1、在CA机器上生成证书；

[root@ca /etc/pki/CA]# openssl ca -in httpd.csr -out certs/httpd.crt -days 300                    #颁发证书并设置有效期300天
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for /etc/pki/CA/private/cakey.pem:                                              #每次都要输入口令密码，所以在做测试时可以考虑不加密；
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Oct 22 03:08:16 2017 GMT
            Not After : Aug 18 03:08:16 2018 GMT
        Subject:                                                                                 #申请方信息
            countryName               = CN
            stateOrProvinceName       = henan
            organizationName          = magedu.com
            organizationalUnitName    = opt
            commonName                = www.sjj.com
            emailAddress              = admin@qq.com
        X509v3 extensions:
            X509v3 Basic Constraints:        
                CA:FALSE
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
                2B:83:77:0F:57:7F:B9:49:EA:00:00:A7:B2:C3:70:11:1D:5B:8F:A7
            X509v3 Authority Key Identifier: 
                keyid:2F:6B:1D:F4:78:8C:DF:1A:17:2E:66:C9:EB:BF:EB:9C:D7:2A:B1:9D

Certificate is to be certified until Aug 18 03:08:16 2018 GMT (300 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

#注意：若是没有事先创建index.txt和serial两个文件，在颁发证书时是会报错的，所以就根据其错误提示，去创建文件就可以了

[root@ca /etc/pki/CA]# tree
.
├── cacert.pem
├── certs
│   └── httpd.crt #生成证书文件
├── crl
├── httpd.csr #B机器发来的申请证书文件
├── index.txt #颁发证书后生成的新的数据库文件 
├── index.txt.attr
├── index.txt.old
├── newcerts
│   └── 01.pem
├── private
│   └── cakey.pem #根CA自己的私钥文件
├── serial
└── serial.old
[root@ca /etc/pki/CA]# cat index.txt       # 颁发证书后生成的新的数据库文件，里面有申请方信息；而之前的数据库文件里面仍为空，并重命名为index.txt.old
        
V       180818030816Z           01      unknown /C=CN/ST=henan/O=magedu.com/OU=opt/CN=www.sjj.com/emailAddress=admin@qq.com
[root@ca /etc/pki/CA]#

2、将生成的证书传回申请方B机器；

[root@ca /etc/pki/CA]# scp certs/httpd.crt 192.168.242.206:/etc/httpd/conf.d/ssl/        #都统一放在一个目录下 
The authenticity of host '192.168.242.206 (192.168.242.206)' can't be established.
RSA key fingerprint is 30:49:c8:65:14:10:12:ba:93:8c:da:97:23:03:b1:88.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.242.206' (RSA) to the list of known hosts.
root@192.168.242.206's password: 
httpd.crt                      100% 4533     4.4KB/s   00:00    
[root@ca /etc/pki/CA]# 

同时将CA自己的证书也拷过去；

四：定义服务器配置文件；

	SSLCertificateFile /etc/pki/tls/certs/localhost.crt          #证书路径
	SSLCertificateKeyFile /etc/pki/tls/private/localhost.key     #key路径
	#SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt #CA的路径---》本来是被注释掉的，这样在查看证书时，就看不到根CA了，
改为：
	SSLCertificateFile /etc/httpd/conf.d/ssl/httpd.crt               
	SSLCertificateKeyFile /etc/httpd/conf.d/ssl/httpd.key   
	SSLCACertificateFile /etc/httpd/conf.d/ssl/cacert.pem   #我们可以启动，在证书里就可以看到根CA了；

[root@client /etc/pki/CA]# getenforce            #查询状态
Enforcing                     
[root@client /etc/pki/CA]# setenforce 0
[root@client /etc/pki/CA]#  getenforce 
Permissive                                     #要处于禁止状态，所以用setenforce 0设置一下；

三：实验测试；                                                                            

[root@server ~]# cat /var/www/html/index.html 
Centos 6

在客户端A上用curl命令检测一下；

[root@client /etc/pki/CA]# curl http://192.168.242.206/                         #直接用http可以连接
Centos 6
[root@client /etc/pki/CA]# curl https://192.168.242.206/                        #用https连接需要证书
curl: (60) Peer certificate cannot be authenticated with known CA certificates
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.
[root@client /etc/pki/CA]#curl -k https://192.168.242.206/                      #因为CA证书目前在A上是不安全的，所以加上-k（忽略证书）之后就可以显示页面了
Centos 6

然后我们可以在网页浏览器上看，效果比较明显；

1、我们在windows下的“c:WindowsSystem32driversetc”里的hosts文件里添加上：192.168.242.206    www.sjj.com ； 172.17.0.108    www.sjj.com;

2、我们使用名字去访问站点；

下面用的是火狐浏览器

希望看到此贴的大神们，帮一下忙，感谢！！！