{"id":169,"date":"2014-05-01T22:10:13","date_gmt":"2014-05-01T19:10:13","guid":{"rendered":"https:\/\/dlshad.net\/?p=169"},"modified":"2014-05-01T22:10:13","modified_gmt":"2014-05-01T19:10:13","slug":"%d8%aa%d8%b3%d8%ac%d9%8a%d9%84-%d8%a7%d9%84%d8%af%d8%ae%d9%88%d9%84-%d8%b9%d9%86-%d8%b7%d8%b1%d9%8a%d9%82-%d8%b4%d9%87%d8%a7%d8%af%d8%a7%d8%aa-%d8%a7%d9%84%d8%aa%d8%b4%d9%81%d9%8a%d8%b1-certificate-ba","status":"publish","type":"post","link":"https:\/\/dlshad.net\/%d8%aa%d8%b3%d8%ac%d9%8a%d9%84-%d8%a7%d9%84%d8%af%d8%ae%d9%88%d9%84-%d8%b9%d9%86-%d8%b7%d8%b1%d9%8a%d9%82-%d8%b4%d9%87%d8%a7%d8%af%d8%a7%d8%aa-%d8%a7%d9%84%d8%aa%d8%b4%d9%81%d9%8a%d8%b1-certificate-ba\/","title":{"rendered":"\u062a\u0633\u062c\u064a\u0644 \u0627\u0644\u062f\u062e\u0648\u0644 \u0639\u0646 \u0637\u0631\u064a\u0642 \u0634\u0647\u0627\u062f\u0627\u062a \u0627\u0644\u062a\u0634\u0641\u064a\u0631 certificate-based authentication \u0641\u064a \u0633\u064a\u0631\u0641\u0631\u0627\u062a \u0627\u0644\u0623\u0628\u0627\u062a\u0634\u064a"},"content":{"rendered":"

\u0623\u0642\u0648\u0645 \u0627\u0644\u0623\u0646 \u0628\u0623\u0639\u062f\u0627\u062f \u062a\u0637\u0628\u064a\u0642 \u0648\u064a\u0628 \u064a\u062e\u0635 \u0639\u0645\u0644\u064a , \u064a\u062d\u062a\u0648\u064a \u0627\u0644\u062a\u0637\u0628\u064a\u0642 \u0639\u0644\u0649 \u0645\u0639\u0644\u0648\u0645\u0627\u062a \u062d\u0633\u0627\u0633\u0629 \u062c\u062f\u0627\u064b \u0644\u0630\u0627 \u0637\u064f\u0644\u0628 \u0645\u0646\u064a \u0628\u0646\u0627\u0621 \u0646\u0638\u0627\u0645 \u064a\u062d\u0645\u064a \u0627\u0644\u0628\u064a\u0627\u0646\u0627\u062a \u0627\u0644\u062d\u0633\u0627\u0633\u0629 \u0648 \u064a\u0633\u0645\u062d \u0628\u062f\u062e\u0648\u0644 \u0627\u0644\u0623\u0634\u062e\u0627\u0635 \u0627\u0644\u0645\u062e\u0648\u0644\u064a\u0646 \u0641\u0642\u0637 \u0644\u0644\u062a\u0637\u0628\u064a\u0642.<\/p>\n

\u0642\u0645\u062a \u0628\u0627\u0644\u0628\u062f\u0627\u064a\u0629 \u0628\u0623\u062c\u0631\u0627\u0621 \u0642\u0627\u0626\u0645\u0629 \u0628\u064a\u0636\u0627\u0621 White list \u00a0\u062a\u0633\u0645\u062d \u0644\u0628\u0639\u0636 \u0639\u0646\u0648\u0627\u064a\u0646 \u0627\u0644\u0640 IP \u0627\u0644\u0645\u062e\u0648\u0644\u0629 \u0641\u0642\u0637 \u0644\u062f\u062e\u0648\u0644 \u0627\u0644\u062a\u0637\u0628\u064a\u0642, \u0648 \u0644\u0643\u0646 \u064a\u0648\u062c\u062f \u0637\u0631\u064a\u0642\u0629 \u0627\u0642\u0648\u0649 \u0645\u0646 \u0630\u0644\u0643.<\/p>\n

\u0627\u0644\u0641\u0643\u0631\u0629 \u0623\u0646 \u0633\u064a\u0631\u0641\u0631 \u0627\u0644\u0640 Apache \u064a\u0633\u0645\u0639 \u0628\u0645\u0627 \u064a\u0633\u0645\u0649 certificate-based authentication \u0648 \u0627\u0644\u062a\u064a \u0647\u064a \u0639\u0628\u0627\u0631\u0629 \u0639\u0646 \u0634\u0647\u0627\u062f\u0629 \u062a\u0634\u0641\u064a\u0631 \u0639\u0627\u0645\u0629 \u0648 \u062e\u0627\u0635\u0629, \u062a\u0632\u0631\u0639 \u0627\u0644\u0634\u0647\u0627\u062f\u0629 \u0641\u064a \u0645\u062a\u0635\u0641\u062d \u0627\u0644\u0645\u0633\u062a\u062e\u062f\u0645 \u0639\u0646\u062f\u0647\u0627 \u0641\u0623\u0646 \u0627\u0644\u0627\u0634\u062e\u0627\u0635 \u0627\u0644\u0630\u064a\u0646 \u064a\u0645\u062a\u0644\u0643\u0648\u0646 \u0630\u0627\u062a \u0627\u0644\u0640 IP address \u00a0\u0627\u0644\u0645\u062e\u0648\u0644 \u0644\u0647\u0645 \u0628\u062f\u062e\u0648\u0644 \u0627\u0644\u062a\u0637\u0628\u064a\u0642 \u0644\u0646 \u064a\u0633\u062a\u0637\u064a\u0639\u0648\u0627 \u0627\u0644\u062f\u062e\u0648\u0644 \u0645\u0627\u0644\u0645 \u064a\u0645\u062a\u0644\u0643\u0648\u0627 \u0634\u0647\u0627\u062f\u0629 \u0627\u0644\u062a\u0634\u0641\u064a\u0631 \u0639\u0644\u0649 \u0645\u062a\u0635\u0641\u062d\u0647\u0645 \u0627\u0644\u0634\u062e\u0635\u064a.<\/p>\n

<\/p>\n

\u064a\u062f\u0639\u0645 \u0633\u064a\u0631\u0641\u0631 \u0627\u0644\u0640 Apache \u00a0\u0645\u064a\u0632\u0629 \u0627\u0644\u062a\u062d\u0642\u0642 \u0645\u0646 \u0627\u0644\u0645\u0633\u062a\u062e\u062f\u0645\u064a\u0646 \u0639\u0646 \u0637\u0631\u064a\u0642 \u0627\u0644\u0640 SSL \u00a0\u0644\u0630\u0627 \u0641\u0627\u0646 \u0639\u0645\u0644\u064a\u0629 \u062a\u0628\u0627\u062f\u0644 \u0627\u0644\u0628\u064a\u0627\u0646\u0627\u062a \u0645\u0627\u0628\u064a\u0646 \u0627\u0644\u0645\u0633\u062a\u062e\u062f\u0645 \u0648 \u0627\u0644\u0633\u064a\u0631\u0641\u0631 \u0633\u062a\u0643\u0648\u0646 \u0645\u0634\u0641\u0631\u0629 \u0627\u064a\u0636\u0627\u064b.<\/p>\n

\u064a\u062a\u0645 \u062a\u0641\u0639\u064a\u0644 \u0627\u0644\u0645\u064a\u0632\u0629 \u0628\u0648\u0627\u0633\u0637\u0629 \u0625\u0636\u0627\u0641\u0629 \u0627\u0644\u0645\u0641\u062a\u0627\u062d \u0648 \u0627\u0644\u0634\u0647\u0627\u062f\u0629 \u0628\u062f\u0627\u062e\u0644 \u0645\u062c\u0644\u062f \u0623\u0639\u062f\u0627\u062f\u0627\u062a \u0627\u0644\u0627\u0628\u0627\u062a\u0634\u064a, \u0648 \u0628\u0627\u0644\u0630\u0627\u062a \u0628\u062f\u0627\u062e\u0644 \u0645\u062c\u0644\u062f \u0634\u0647\u0627\u062f\u0627\u062a \u0627\u0644\u0640 SSL.<\/p>\n

\u0648 \u0645\u0646 \u062b\u0645 \u0625\u0636\u0627\u0641\u0629 \u0627\u0644\u0623\u0633\u0637\u0631 \u0627\u0644\u062a\u0627\u0644\u064a\u0629 \u0627\u0644\u0649 \u0645\u0644\u0641 apache config file or httpd.conf \u00a0\u0644\u064a\u062a\u0645 \u062a\u0641\u0639\u064a\u0644 \u0627\u0644\u0645\u064a\u0632\u0629.<\/p>\n

\n

SSLEngine on<\/strong><\/p>\n

SSLCipherSuite<\/strong><\/p>\n

ALL:!ADH:!EXPORT56:RC4+RSA:<\/strong><\/p>\n

+HIGH:+MEDIUM:+LOW:+SSLv2:<\/strong><\/p>\n

+EXP:+eNULL<\/strong><\/p>\n

SSLCertificateFile conf\/ssl\/<\/strong><\/p>\n

myserver.crt<\/strong><\/p>\n

SSLCertificateKeyFile conf\/ssl\/<\/strong><\/p>\n

myserver.key<\/strong><\/p>\n<\/blockquote>\n

\u0641\u064a \u0647\u0630\u0647 \u0627\u0644\u062d\u0627\u0644\u0629 \u0641\u0623\u0646 \u0633\u064a\u0631\u0641\u0631 \u0627\u0644\u0627\u0628\u0627\u062a\u0634\u064a \u0633\u064a\u0642\u0648\u0645 \u0628\u062a\u0641\u0639\u064a\u0644 \u0627\u0644\u0645\u0646\u0641\u0630 443 \u0648 \u0627\u0633\u062a\u0642\u0628\u0627\u0644 \u0627\u0644\u0623\u062a\u0635\u0627\u0644\u0627\u062a \u0639\u0628\u0631\u0647, \u0648 \u0644\u0643\u0646 \u0644\u0646 \u064a\u0633\u0645\u062d \u0644\u0623\u062d\u062f \u0628\u0627\u0644\u062f\u062e\u0648\u0644 \u0645\u0627\u0644\u0645 \u064a\u0645\u062a\u0644\u0643 \u0627\u0644\u0634\u0647\u0627\u062f\u0629 \u0627\u0644\u0645\u062e\u0635\u0635\u0629 \u0644\u0644\u062a\u0634\u0641\u064a\u0631.<\/strong><\/p>\n

\u0644\u0625\u0636\u0627\u0641\u0629 \u0639\u062f\u0629 \u0645\u0633\u062a\u062e\u062f\u0645\u064a\u0646 ( \u0639\u062f\u0629 \u0634\u0647\u0627\u062f\u0627\u062a ) \u0642\u0645 \u0628\u0625\u0636\u0627\u0641\u0629 \u0627\u0644\u0623\u0633\u0637\u0631 \u0627\u0644\u062a\u0627\u0644\u064a\u0629 \u0627\u0644\u0649 \u0645\u0644\u0641 \u0627\u0639\u062f\u0627\u062f\u0627\u062a \u0627\u0644\u0627\u0628\u0627\u062a\u0634\u064a httpd.conf<\/p>\n

\n

SSLVerifyClient require<\/strong><\/p>\n

SSLVerifyDepth 1<\/strong><\/p>\n

SSLCACertificateFile conf\/ssl\/myserver.crt<\/strong><\/p>\n<\/blockquote>\n

\u0641\u064a \u0647\u0630\u0647 \u0627\u0644\u062d\u0627\u0644\u0629, \u0644\u0646 \u064a\u0633\u0645\u062d \u0644\u0623\u064a \u0645\u0633\u062a\u062e\u062f\u0645 \u0628\u0627\u0644\u062f\u062e\u0648\u0644 \u0645\u0627\u0639\u062f\u0627 \u0627\u0644\u0645\u0633\u062a\u062e\u062f\u0645\u064a\u0646 \u0627\u0644\u0630\u064a\u0646 \u062a\u0645 \u062a\u0648\u0642\u064a\u0639 \u0634\u0647\u0627\u062f\u0627\u062a\u0647\u0645 \u0628\u0648\u0627\u0633\u0637\u0629 \u0627\u0644\u0633\u064a\u0631\u0641\u0631 \u0627\u0644\u062e\u0627\u0635 \u0628\u0643.<\/strong><\/p>\n

\u0644\u0623\u0646\u0634\u0627\u0621 \u0627\u0644\u0634\u0647\u0627\u062f\u0627\u062a \u0644\u0644\u0645\u062a\u0633\u062e\u062f\u0645\u064a\u0646 , \u0642\u0645 \u0628\u062a\u0646\u0641\u064a\u0630 \u0627\u0644\u0623\u0648\u0627\u0645\u0631 \u0627\u0644\u062a\u0627\u0644\u064a\u0629:<\/p>\n

\n

openssl genrsa -des3 -out username.key 1024<\/strong><\/p>\n

openssl req -new -key username.key -out username.csr<\/strong><\/p>\n

openssl x509 -req -in username.csr -out username.crt -sha1<\/strong><\/p>\n

-CA myserver.crt -CAkey myserver.key<\/strong><\/p>\n

-CAcreateserial -days 365<\/strong><\/p>\n

openssl pkcs12-export -in username.crt -inkey username.key<\/strong><\/p>\n

-name “$USER Cert” -out username.p12<\/strong><\/p>\n

openssl pkcs12 -in username.p12 -clcerts -nokeys -info<\/strong><\/p>\n<\/blockquote>\n

\u0641\u064a \u0645\u0631\u062d\u0644\u0629 \u0627\u0644\u062a\u0635\u062f\u064a\u0631 Export \u00a0\u0633\u064a\u062a\u0645 \u0637\u0644\u0628 \u0643\u0644\u0645\u0629 \u0633\u0631 \u0627\u0644\u062a\u0635\u062f\u064a\u0631 Export password \u0647\u064a \u0645\u0631\u062d\u0644\u0629 \u0636\u0631\u0648\u0631\u064a\u0629 \u0628\u0627\u0644\u0623\u0636\u0627\u0641\u0629 \u0644\u0645\u0644\u0641 username.p12 , \u0645\u0646 \u0627\u062c\u0644 \u062a\u0631\u0643\u064a\u0628 \u0627\u0644\u0634\u0647\u0627\u062f\u0629 \u0639\u0644\u0649 \u0645\u062a\u0635\u0641\u062d \u0627\u0644\u0645\u0633\u062a\u062e\u062f\u0645.<\/p>\n

\u0627\u0644\u0633\u0637\u0631 \u0627\u0644\u0623\u062e\u064a\u0631 \u064a\u0638\u0647\u0631 \u0644\u0643 \u062a\u0641\u0627\u0635\u064a\u0644 \u0627\u0644\u0634\u0647\u0627\u062f\u0629.<\/p>\n

\u0648 \u0645\u0646 \u062b\u0645 \u0633\u062a\u0642\u0648\u0645 \u0628\u0625\u0631\u0633\u0627\u0644 \u0627\u0644\u0634\u0647\u0627\u062f\u0629 \u0644\u0644\u0645\u0633\u062a\u062e\u062f\u0645 \u0648 \u0627\u0644\u0630\u064a \u0628\u062f\u0648\u0631\u0647 \u0633\u064a\u0642\u0648\u0645 \u0628\u062a\u0631\u0643\u064a\u0628\u0647\u0627 \u0639\u0644\u0649 \u0627\u0644\u0645\u062a\u0635\u0641\u062d, \u0627\u0648 \u0628\u0623\u0645\u0643\u0627\u0646\u0643 \u0643\u0645\u062f\u064a\u0631 \u0644\u0644\u0646\u0638\u0627\u0645 \u062a\u0631\u0643\u064a\u0628 \u0627\u0644\u0634\u0647\u0627\u062f\u0629 \u0639\u0644\u0649 \u0645\u062a\u0635\u0641\u062d\u0627\u062a \u0627\u0644\u0645\u0633\u062a\u062e\u062f\u0645\u064a\u0646 \u064a\u062f\u0648\u064a\u0627\u064b \u0645\u0645\u0627 \u0633\u064a\u0645\u0646\u0639\u0647\u0645 \u0645\u0646 \u0633\u062d\u0628 \u0627\u0644\u0634\u0647\u0627\u062f\u0629 \u0648 \u062a\u0631\u0643\u064a\u0628\u0647\u0627 \u0639\u0644\u0649 \u062d\u0627\u0633\u0648\u0628 \u0627\u062e\u0631, \u0641\u064a \u0633\u0628\u064a\u0644 \u0632\u064a\u0627\u062f\u0629 \u0627\u0644\u0623\u0645\u0627\u0646.<\/p>\n

\u0627\u0644\u0645\u0635\u0627\u062f\u0631<\/p>\n

1-\u00a0\u00a0\u00a0\u00a0\u00a0 Apache website httpd.apache<\/strong>.org<\/p>\n

2-\u00a0\u00a0\u00a0\u00a0\u00a0 Add certificate-based authentication to LAMP server http:\/\/www.tuxradar.com\/answers\/368<\/p>\n

\n

\"Share<\/a>