|
|
|
ex.) $ tar zxfv openssl-x.x.x.tar.gz $ cd openssl-x.x.x $ ./config shared ^^^^^^ <-- openssh等で共有lib を使用する場合に必要 $ make $ make test $ su # make install <-- デフォルトでは /usr/local/ssl にインストールされる |
|
ex.) $ tar zxfv apache_1.3.20.tar.gz |
|
ex.) $ tar zxfv mod_ssl-2.8.4-1.3.20.tar.gz |
|
ex.) $ cd mod_ssl-2.8.4-1.3.20 $ ./configure --with-apache=../apache_1.3.20 \ <-- Apacheのソースディレクトリー > --prefix=/usr/local/apache_mssl \ <-- Apacheをインストールするディレクトリー > --enable-shared=ssl \ > --with-ssl=/usr/local/ssl <-- OpenSSLのディレクトリー |
|
ex.) $ cd mod_ssl-2.8.4-1.3.20 $ ./configure --with-apache=../apache_1.3.20 \ <-- Apacheのソースディレクトリー > --prefix=/usr/local/apache_mssl \ <-- Apacheをインストールするディレクトリー > --enable-shared=ssl |
|
ex.) $ cd apache_1.3.20 $ ./configure --enable-module=all --enable-shared=max \ > --prefix=/usr/local/apache_mssl ^^^^^^^^^^^^^^^^^^^^^^ <-- インストールするディレクトリー |
|
ex.) $ cd apache_1.3.20 $ SSL_BASE=/usr <-- これがみそ $ ./configure --enable-module=all --enable-shared=max \ > --prefix=/usr/local/apache_mssl ^^^^^^^^^^^^^^^^^^^^^^ <-- インストールするディレクトリー |
|
ex.) $ make |
ex.) $ su
# make certificate
make[1]: Entering directory `/home/hoge/src/apache_1.3.20/src'
SSL Certificate Generation Utility (mkcert.sh)
Copyright (c) 1998-2000 Ralf S. Engelschall, All Rights Reserved.
Generating test certificate signed by Snake Oil CA [TEST]
WARNING: Do not use this for real-life/production systems
______________________________________________________________________
STEP 0: Decide the signature algorithm used for certificate
The generated X.509 CA certificate can contain either
RSA or DSA based ingredients. Select the one you want to use.
Signature Algorithm ((R)SA or (D)SA) [R]: <-- リターン
______________________________________________________________________
STEP 1: Generating RSA private key (1024 bit) [server.key]
50471 semi-random bytes loaded
Generating RSA private key, 1024 bit long modulus
...++++++
..++++++
e is 65537 (0x10001)
______________________________________________________________________
STEP 2: Generating X.509 certificate signing request [server.csr]
Using configuration from .mkcert.cfg
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
1. Country Name (2 letter code) [XY]:JP <-- 国
2. State or Province Name (full name) [Snake Desert]:Aomori <-- 県
3. Locality Name (eg, city) [Snake Town]:Hachinohe <-- 市
4. Organization Name (eg, company) [Snake Oil, Ltd]:hoge fuga inc. <-- 組織 *1
5. Organizational Unit Name (eg, section) [Webserver Team]:webmaster
6. Common Name (eg, FQDN) [www.snakeoil.dom]:www.hoge.hogefuga.net <-- サーバー名(FQDN) *2
7. Email Address (eg, name@FQDN) [www@snakeoil.dom]:webmaster@hoge.hogefuga.net <-- メールアドレス
8. Certificate Validity (days) [365]:
*1 ドメインのレジストラーに登録されている名称
*2 使用する Webサーバーの FQDN
______________________________________________________________________
STEP 3: Generating X.509 certificate signed by Snake Oil CA [server.crt]
Certificate Version (1 or 3) [3]: <-- リターン
Signature ok
subject=/C=JP/ST=Aomori/L=Hachinohe/O=hoge fuga inc./OU=webmaster/CN=www.hoge.hogefuga.net/Email=webmaster@hoge.hogefuga.net
Getting CA Private Key
Verify: matching certificate & key modulus
read RSA key
Verify: matching certificate signature
../conf/ssl.crt/server.crt: OK
______________________________________________________________________
STEP 4: Enrypting RSA private key with a pass phrase for security [server.key]
The contents of the server.key file (the generated private key) has to be
kept secret. So we strongly recommend you to encrypt the server.key file
with a Triple-DES cipher and a Pass Phrase.
Encrypt the private key now? [Y/n]: <-- リターン
Fine, you're using an encrypted RSA private key.
read RSA key
writing RSA key
Enter PEM pass phrase: <-- パスフレーズ
Verifying password - Enter PEM pass phrase: <-- パスフレーズをもう一度
Fine, you're using an encrypted RSA private key.
______________________________________________________________________
RESULT: Server Certification Files
o conf/ssl.key/server.key
The PEM-encoded RSA private key file which you configure
with the 'SSLCertificateKeyFile' directive (automatically done
when you install via APACI). KEEP THIS FILE PRIVATE!
o conf/ssl.crt/server.crt
The PEM-encoded X.509 certificate file which you configure
with the 'SSLCertificateFile' directive (automatically done
when you install via APACI).
o conf/ssl.csr/server.csr
The PEM-encoded X.509 certificate signing request file which
you can send to an official Certificate Authority (CA) in order
to request a real server certificate (signed by this CA instead
of our demonstration-only Snake Oil CA) which later can replace
the conf/ssl.crt/server.crt file.
WARNING: Do not use this for real-life/production systems
make[1]: Leaving directory `/home/hoge/src/apache_1.3.20/src'
|
|
ex.) # make install |
|
ex.) # cd /usr/local/apache_mssl # cd conf # vi httpd.conf ＊接続ポートの設定 <IfDefine SSL> Listen 80 <-- 通常の接続 port 80 Listen 443 <-- SSLでの接続 port 443 </IfDefine> ＊サーバー名の設定 ServerName www.hoge.hogefuga.net ＊SSLヴァーチャルホストの設定 <IfDefine SSL> <VirtualHost _default_:443> <-- 接続ポートの設定：前項の接続ポートの値 DocumentRoot "/usr/local/apache_mssl/htdocs_ssl" ^-- SSL接続時のドキュメントディレクトリー ServerName www.hoge.hogefuga.net <-- サーバー名 ： ： ： </VirtualHost> </IfDefine SSL> |
|
ex.) # cd /usr/local/apache_mssl/conf/ssl.key # cp -p server.key server.key.org # openssl rsa -in server.key.org -out server.key read RSA key Enter PEM pass phrase: <-- パスフレーズを入力 writing RSA key |
|
ex.) # /usr/local/apache_mssl/apachectl start |
|
ex.) # /usr/local/apache_mssl/apachectl startssl ^^^^^^^^ |
|
ex.) http://www.hoge.hoge.net/ |
|
ex.) https://www.hoge.hoge.net/ ^^^^^ |
|
# cd /usr/local/apache/conf # rm -f ssl.key/server.key # rm -f ssl.crt/server.crt |
|
# openssl genrsa -des3 1024 > ssl.key/server.key warning, not much extra random data, consider using the -rand option Generating RSA private key, 1024 bit long modulus ...++++++ .......................++++++ e is 65537 (0x10001) Enter PEM pass phrase: ←パスフレーズ Verifying password - Enter PEM pass phrase: ←パスフレーズをもう一度 |
|
# openssl req -new -key ssl.key/server.key -x509 -days 365 -out ssl.crt/server.crt Using configuration from /var/ssl/openssl.cnf Enter PEM pass phrase: ←パスフレーズ You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:JP ←国 State or Province Name (full name) [Some-State]:Aomori ←県 Locality Name (eg, city) []:Hachinohe ←市 Organization Name (eg, company) [Internet Widgits Pty Ltd]:hoge fuga inc. ← 組織 Organizational Unit Name (eg, section) []: Common Name (eg, YOUR name) []:webmaster Email Address []:webmaster@hoge.hogefuga.net |
| # ssleay md5 /usr/local/* > rand.dat |
| ssleay genrsa -rand rand.dat -des 1024 > key.pem |
| ssleay genrsa -rand rand.dat -des3 1024 > key.pem |
| # ssleay req -new -key key.pem -out csr.pem |
|
SSLCertificateFile /usr/local/apache2/conf/ssl.crt/server.crt ↓ SSLCertificateFile /usr/local/apache2/conf/ssl.crt/cert.pem SSLCertificateKeyFile /usr/local/apache2/conf/ssl.key/server.key ↓ SSLCertificateKeyFile /usr/local/apache2/conf/ssl.key/key.pem |