久し振りに SSL テスト環境をセットアップしたので書いておきます。

証明書を作成する部分だけです。
出来上がったサーバ証明書を apache にセットするところは省略しました。

1. 秘密鍵作成

ランダムなデータを作成します。

# openssl md5 /usr/local/bin/* > rand.dat

# openssl md5 /usr/local/bin/* > rand.dat

秘密鍵を作成します。

# openssl genrsa -rand rand.dat -des3 1024 > example.com.key 56935 semi-random bytes loaded Generating RSA private key, 1024 bit long modulus ..............++++++ ........................................++++++ e is 65537 (0x10001) Enter pass phrase: Verifying - Enter pass phrase:

# openssl genrsa -rand rand.dat -des3 1024 > example.com.key 56935 semi-random bytes loaded Generating RSA private key, 1024 bit long modulus ..............++++++ ........................................++++++ e is 65537 (0x10001) Enter pass phrase: Verifying - Enter pass phrase:

2. CSR 作成

# openssl req -new -key example.com.key -out example.com.csr Enter pass phrase for example.com.key: You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [GB]:JP State or Province Name (full name) [Berkshire]:Tokyo Locality Name (eg, city) [Newbury]:Minato-ku Organization Name (eg, company) [My Company Ltd]:example Organizational Unit Name (eg, section) []:HQ Common Name (eg, your name or your server's hostname) []:example.com Email Address []:info@example.com   Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []:

# openssl req -new -key example.com.key -out example.com.csr Enter pass phrase for example.com.key: You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [GB]:JP State or Province Name (full name) [Berkshire]:Tokyo Locality Name (eg, city) [Newbury]:Minato-ku Organization Name (eg, company) [My Company Ltd]:example Organizational Unit Name (eg, section) []:HQ Common Name (eg, your name or your server's hostname) []:example.com Email Address []:info@example.com Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []:

3. 自己署名証明書作成

# openssl x509 -in example.com.csr -out example.com.crt -req -s ignkey example.com.key -days 3650 Signature ok subject=/C=JP/ST=Tokyo/L=Minato-ku/O=example/OU=HQ/CN=example.com/emailAddress =info@example.com Getting Private key Enter pass phrase for example.com.key:

# openssl x509 -in example.com.csr -out example.com.crt -req -s ignkey example.com.key -days 3650 Signature ok subject=/C=JP/ST=Tokyo/L=Minato-ku/O=example/OU=HQ/CN=example.com/emailAddress =info@example.com Getting Private key Enter pass phrase for example.com.key:

4. 秘密鍵からパスフレーズを削除

# openssl rsa -in example.com.key -out example.com.key_without_pp Enter pass phrase for example.com.key: writing RSA key

# openssl rsa -in example.com.key -out example.com.key_without_pp Enter pass phrase for example.com.key: writing RSA key