とりあえず、イントラサーバなので
自己証明書でSSL化のメモメモ
■ CA認証局の作成
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 |
# /etc/pki/tls/misc/CA -newca CA certificate filename (or enter to create) Making CA certificate ... Generating a 2048 bit RSA private key .........+++ ..........................................................................+++ writing new private key to '/etc/pki/CA/private/./cakey.pem' Enter PEM pass phrase: Verifying - Enter PEM pass phrase: ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:JP State or Province Name (full name) []:Tokyo Locality Name (eg, city) [Default City]:Shibuya Organization Name (eg, company) [Default Company Ltd]:test co.,Ltd Organizational Unit Name (eg, section) []: Common Name (eg, your name or your server's hostname) []:xxxxxx Email Address []: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: Using configuration from /etc/pki/tls/openssl.cnf Enter pass phrase for /etc/pki/CA/private/./cakey.pem: Check that the request matches the signature Signature ok Certificate Details: Serial Number: a3:42:a9:43:4f:07:98:78 Validity Not Before: Nov 25 05:31:41 2015 GMT Not After : Nov 24 05:31:41 2018 GMT Subject: countryName = JP stateOrProvinceName = Tokyo organizationName = test co.,Ltd commonName = xxx X509v3 extensions: X509v3 Subject Key Identifier: 1E:D8:0E:A7:9F:28:3B:76:B0:38:37:5D:B6:A9:2B:0B:B1:F3:D2:99 X509v3 Authority Key Identifier: keyid:1E:D8:0E:A7:9F:28:3B:76:B0:38:37:5D:B6:A9:2B:0B:B1:F3:D2:99 X509v3 Basic Constraints: CA:TRUE Certificate is to be certified until Nov 24 05:31:41 2018 GMT (1095 days) Write out database with 1 new entries Data Base Updated |
■ CA証明書の場所
・CA秘密鍵 /etc/pki/CA/private/cakey.pem
・CA証明書 /etc/pki/CA/cacert.pem
■ サーバー証明書の秘密鍵作成
|
1 2 3 4 5 6 7 8 9 10 |
mkdir /etc/pki/ssl cd /etc/pki/ssl # openssl genrsa -out server.key -aes256 2048 Generating RSA private key, 2048 bit long modulus ...........+++ .........+++ e is 65537 (0x10001) Enter pass phrase for server.key: ← パスワード入力 Verifying - Enter pass phrase for server.key: ← パスワード入力 |
■ サーバー証明書作成
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 |
# openssl req -new -sha256 -key server.key -out server.csr Enter pass phrase for server.key: You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:JP State or Province Name (full name) []:Tokyo Locality Name (eg, city) [Default City]:Shibuya Organization Name (eg, company) [Default Company Ltd]:test co.,Ltd Organizational Unit Name (eg, section) []: Common Name (eg, your name or your server's hostname) []:xxxx Email Address []: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: |
The organizationName field needed to be the same in the ～
と怒られてしまうので、CA局と、証明書の「Organization Name」は同一に
■ サーバー証明書へのCAの署名
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 |
# openssl ca -md sha256 -config /etc/pki/tls/openssl.cnf -in server.csr -keyfile /etc/pki/CA/private/cakey.pem -cert /etc/pki/CA/cacert.pem -out server.crt Using configuration from /etc/pki/tls/openssl.cnf Enter pass phrase for /etc/pki/CA/private/cakey.pem: Check that the request matches the signature Signature ok Certificate Details: Serial Number: a3:42:a9:43:4f:07:98:79 Validity Not Before: Nov 25 05:53:48 2015 GMT Not After : Nov 24 05:53:48 2016 GMT Subject: countryName = JP stateOrProvinceName = Tokyo organizationName = test co.,Ltd commonName = xxxxx X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: 6A:78:90:83:0B:3A:B4:08:E1:9D:0A:F1:70:42:59:D6:6D:DB:CC:C9 X509v3 Authority Key Identifier: keyid:1E:D8:0E:A7:9F:28:3B:76:B0:38:37:5D:B6:A9:2B:0B:B1:F3:D2:99 Certificate is to be certified until Nov 24 05:53:48 2016 GMT (365 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated |
もし、下記のメッセージが出て失敗してしまったら
failed to update database
TXT_DB error number 2
りぶぉーくをすると復活するらしい