{"id":230079,"date":"2023-12-25T14:33:26","date_gmt":"2023-12-25T06:33:26","guid":{"rendered":"https:\/\/www.idc.net\/help\/230079\/"},"modified":"2023-12-25T14:33:26","modified_gmt":"2023-12-25T06:33:26","slug":"apache%e6%96%b0%e6%89%8b%e6%95%99%e7%a8%8b%ef%bc%9a%e9%85%8d%e7%bd%aeocsp-stapling","status":"publish","type":"post","link":"https:\/\/idc.net\/help\/230079\/","title":{"rendered":"Apache\u65b0\u624b\u6559\u7a0b\uff1a\u914d\u7f6eOCSP Stapling"},"content":{"rendered":"

Apache\u65b0\u624b\u6559\u7a0b\uff1a\u914d\u7f6eOCSP Stapling<\/h1>\n

\u5728\u4fdd\u62a4\u7f51\u7ad9\u5b89\u5168\u65b9\u9762\uff0cSSL\u8bc1\u4e66\u662f\u4e00\u9879\u91cd\u8981\u7684\u63aa\u65bd\u3002\u7136\u800c\uff0c\u4f20\u7edf\u7684SSL\u8bc1\u4e66\u9a8c\u8bc1\u65b9\u5f0f\u5b58\u5728\u4e00\u4e9b\u95ee\u9898\uff0c\u6bd4\u5982\u5ef6\u8fdf\u548c\u6027\u80fd\u95ee\u9898\u3002\u4e3a\u4e86\u89e3\u51b3\u8fd9\u4e9b\u95ee\u9898\uff0cApache\u5f15\u5165\u4e86OCSP Stapling\u6280\u672f\u3002<\/p>\n

\u4ec0\u4e48\u662fOCSP Stapling\uff1f<\/h2>\n

OCSP\uff08Online Certificate Status Protocol\uff09\u662f\u4e00\u79cd\u7528\u4e8e\u9a8c\u8bc1SSL\u8bc1\u4e66\u6709\u6548\u6027\u7684\u534f\u8bae\u3002\u4f20\u7edf\u7684SSL\u8bc1\u4e66\u9a8c\u8bc1\u65b9\u5f0f\u662f\u901a\u8fc7\u5411\u8bc1\u4e66\u9881\u53d1\u673a\u6784\uff08CA\uff09\u7684OCSP\u670d\u52a1\u5668\u53d1\u9001\u8bf7\u6c42\u6765\u9a8c\u8bc1\u8bc1\u4e66\u7684\u6709\u6548\u6027\u3002\u8fd9\u79cd\u65b9\u5f0f\u5b58\u5728\u4e00\u4e9b\u95ee\u9898\uff0c\u6bd4\u5982\u5ef6\u8fdf\u548c\u6027\u80fd\u95ee\u9898\u3002<\/p>\n

OCSP Stapling\u662f\u4e00\u79cd\u6539\u8fdb\u7684\u9a8c\u8bc1\u65b9\u5f0f\uff0c\u5b83\u901a\u8fc7\u5728SSL\u63e1\u624b\u8fc7\u7a0b\u4e2d\uff0c\u7531\u670d\u52a1\u5668\u4e3b\u52a8\u5411CA\u7684OCSP\u670d\u52a1\u5668\u8bf7\u6c42\u5e76\u7f13\u5b58\u8bc1\u4e66\u7684\u6709\u6548\u6027\u4fe1\u606f\u3002\u8fd9\u6837\u4e00\u6765\uff0c\u5ba2\u6237\u7aef\u5728\u9a8c\u8bc1\u8bc1\u4e66\u6709\u6548\u6027\u65f6\uff0c\u53ef\u4ee5\u76f4\u63a5\u4ece\u670d\u52a1\u5668\u83b7\u53d6\u7f13\u5b58\u7684\u6709\u6548\u6027\u4fe1\u606f\uff0c\u800c\u4e0d\u9700\u8981\u518d\u5411CA\u7684OCSP\u670d\u52a1\u5668\u53d1\u9001\u8bf7\u6c42\u3002<\/p>\n

\u4e3a\u4ec0\u4e48\u8981\u914d\u7f6eOCSP Stapling\uff1f<\/h2>\n

\u914d\u7f6eOCSP Stapling\u53ef\u4ee5\u5e26\u6765\u4ee5\u4e0b\u597d\u5904\uff1a<\/p>\n

    \n
  1. \u63d0\u9ad8\u7f51\u7ad9\u7684\u6027\u80fd\uff1a\u7531\u4e8e\u5ba2\u6237\u7aef\u4e0d\u9700\u8981\u518d\u5411CA\u7684OCSP\u670d\u52a1\u5668\u53d1\u9001\u8bf7\u6c42\uff0c\u53ef\u4ee5\u51cf\u5c11\u63e1\u624b\u8fc7\u7a0b\u7684\u5ef6\u8fdf\uff0c\u4ece\u800c\u63d0\u9ad8\u7f51\u7ad9\u7684\u6027\u80fd\u3002<\/li>\n
  2. \u589e\u5f3a\u7f51\u7ad9\u7684\u5b89\u5168\u6027\uff1aOCSP Stapling\u53ef\u4ee5\u9632\u6b62\u653b\u51fb\u8005\u901a\u8fc7\u62d2\u7edd\u670d\u52a1\u653b\u51fb\uff08DoS\uff09\u6765\u5f71\u54cd\u7f51\u7ad9\u7684\u53ef\u7528\u6027\u3002<\/li>\n
  3. \u51cf\u5c11\u5bf9CA\u7684\u4f9d\u8d56\uff1a\u7531\u4e8e\u670d\u52a1\u5668\u4e3b\u52a8\u83b7\u53d6\u5e76\u7f13\u5b58\u8bc1\u4e66\u7684\u6709\u6548\u6027\u4fe1\u606f\uff0c\u53ef\u4ee5\u51cf\u5c11\u5bf9CA\u7684\u4f9d\u8d56\uff0c\u63d0\u9ad8\u7f51\u7ad9\u7684\u53ef\u9760\u6027\u3002<\/li>\n<\/ol>\n

    \u5982\u4f55\u914d\u7f6eOCSP Stapling\uff1f<\/h2>\n

    \u8981\u914d\u7f6eOCSP Stapling\uff0c\u60a8\u9700\u8981\u6309\u7167\u4ee5\u4e0b\u6b65\u9aa4\u8fdb\u884c\u64cd\u4f5c\uff1a<\/p>\n

      \n
    1. \u786e\u4fdd\u60a8\u7684Apache\u7248\u672c\u652f\u6301OCSP Stapling\u3002\u60a8\u53ef\u4ee5\u901a\u8fc7\u8fd0\u884c\u4ee5\u4e0b\u547d\u4ee4\u6765\u68c0\u67e5\uff1a<\/li>\n<\/ol>\n
      apachectl -M | grep ssl_stapling\n<\/code><\/pre>\n
        \n
      1. \u542f\u7528OCSP Stapling\u3002\u5728Apache\u7684\u914d\u7f6e\u6587\u4ef6\u4e2d\uff0c\u627e\u5230SSL\u865a\u62df\u4e3b\u673a\u7684\u914d\u7f6e\u5757\uff0c\u5e76\u6dfb\u52a0\u4ee5\u4e0b\u6307\u4ee4\uff1a<\/li>\n<\/ol>\n
        SSLUseStapling on\nSSLStaplingCache \"shmcb:\/path\/to\/stapling_cache(512000)\"\n<\/code><\/pre>\n
        \u8bf7\u5c06\/path\/to\/stapling_cache<\/code>\u66ff\u6362\u4e3a\u60a8\u5e0c\u671b\u5b58\u50a8\u7f13\u5b58\u6587\u4ef6\u7684\u8def\u5f84\u3002<\/p>\n
          \n
        1. \u91cd\u65b0\u542f\u52a8Apache\u670d\u52a1\u4ee5\u4f7f\u914d\u7f6e\u751f\u6548\u3002<\/li>\n<\/ol>\n
          sudo service apache2 restart\n<\/code><\/pre>\n
          \u793a\u4f8b\u4ee3\u7801<\/h2>\n
          \u4ee5\u4e0b\u662f\u4e00\u4e2a\u793a\u4f8b\u7684Apache\u914d\u7f6e\u6587\u4ef6\uff0c\u6f14\u793a\u4e86\u5982\u4f55\u914d\u7f6eOCSP Stapling\uff1a<\/p>\n
          <VirtualHost *:443>\n  ServerName example.com\n  DocumentRoot \/var\/www\/html\n  \n  SSLEngine on\n  SSLCertificateFile \/path\/to\/certificate.crt\n  SSLCertificateKeyFile \/path\/to\/private.key\n  \n  SSLUseStapling on\n  SSLStaplingCache \"shmcb:\/path\/to\/stapling_cache(512000)\"\n  \n  <Directory \/var\/www\/html>\n    Options Indexes FollowSymLinks\n    AllowOverride All\n    Require all granted\n  <\/Directory>\n<\/VirtualHost>\n<\/code><\/pre>\n
          \u603b\u7ed3<\/h2>\n
          \u901a\u8fc7\u914d\u7f6eOCSP Stapling\uff0c\u60a8\u53ef\u4ee5\u63d0\u9ad8\u7f51\u7ad9\u7684\u6027\u80fd\u548c\u5b89\u5168\u6027\uff0c\u5e76\u51cf\u5c11\u5bf9CA\u7684\u4f9d\u8d56\u3002\u5728\u914d\u7f6e\u8fc7\u7a0b\u4e2d\uff0c\u8bf7\u786e\u4fdd\u60a8\u7684Apache\u7248\u672c\u652f\u6301OCSP Stapling\uff0c\u5e76\u6309\u7167\u6b65\u9aa4\u542f\u7528OCSP Stapling\u3002\u5982\u679c\u60a8\u60f3\u4e86\u89e3\u66f4\u591a\u5173\u4e8eOCSP Stapling\u7684\u4fe1\u606f\uff0c\u8bf7\u8bbf\u95ee\u6211\u4eec\u7684\u5b98\u7f51\uff1ahttps:\/\/idc.net<\/a>\u3002<\/p>\n
          \u9999\u6e2f\u670d\u52a1\u5668\u9996\u9009\u540e\u6d6a\u4e91<\/h3>\n
          \u5982\u679c\u60a8\u6b63\u5728\u5bfb\u627e\u53ef\u9760\u7684\u9999\u6e2f\u670d\u52a1\u5668\u63d0\u4f9b\u5546\uff0c\u540e\u6d6a\u4e91\u662f\u60a8\u7684\u9996\u9009\u3002\u6211\u4eec\u63d0\u4f9b\u9ad8\u6027\u80fd\u7684\u9999\u6e2f\u670d\u52a1\u5668\uff0c\u4ee5\u53ca\u5176\u4ed6\u591a\u79cd\u670d\u52a1\u5668\u4ea7\u54c1\uff0c\u5305\u62ec\u7f8e\u56fd\u670d\u52a1\u5668\u548c\u4e91\u670d\u52a1\u5668\u3002\u8bf7\u8bbf\u95ee\u6211\u4eec\u7684\u5b98\u7f51\u4e86\u89e3\u66f4\u591a\u4fe1\u606f\uff1ahttps:\/\/idc.net<\/a>\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
          Apache\u65b0\u624b\u6559\u7a0b\uff1a\u914d\u7f6eOCSP Stapling \u5728\u4fdd\u62a4\u7f51\u7ad9\u5b89\u5168\u65b9\u9762\uff0cSSL\u8bc1\u4e66\u662f\u4e00\u9879\u91cd\u8981\u7684\u63aa\u65bd\u3002\u7136\u800c\uff0c\u4f20 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[41],"tags":[],"class_list":["post-230079","post","type-post","status-publish","format-standard","hentry","category-apache"],"_links":{"self":[{"href":"https:\/\/idc.net\/help\/wp-json\/wp\/v2\/posts\/230079","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/idc.net\/help\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/idc.net\/help\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/idc.net\/help\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/idc.net\/help\/wp-json\/wp\/v2\/comments?post=230079"}],"version-history":[{"count":0,"href":"https:\/\/idc.net\/help\/wp-json\/wp\/v2\/posts\/230079\/revisions"}],"wp:attachment":[{"href":"https:\/\/idc.net\/help\/wp-json\/wp\/v2\/media?parent=230079"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/idc.net\/help\/wp-json\/wp\/v2\/categories?post=230079"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/idc.net\/help\/wp-json\/wp\/v2\/tags?post=230079"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}