2007年10月26日 存档

Apache整合Tomcat的vhosts及mod_jk配置

2007年10月26日,星期五

httpd-vhosts.conf的配置例子如下:

#
# Virtual Hosts
#
# If you want to maintain multiple domains/hostnames on your
# machine you can setup VirtualHost containers for them. Most configurations
# use only name-based virtual hosts so the server doesn’t need to worry about
# IP addresses. This is indicated by the asterisks in the directives below.
#
# Please see the documentation at
# <URL: http://httpd.apache.org/docs/2.2/vhosts/ >
# for further details before you try to setup virtual hosts.
#
# You may use the command line option ‘-S’ to verify your virtual host
# configuration.

#
# Use name-based virtual hosting.
#

LoadModule headers_module modules/mod_headers.so
LoadModule expires_module modules/mod_expires.so

ExpiresActive On
ExpiresByType text/css A259200
#text/css类型文件的过期设置为“访问后的259200秒”
ExpiresByType application/x-javascript A259200
# application/x-javascript类型文件的过期设置为“访问后的300秒”
ExpiresByType image/png A2592000
#image/png类型文件的过期设置为“访问后的2592000秒”
ExpiresByType image/gif A2592000
#image/gif类型文件的过期设置为“访问后的2592000秒”
ExpiresByType application/x-shockwave-flash A2592000
# application/x-shockwave-flash类型文件的过期设置为“访问后的2592000秒”

LoadModule deflate_module modules/mod_deflate.so
AddOutputFilterByType DEFLATE text/html text/plain text/xml text/javascript text/css

NameVirtualHost *

#
# VirtualHost example:
# Almost any directive may go into a VirtualHost container.
# The first VirtualHost section is used for all requests that do not
# match a ServerName or ServerAlias in any <VirtualHost> block.
#

LoadModule jk_module modules/-apache-2.2.4.so

JkWorkersFile conf/workers.properties
JkLogFile logs/mod_jk.log
JklogLevel error
JkOptions +ForwardURICompatUnparsed
JkOptions +ForwardSSLCertChain

<VirtualHost *>
ServerAdmin admin@www.618119.com
DocumentRoot /www/docs/www.618119.com
ServerName 618119.com
ServerAlias www.618119.com
ErrorLog logs/www.618119.com-error.log
CustomLog “|bin/cronolog.exe logs/www.618119.com-access%Y%m%d.log” combined
JkMount / www
JkMount /* www
JkMount /jkstatus jkstatus
<Location /jkstatus>
Order deny,allow
Allow from 127.
</Location>

</VirtualHost>

<VirtualHost *>
ServerAdmin admin@blog.618119.com
DocumentRoot /www/docs/blog.618119.com
ServerName www.blog.618119.com
ServerAlias *.blog.618119.com
ErrorLog logs/blog.618119.com-error.log
CustomLog “|bin/cronolog.exe logs/blog.618119.com-access%Y%m%d.log” combined
JkMount /* blog
JkMount /jkstatus jkstatus
<Location /jkstatus>
Order deny,allow
Allow from 127.
</Location>
</VirtualHost>

<VirtualHost *>
ServerAdmin admin@www.618119.com
DocumentRoot /www/docs/lizongbo.618119.com
ServerName lizongbo.618119.com
ErrorLog logs/lizongbo.618119.com-error.log
CustomLog “|bin/cronolog.exe logs/lizongbo.618119.com-access%Y%m%d.log” combined
JkMount / ring
JkMount /* ring

</VirtualHost>

(更多…)

Tags: , , , ,

配置windows下的curl来获取https页面内容

2007年10月26日,星期五

刚刚看到了javayou提到了可以在windows下使用的curl命令,

http://www.javayou.com/html/diary/showlog.vm?sid=2&log_id=13985

于是下载了支持ssl的curl来使用:
下载连接为: http://www.execve.net/curl/curl-7.17.0-win32-ssl.zip

解压到D:\Programs\-7.17.0
下载OpenSSL组件:

http://618119.com/OpenSSL/libeay32.dll

http://618119.com/OpenSSL/libssl32.dll

将libssl32.dll和libeay32.dll复制到D:\Programs\curl-7.17.0,

否则运行curl.exe会被提示:

—————————
curl.exe – 无法找到组件
—————————
没有找到 libeay32.dll,因此这个应用程序未能启动。重新安装应用程序可能会修复此问题。
—————————
确定
—————————

—————————
curl.exe – 无法找到组件
—————————
没有找到 ,因此这个应用程序未能启动。重新安装应用程序可能会修复此问题。
—————————
确定
—————————
(参考: http://618119.com/archives/2007/10/26/15.html)
如果需要连接的网站使用的证书不是操作系统已经信任的证书,则需要指定ca根证书文件.
并且服务器的证书CN必须与url里的host一致,否则无法下载.

测试命令示例如下:

curl https://www.google.com/

curl https://www.618119.com/

curl https://lizongbo.618119.com/ ca.crt

D:\Programs\curl-7.17.0>curl https://www.google.com/
<HTML><HEAD><meta http-equiv=”content-type” content=”text/html;charset=utf-8″>
<TITLE>302 Moved</TITLE></HEAD><BODY>
<H1>302 Moved</H1>
The document has moved
<A href=”http://www.google.com”>here</A>.
</BODY></HTML>

D:\Programs\curl-7.17.0>curl https://618119.com/
curl: (60) SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify faile
d
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a “bundle”
of Certificate Authority (CA) public keys (CA certs). The default
bundle is named curl-ca-bundle.crt; you can specify an alternate file
using the –cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you’d like to turn off curl’s verification of the certificate, use
the -k (or –insecure) option.

D:\Programs\curl-7.17.0>curl https://lizongbo.618119.com/ –cacert ca.crt
curl: (51) SSL: certificate subject name ’618119.com’ does not match target host name ‘lizongbo.618119.com’

Tags: , , ,

关于OpenSSL里libssl32.dll与ssleay32.dll的区别

2007年10月26日,星期五

现在很多程序都提供了ssl功能,但是在安装程序中并未自带OpenSSL组件,需要额外下载,因此选择不同版本OpenSSL的时候,可能会遇到如下的错误信息:

—————————
.exe – 无法找到组件
—————————
没有找到 ,因此这个应用程序未能启动。重新安装应用程序可能会修复此问题。
—————————
确定
—————————

或者:

—————————
lighttpd.exe – 无法找到组件
—————————
没有找到 ,因此这个应用程序未能启动。重新安装应用程序可能会修复此问题。
—————————
确定
—————————

网上相关的问题有:

http://curl.haxx.se/mail/archive-2002-09/0063.html

libssl32.dll与ssleay32.dll的实际内容是没有任何区别,只是openssl在版本升级之后,
将在win32平台上编译生成的文件名libssl32.dll修改成了ssleay32.dll,libeay32.dll的名字则没改变.
(OpenSSL的changelog里并没有提到文件名变化的问题,参见: http://www.openssl.org/news/changelog.html )
而很多依赖openssl的程序里,在加载OpenSSL的dll时,使用了固定的文件名字.只加载libssl32.dll或者ssleay32.dll,
因此在找不到文件的时候不会尝试另外一个文件名,就直接提示出错信息.

解决的办法也很简单,就是根据程序需要调用的dll名字,将libssl32.dll修改成ssleay32.dll,或者将ssleay32.dll修改成libssl32.dll.

对于开发者来说,为了让使用者少走弯路,在加载dll的时候,代码可以改成下面这个样子:
(参考这里的讨论: http://forums.miranda-im.org/showthread.php?t=4545)
if (( hLibSSL = LoadLibrary( “SSLEAY32.DLL” )) == NULL ) {
if (( hLibSSL = LoadLibrary( “LIBSSL32.DLL” )) == NULL ) { //the oldname

MSN_ShowError( “Valid %s must be installed to perform the SSL login”, “SSLEAY32.DLL” );
return 1;
}       } }

OpenSSL当前最新版本为OpenSSL 0.9.8g ,也就是OpenSSL 0.9.8.7 ,
编译好的 dll文件可以在这里下载

http://www.apachelounge.com/download/binaries/OpenSSL_0.9.8g.zip

来源: http://www.apachelounge.com/download/

如果只想下载就使用,懒得重命名的话:
可以直接下载我放在服务器上的文件:
(libssl32.dll与ssleay32.dll是一样的)

http://618119.com/OpenSSL/libeay32.dll

http://618119.com/OpenSSL/libssl32.dll

http://618119.com/OpenSSL/ssleay32.dll

除了将OpenSSL的dll加载的方式来使用OpenSSL,也可以采取直接编译进程序的方法来使用OpenSSL,比如
Tomcat的APR组件,就是将APR和OpenSSL直接编译进来,使用非常方便:
参考: http://tomcat.apache.org/tomcat-6.0-doc/apr.html

Tags: , , ,