache_pass.sh 内容就是显示密码：
#!/bin/sh
echo “password”
4.5、测试部署
在客户机从浏览器访问：
https://serverIP
浏览器可能报警证书问题。需要通过下面步骤对客户机的证书做设置。
五、客户端的证书设置
7.1 Chrome
Q: 如果browser是google的chrome的话，会报错“Failed to get access to local media. Error code was Permission Denied”
因为，chrome needs https to use get user media，Updated to secure http and everything works fine.
由于，Starting with Chrome 47, getUserMedia() requests only allowed from secure HTTPS or localhost, so need to setup a self signed ssl certificate for webserver and and access with https://722.20.10.11:8080
所以，如果使用chrome浏览器的话，可以部署自签署证书采用ssl实现https。
如果一定要选择http实现webrtc的话，那就用firefox浏览器不要用chrome。
Q: how to always accept webRTC webcam request in chrome?
if command line:
$ google-chrome “http://localhost” –use-fake-ui-for-media-stream
which avoids the need to grant camera/microphone permissions.
or, on Chrome:
chrome://settings/content#media-stream-mic
APP: List of Chromium Command Line Switches
http://peter.sh/experiments/chromium-command-line-switches/
7.2 Firefox
Q: how to always accept webRTC webcam request in firefox?
Go in url about:config
Search media.navigator.permission.disabled
dbClick or set value to true
7.3 Setup ssl https connection
As mentioned earlier, apps running on Chrome browsers can’t access local cameras and microphones unless the application is hosted from localhost or an SSL server (https).
When you are doing development, it is simplest to get node.js to handle the SSL. Benefits of using SSL:
* Increase end user confidence
* Secure signaling traffic from eavesdroppers
* In Chrome: Browser remembers camera and microphone sharing preference for site. Does not re-ask at each – visit.
* In Chrome: Enables screen sharing API
Before applying, you will need to generate a CSR (Certificate Signing Request). The most common software used for generating CSR’s and handling SSL is OpenSSL,
There are many operating system specific guides available for how to use SSL on your server Self signed certificates are a free method of creating a certificate suitable for development. A warning will occur when browsing your site.
http://www.selfsignedcertificate.com/ <— from thi st ogenerate or, You can create a key and certificate yourself instead of downloading them from this page. This makes your key more secure. To generate a key: $ openssl genrsa -out 172.20.10.3.key 2048 And the certificate: $ openssl req -new -x509 -key 172.20.10.3.key -out 172.20.10.3.cert -days 3650 -subj /CN=172.20.10.3 or, to buy one http://bit.ly/i95aUS 如果是商业购买的，证书链可靠，浏览器不需要设置。 如果是自签名的，需要导入或下载证书，各个浏览器不同。 5.1、Firefox 这个在访问https://serverIP时， 会提示网站不可信任。 那么添加例外就可以： exception->confirm security exception https://serverIP ok，就可以通过ip地址访问。 5.2、Chrome 这个访问https://IP-address，浏览器： Your connection is not private Attackers might be trying to steal your information from 116.50.77.22 (for example, passwords, messages or credit cards). NET::ERR_CERT_COMMON_NAME_INVALID 具体的： This server could not prove that it is 116.50.77.22; its security certificate is not trusted by your computer’s operating system. This may be caused by a misconfiguration or an attacker intercepting your connection. Proceed to 116.50.77.22 (unsafe) 所以，同样需要添加证书： edit->preference->advanced setting->https/ssl->authorities->import->ok. 但是， Chrome非常憎恨自签署证书Why does Chrome hate self-signed certificates so much。 浏览器依然不能像http那样通过IP地址访问服务器，对于https://serverIP这种方式依然报警： Server’s certificate does not match the URL 所以，需要根据证书里Issued to的域名信息修改： $ vi /etc/hosts 10.10.0.1 dehaou14-n501jw $ ping dehaou14-n501jw ok https://dehaou14-n501jw/ ok
十、在做一份
对于webRTC的nodejs使用8080端口的音视频聊天服务，重复上述步骤，生成zdh2_rtc.crt和zdh2_rtc.key，重复上述步骤部署。
rris
rris