![[PukiWiki]](image/pukiwiki.png "[PukiWiki]")
|
Suse10 ssl |
kagyuu@grape:~> su - Password:
grape:~ # mkdir /usr/local/ssl
grape:~ # cd /usr/local/ssl grape:/usr/local/ssl # /usr/share/ssl/misc/CA.pl -newca �� CA certificate filename (or enter to create) Making CA certificate ... Generating a 1024 bit RSA private key .................++++++ ........++++++ writing new private key to './demoCA/private/./cakey.pem' �� Enter PEM pass phrase:**************** Verifying - Enter PEM pass phrase:**************** ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- �� Country Name (2 letter code) [AU]:JA �� State or Province Name (full name) [Some-State]:Tokyo �� Locality Name (eg, city) []:Bunkyo �� Organization Name (eg, company) [Internet Widgits Pty Ltd]:Private CA �� Organizational Unit Name (eg, section) []: �� Common Name (eg, YOUR name) []:kagyuu �� Email Address []:kagyuu@hondou.homedns.org
grape:/usr/local/ssl # ls . .. demoCA
grape:/usr/local/ssl # /usr/share/ssl/misc/CA.pl -newreq-nodes Generating a 1024 bit RSA private key ...........++++++ .......++++++ writing new private key to 'newreq.pem' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- �� Country Name (2 letter code) [AU]:JP �� State or Province Name (full name) [Some-State]:Tokyo �� Locality Name (eg, city) []:Bunkyo �� Organization Name (eg, company) [Internet Widgits Pty Ltd]:Hondoh �� Organizational Unit Name (eg, section) []:Web Admin �� Common Name (eg, YOUR name) []:hondou.homedns.org �� Email Address []:kagyuu@hondou.homedns.org Please enter the following 'extra' attributes to be sent with your certificate request �� A challenge password []: �� An optional company name []: Request (and private key) is in newreq.pem grape:/usr/local/ssl # ls . .. demoCA newreq.pem
grape:/usr/local/ssl # /usr/share/ssl/misc/CA.pl -sign
Using configuration from /etc/ssl/openssl.cnf
�� Enter pass phrase for ./demoCA/private/cakey.pem:****************
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Aug 18 17:44:34 2006 GMT
Not After : Aug 15 17:44:34 2016 GMT
Subject:
countryName = JP
stateOrProvinceName = Tokyo
localityName = Bunkyo
organizationName = Hondoh
organizationalUnitName = Web Admin
commonName = hondou.homedns.org
emailAddress = kagyuu@hondou.homedns.org
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
BC:E5:0A:10:94:5A:71:31:5F:04:CD:F8:71:17:98:C8:69:08:89:31
X509v3 Authority Key Identifier:
keyid:5B:68:21:F5:6D:0F:94:60:55:6A:2F:55:9A:8E:7E:07:F2:58:42:CB
DirName:/C=JP/ST=Tokyo/L=Bunkyo/O=PrivateCA/CN=kagyuu/emailAddress=kagyuu@hondou.homedns.org
serial:A8:16:81:D7:6B:0A:F2:FF
Certificate is to be certified until Aug 15 17:44:34 2016 GMT (3650 days)
Sign the certificate? [y/n]:y
�� 1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
Signed certificate is in newcert.pem
grape:/usr/local/ssl # ls
. .. demoCA newcert.pem newreq.pem
grape:/usr/local/ssl # openssl rsa -in newreq.pem -out server.key writing RSA key
grape:/usr/local/ssl # openssl x509 -in newcert.pem -out server.crt
# This global SSL configuration is ignored if # "SSL" is not defined, or if "NOSSL" is defined. <IfDefine SSL> <IfDefine !NOSSL> <IfModule mod_ssl.c> # # Some MIME-types for downloading Certificates and CRLs # AddType application/x-x509-ca-cert .crt AddType appli ･･･
grape:/etc/apache2/vhosts.d # cp vhost-ssl.template vhost-ssl.conf
grape:/etc/apache2/vhosts.d # vi vhost-ssl.conf
･･･(いろいろいじって)･･･
grape:/etc/apache2/vhosts.d # diff vhost-ssl.template vhost-ssl.conf -u
--- vhost-ssl.template 2005-09-10 03:39:20.000000000 +0900
+++ vhost-ssl.conf 2006-08-19 03:58:09.000000000 +0900
@@ -36,8 +36,8 @@
# General setup for the virtual host
DocumentRoot "/srv/www/htdocs"
- #ServerName www.example.com:443
- #ServerAdmin webmaster@example.com
+ ServerName hondou.homedns.org:443
+ ServerAdmin kagyuu@hondou.homedns.org
ErrorLog /var/log/apache2/error_log
TransferLog /var/log/apache2/access_log
@@ -57,16 +57,18 @@
# in mind that if you have both an RSA and a DSA certificate you
# can configure both in parallel (to also allow the use of DSA
# ciphers, etc.)
- SSLCertificateFile /etc/apache2/ssl.crt/server.crt
+ #SSLCertificateFile /etc/apache2/ssl.crt/server.crt
#SSLCertificateFile /etc/apache2/ssl.crt/server-dsa.crt
+ SSLCertificateFile /usr/local/ssl/server.crt
# Server Private Key:
# If the key is not combined with the certificate, use this
# directive to point at the key file. Keep in mind that if
# you've both a RSA and a DSA private key you can configure
# both in parallel (to also allow the use of DSA ciphers, etc.)
- SSLCertificateKeyFile /etc/apache2/ssl.key/server.key
+ #SSLCertificateKeyFile /etc/apache2/ssl.key/server.key
#SSLCertificateKeyFile /etc/apache2/ssl.key/server-dsa.key
+ SSLCertificateKeyFile /usr/local/ssl/server.key
# Server Certificate Chain:
# Point SSLCertificateChainFile at a file containing the
@@ -86,6 +88,8 @@
# Makefile to update the hash symlinks after changes.
#SSLCACertificatePath /etc/apache2/ssl.crt
#SSLCACertificateFile /etc/apache2/ssl.crt/ca-bundle.crt
+ SSLCACertificatePath /usr/local/ssl/demoCA
+ SSLCACertificateFile /usr/local/ssl/demoCA/cacert.pem
# Certificate Revocation Lists (CRL):
# Set the CA revocation path where to find CA CRLs for client
grape:/etc/apache2/vhosts.d #
grape:/etc/apache2/vhosts.d # /etc/rc.d/apache2 restart Syntax OK Shutting down httpd2 (waiting for all children to terminate) done Starting httpd2 (prefork) done
httpsでアクセスすると通信が暗号化されるようになった
/srv/www/htdocs/squirrelmail/index.php のりダイレクト先をhttpsにする。
// if we are, go ahead to the login page.
- header('Location: src/login.php');
+ header('Location: https://hondou.homedns.org/squirrelmail/src/login.php');
ssl_yast5.png 2409件
[詳細]
ssl_yast1.png 2577件
[詳細]
ssl_access.png 2436件
[詳細]
ssl.png 2500件
[詳細]
ssl_yast4.png 2553件
[詳細]
ssl_yast2.png 2448件
[詳細]
ssl_yast3.png 2471件
[詳細]
