久し振りに SSL テスト環境をセットアップしたので書いておきます。
証明書を作成する部分だけです。
出来上がったサーバ証明書を apache にセットするところは省略しました。
- 秘密鍵作成
ランダムなデータを作成します。
# openssl md5 /usr/local/bin/* > rand.dat |
# openssl md5 /usr/local/bin/* > rand.dat
秘密鍵を作成します。
# openssl genrsa -rand rand.dat -des3 1024 > example.com.key
56935 semi-random bytes loaded
Generating RSA private key, 1024 bit long modulus
..............++++++
........................................++++++
e is 65537 (0x10001)
Enter pass phrase:
Verifying - Enter pass phrase: |
# openssl genrsa -rand rand.dat -des3 1024 > example.com.key
56935 semi-random bytes loaded
Generating RSA private key, 1024 bit long modulus
..............++++++
........................................++++++
e is 65537 (0x10001)
Enter pass phrase:
Verifying - Enter pass phrase:
- CSR 作成
# openssl req -new -key example.com.key -out example.com.csr
Enter pass phrase for example.com.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:JP
State or Province Name (full name) [Berkshire]:Tokyo
Locality Name (eg, city) [Newbury]:Minato-ku
Organization Name (eg, company) [My Company Ltd]:example
Organizational Unit Name (eg, section) []:HQ
Common Name (eg, your name or your server's hostname) []:example.com
Email Address []:info@example.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []: |
# openssl req -new -key example.com.key -out example.com.csr
Enter pass phrase for example.com.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:JP
State or Province Name (full name) [Berkshire]:Tokyo
Locality Name (eg, city) [Newbury]:Minato-ku
Organization Name (eg, company) [My Company Ltd]:example
Organizational Unit Name (eg, section) []:HQ
Common Name (eg, your name or your server's hostname) []:example.com
Email Address []:info@example.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
- 自己署名証明書作成
# openssl x509 -in example.com.csr -out example.com.crt -req -s
ignkey example.com.key -days 3650
Signature ok
subject=/C=JP/ST=Tokyo/L=Minato-ku/O=example/OU=HQ/CN=example.com/emailAddress
=info@example.com
Getting Private key
Enter pass phrase for example.com.key: |
# openssl x509 -in example.com.csr -out example.com.crt -req -s
ignkey example.com.key -days 3650
Signature ok
subject=/C=JP/ST=Tokyo/L=Minato-ku/O=example/OU=HQ/CN=example.com/emailAddress
=info@example.com
Getting Private key
Enter pass phrase for example.com.key:
- 秘密鍵からパスフレーズを削除
# openssl rsa -in example.com.key -out example.com.key_without_pp
Enter pass phrase for example.com.key:
writing RSA key |
# openssl rsa -in example.com.key -out example.com.key_without_pp
Enter pass phrase for example.com.key:
writing RSA key