トップ＞ オープンソース＞ 第三者証明付きSSLを作る

第三者証明付きSSLを作る

Apache + mod_ssl + openssl + ベリサインで証明書付きSSL

(1)Basic Information

SSL URL : http://www.hogehoge.co.jp/
Common Name : www.hogehoge.co.jp
Organization : HogehogeCorp
Organization Unit : TechnicalDiv
Locality : KagoshimaShi
State or Province : KagoshimaKen
Country : JP

pass phrase : hitoyohitoyonihitomigoro141421356

conf : /usr/local/apache2/conf/httpd.conf
secret key : /usr/local/apache2/conf/ssl.key/server.key
certificate : /usr/local/apache2/conf/ssl.crt/server.crt

(2)Create Secret KEY

cd /usr/local/apache2/conf
mkdir ssl.key
mkdir ssl.crt
/usr/local/bin/openssl md5 * > rand.dat
/usr/local/bin/openssl genrsa -rand rand.dat -des3 1024 > ssl.key/server.key
pass-phrase : hitoyohitoyonihitomigoro141421356

(3)Delete pass phrase

cd /usr/local/apache2/conf
/usr/local/bin/openssl rsa -in ssl.key/server.key -out ssl.key/server.key
read RSA private key
Enter PEM pass phrase: hitoyohitoyonihitomigoro141421356
writing RSA private key

(4)Create CSR (Certificate Signing Request)

cd /usr/local/apache2/conf
/usr/local/bin/openssl req -new -key ssl.key/server.key -out csr.pem
pass-phrase : hitoyohitoyonihitomigoro141421356
Country Name : JP
State or Province Name : KagoshimaKen
Locality Name : KagoshimaShi
Organization Name : HogehogeCorp
Organization Unit Name : TechnicalDiv
Common Name : www.hogehoge.co.jp
Email Address = nothing
A challenge password = nothing
An optional company name = nothing

(5)Send CSR to CA ( Verisign .... )

Send /usr/local/apache2/conf/csr.pem

(6)Receive Certificate

Receive email
Copy and Paste /usr/local/apache2/conf/ssl.crt/server.crt

(7)edit httpd.conf

chmod 700 /usr/local/apache2/conf/ssl.key
chmod 700 /usr/local/apache2/conf/ssl.crt
chmod 600 /usr/local/apache2/conf/ssl.key/server.key
chmod 600 /usr/local/apache2/conf/ssl.crt/server.crt
vi httpd.conf
SSLCertificateKeyFile /usr/local/apache2/conf/ssl.key/server.key
SSLCertificateFile /usr/local/apache2/conf/ssl.crt/server.crt

(8)Back server.key and server.crt

back up to FDD/CD-R/DvD

(99)とりあえず自己証明書にするとき

/usr/local/bin/openssl x509 -in csr.pem -out ssl.crt/server.crt -req -signkey ssl.key/server.key -days 365

カテゴリ内の記事