インストール時に生成されたキーを削除
このキーと証明書をそのまま使うことはお勧めできません。理由としてはパスワードがないこと、証明書の内容に必要な情報が入っていないことです。
# cd /etc/httpd/conf
# rm ssl.key/server.key
# rm ssl.crt/server.crt
キーの生成
キーはパスワードつきのものを利用します。もしキーが盗まれた場合にもパスワードがなければ利用できないのであなたのWebの偽者が作られることはないのです。
# make genkey
umask 77 ; \
/usr/bin/openssl genrsa -des3 1024 > /etc/httpd/conf/ssl.key/server.key
Generating RSA private key, 1024 bit long modulus
....++++++
........................................++++++
e is 65537 (0x10001)
Enter pass phrase:xxxxxxxxx ＜＜ 4桁以上のパスワード
Verifying - Enter pass phrase:xxxxxxxxx ＜＜ 確認の再入力
パスワードなしのキーの生成の方法（あまりお勧め出来ません）
# /usr/bin/openssl genrsa 1024 > /etc/httpd/conf/ssl.key/server.key
# chmod go-rwx /etc/httpd/conf/ssl.key/server.key
自己署名証明書の作成
# cd /usr/share/ssl/certs
# make testcert
umask 77 ; \
/usr/bin/openssl req -new -key /etc/httpd/conf/ssl.key/server.key -x509 -days 36
5 -out /etc/httpd/conf/ssl.crt/server.crt
Enter pass phrase for /etc/httpd/conf/ssl.key/server.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:JP
State or Province Name (full name) [Berkshire]:Tokyo
Locality Name (eg, city) [Newbury]:chiyoda-ku
Organization Name (eg, company) [My Company
Ltd]: kaji3.com
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname)
[]:www.kaji3.com
Email Address []:admin@kaji3.com
CAに証明書発行依頼する場合
# cd /usr/share/ssl/certs
# make certreq
umask 77 ; \
/usr/bin/openssl req -new -key /etc/httpd/conf/ssl.key/server.key -out /etc/http
d/conf/ssl.csr/server.csr
Enter pass phrase for /etc/httpd/conf/ssl.key/server.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:JP
State or Province Name (full name) [Berkshire]:Tokyo
Locality Name (eg, city) [Newbury]:Chiyoda-ku
Organization Name (eg, company) [My Company
Ltd]:kaji3.com
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:www.kaji3.com
Email Address []:admin@kaji3.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
なお、細かな記載事項についてはCAの説明をよく読んで入力するようにして下さい。
CAから送られてきた証明書を/etc/httpd/conf/ssl.csr/server.csrとして保存します。
|
