解決 XAMPP的弱點掃瞄：35291 SSL Certificate Signed Using Weak Hashing Algorithm 與重建憑證2048位元

XAMPP的vhost與SSL設定 重建憑證2048位元

 解決

弱點掃瞄：
SSL Certificate Signed Using Weak Hashing Algorithm

編號： 35291

---------------------------------------------

停止Apache

copy c:\xampp\apache 並更名到 c:\apache24

先把 c:\xampp\apache\conf 建立 ssl 資料夾

把原 c:\xampp\apache\con\ssl.crt ssl.csr ssl.key資料夾內的檔案更名為*-old

---------------SSL設定禁用SHA1----------------------------

修正 c:\xampp\apache\conf\extra\httpd-ssl.conf 

52 SSLCipherSuite HIGH:MEDIUM:!MD5:!RC4:!3DES:!SHA1

53 SSLProxyCipherSuite HIGH:MEDIUM:!MD5:!RC4:!3DES:!SHA1

---------------重建憑證2048位元用key---------------------------

CMD 命令列視窗模式到 c:\xampp\apache\bin 

檢查現有憑證是否 SHA1 

.\openssl x509 -in C:\xampp\apache\conf\ssl.crt\server-old.crt -text -noout

重建憑證用的Key

.\openssl genrsa -out C:\xampp\apache\conf\ssl\server.key 2048

openssl req -new -key C:\xampp\apache\conf\ssl\server.key -out C:\xampp\apache\conf\ssl\server.csr

-----憑證內資料設定------------

Country Name (2 letter code) [AU]:TW

State or Province Name (full name) [Some-State]:taipei

Locality Name (eg, city) []:taipei

Organization Name (eg, company) [Internet Widgits Pty Ltd]:LongBow

Organizational Unit Name (eg, section) []:LonBow

Common Name (e.g. server FQDN or YOUR name) []:localhost

Email Address []:slchang@bmeservice.net

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:bme8888

An optional company name []:Bmeservice

---------------重建憑證2048位元---------------------------

.\openssl x509 -req -days 365 -in C:\xampp\apache\conf\ssl\server.csr -signkey C:\xampp\apache\conf\ssl\server.key -out C:\xampp\apache\conf\ssl\server.crt

再把 c:\xampp\apache\conf\ssl的新建資料, 分別放入對應的資料夾

可以把c:\apache24 刪除

---------------更新到2.4.63---------------------------

把原 c:\xampp\apache\conf 資料copy 到原 c:\xampp\apache2463 (全部覆蓋)

把 apache 更名為apache2462

把 apache2463 更名為apache

啟動 Apache 

更新到2.4.63 (因為server.csr已更新到2048)