-
秘密鍵作成
cd /etc/pki/tls/certs openssl genrsa -aes256 1024 > server.key
Generating RSA private key, 1024 bit long modulus ......................++++++ ............++++++ e is 65537 (0x10001) Enter pass phrase:パスワード入力 Verifying - Enter pass phrase:パスワード再入力
-
公開鍵作成
openssl req -new -key server.key > server.csr
Enter pass phrase for server.key:パスワード入力 You are about to be asked to enter information that will be incorporated into your certificate request. 略 Country Name (2 letter code) [XX]:JP State or Province Name (full name) []:Tokyo Locality Name (eg, city) [Default City]:Akihabara Organization Name (eg, company) [Default Company Ltd]:OreOreCA Organizational Unit Name (eg, section) []:z-area Common Name (eg, your name or your server's hostname) []:z-area.net Email Address []:空欄 A challenge password []:空欄 An optional company name []:空欄
-
証明書作成
openssl x509 -in server.csr -days 36500 -req -signkey server.key > server.crt
Signature ok subject=/C=JP/ST=Tokyo/L=Akihabara/O=OreOreCA/OU=z-area/CN=z-area.net Getting Private key Enter pass phrase for server.key:パスワード入力
-
秘密鍵パスワード解除
現状のままだとApache2の再起動のたびにパスワードを求められるので、
秘密鍵のパスワードを解除しておきます。mv server.key server.key.org openssl rsa -in server.key.org > server.key
Enter pass phrase for server.key.org:パスワード入力 writing RSA key
-
Apache2のSSL導入
yum install mod_ssl
-
Apache2のSSL設定
cp -pi /etc/httpd/conf.d/ssl.conf /etc/httpd/conf.d/ssl.conf.org vi /etc/httpd/conf.d/ssl.conf
下記内容に変更 #DocumentRoot "/var/www/html" ↓ DocumentRoot "/var/www/html" #ServerName www.example.com:443 ↓ ServerName z-area.net:443 ErrorLog logs/ssl_error_log ↓ ErrorLog /var/log/httpd/ssl_error_log TransferLog logs/ssl_access_log ↓ #TransferLog logs/ssl_access_log CustomLog logs/ssl_request_log \ "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b" ↓ CustomLog /var/log/httpd/ssl_access_log \ "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b" # POODLE SSLv3.0 脆弱性問題対処 SSLProtocol all -SSLv2 ↓ SSLProtocol all -SSLv2 -SSLv3 SSLCertificateFile /etc/pki/tls/certs/localhost.crt ↓ SSLCertificateFile /etc/pki/tls/certs/server.crt SSLCertificateKeyFile /etc/pki/tls/private/localhost.key ↓ SSLCertificateKeyFile /etc/pki/tls/certs/server.key
-
Apache2SSLの動作確認
echo '<h1>It works!</h1>' > /var/www/html/index.html /etc/rc.d/init.d/iptables stop /etc/rc.d/init.d/httpd restart
https://192.168.XXX.YYY/
証明書の確認が表示された後、「It works!」が表示されれば正常です。
/etc/rc.d/init.d/iptables start rm -f /var/www/html/index.html