ページ

2009年5月6日水曜日

CentOS 5.3 で SSL

▼秘密鍵(server.key)の作成
作業場所を /etc/httpd/conf/ にする。

    [root@centos conf]# openssl genrsa -aes128 1024 > server.key
    Generating RSA private key, 1024 bit long modulus
    ........................................++++++
    .................++++++
    e is 65537 (0x10001)
    Enter pass phrase:
    Verifying - Enter pass phrase:


▼公開鍵(server.csr)の作成

<入力項目の説明>
Country Name (2 letter code) [AU]:    国名
State or Province Name (full name) [Some-State]:    都道府県名
Locality Name (eg, city) []:    市町村名
Organization Name (eg, company) [Internet Widgits Pty Ltd]:    組織名
Organizational Unit Name (eg, section) []:    部門名
Common Name (eg, YOUR name) []:    サイトの名前
Email Address []:    メールアドレス(省略可)
A challenge password []:    証明書を破棄する時に必要になるパスワード(省略可)
An optional company name []:    別の組織名の入力(省略可)

    [root@papa-centos conf]# openssl req -new -key server.key > server.csr
    Enter pass phrase for server.key:
    You are about to be asked to enter information that will be incorporated
    into your certificate request.
    What you are about to enter is what is called a Distinguished Name or a DN.
    There are quite a few fields but you can leave some blank
    For some fields there will be a default value,
    If you enter '.', the field will be left blank.
    -----
    Country Name (2 letter code) [GB]:JP
    State or Province Name (full name) [Berkshire]:Kanagawa
    Locality Name (eg, city) [Newbury]:Yokohama City
    Organization Name (eg, company) [My Company Ltd]:CentOS
    Organizational Unit Name (eg, section) []:CentOS
    Common Name (eg, your name or your server's hostname) []:papa-centos
    Email Address []:

    Please enter the following 'extra' attributes
    to be sent with your certificate request
    A challenge password []:
    An optional company name []:


▼デジタル証明書(server.crt)の作成

    [root@papa-centos conf]# openssl x509 -in server.csr -days 3650 -req -signkey server.key > server.crt
    Signature ok
    subject=/C=JP/ST=Kanagawa/L=Yokohama City/O=Papa-CentOS/OU=Papa-CentOS/CN=papa-centos
    Getting Private key
    Enter pass phrase for server.key:


▼ssl.conf で修正する行
デジタル証明書と秘密鍵の指定を変更する。

    SSLCertificateFile /etc/httpd/conf/server.crt
    SSLCertificateKeyFile /etc/httpd/conf/server.key


▼apache の再起動

    /sbin/service httpd restart


※ファイアウォールの設定はこちらを参照して下さい。