とあるネットワーク管理者の苦悩

CentOS+OpenSSL(自己署名証明書)

Linux設定 | 16:09

OpenSSLを使って秘密鍵と証明書を作成しhttps通信を行う。

社内サイトなどの暗号化したいけど認証機関の証明書は必要ないというときに利用。

(いわゆるオレオレ証明書)

1)秘密鍵の作成(openssl genrsa)

2)RSA秘密鍵のパスフレーズ削除(openssl in out)

3)証明書要求(CSR)の作成(openssl req)

4)10年間有効な自己署名証明書の作成(openssl x509)

5)httpd.confの編集してapacheの再起動

[root@centos ~]# yum -y install mod_ssl

[root@centos ~]# openssl genrsa -des3 1024 > /etc/pki/tls/private/server.key

Generating RSA private key, 1024 bit long modulus

.................++++++

...................................................++++++

e is 65537 (0x10001)

Enter pass phrase for server.key: パスフレーズ

Verifying - Enter pass phrase for server.key: パスフレーズ

[root@centos ~]# openssl rsa -in /etc/pki/tls/private/server.key -out /etc/pki/tls/private/server.key

Enter pass phrase for server.key: パスフレーズ

writing RSA key

[root@centos ~]# chmod 400 /etc/pki/tls/private/server.key

[root@centos ~]# openssl req -new -key /etc/pki/tls/private/server.key -out /etc/pki/tls/certs/server.csr

Enter pass phrase for server.key: パスフレーズ

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [AU]: JP

State or Province Name (full name) [Some-State]: Tokyo

Locality Name (eg, city) []: Chuo-ku

Organization Name (eg, company) [Internet Widgits Pty Ltd]: hogehoge.inc

Organizational Unit Name (eg, section) []: hogehoge

Common Name (eg, YOUR name) []: hogehoge.com

Email Address []: admin@hogehoge.com

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []: <Enter>

An optional company name []: <Enter>

[root@centos ~]# openssl x509 -in /etc/pki/tls/certs/server.csr -out /etc/pki/tls/certs/server.crt -req -signkey /etc/pki/tls/private/server.key -days 3650

Enter pass phrase for server.key: パスフレーズ

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [AU]: JP

State or Province Name (full name) [Some-State]: Tokyo

Locality Name (eg, city) []: Chuo-ku

Organization Name (eg, company) [Internet Widgits Pty Ltd]: hogehoge.inc

Organizational Unit Name (eg, section) []: hogehoge

Common Name (eg, YOUR name) []: hogehoge.com

Email Address []: admin@hogehoge.com

[root@centos ~]# vi /etc/httpd/conf.d/ssl.conf

以下を編集

SSLCertificateFile /etc/pki/tls/certs/server.crt

SSLCertificateKeyFile /etc/pki/tls/private/server.key

[root@centos ~]# service httpd restart