Apache の SSL 接続を有効にする 01

openssl のインストール

% sudo apt-get install openssl
% sudo apt-get install ssl-cert

openssl の設定

% ls -l /etc/ssl/       
total 24
drwxr-xr-x 2 root root 8192 Dec 23 18:46 certs
-rw-r--r-- 1 root root 9374 May  8  2008 openssl.cnf
drwx------ 2 root root 4096 May  8  2008 private

下記の設定のコメントを外す。
修正前。

% sudo vi /etc/ssl/openssl.cnf
[ usr_cert ]
# This is OK for an SSL server.
# nsCertType = server
[ v3_ca ]
# Some might want this also
# nsCertType = sslCA, emailCA

修正後。

[ usr_cert ]
# This is OK for an SSL server.
nsCertType = server
[ v3_ca ]
# Some might want this also
nsCertType = sslCA, emailCA

秘密鍵や証明書を生成する

Debian の etch の場合、古い WEB ページだと

/usr/sbin/apache2-ssl-certificate

で証明書の生成を行うように書かれているが、現時点だと

/usr/sbin/make-ssl-cert

を使う。ちなみに Apache 1.3 系では

/usr/sbin/mod-ssl-makecert

を使うようだ。

% ls -l /usr/share/ssl-cert/ssleay.cnf 
-rw-r--r-- 1 root root 594 Feb  3  2007 /usr/share/ssl-cert/ssleay.cnf
% sudo /usr/sbin/make-ssl-cert /usr/share/ssl-cert/ssleay.cnf /etc/apache2/ssl/apache2.pem

証明書の設定は下記のような画面で行う。

生成されたファイルの確認

% ls -l /etc/apache2/ssl/                                
total 4
lrwxrwxrwx 1 root root   11 Dec 30 02:18 406b603c -> apache2.pem
-rw------- 1 root root 1925 Dec 30 02:18 apache2.pem

参考

以下は「秘密鍵や証明書を生成する」の古い記述である。
下記の作業内容で生成した秘密鍵や証明書では、SSL を有効にした状態で Apache2 の起動は不可能だった。

% ls -l /usr/lib/ssl/misc/
total 28
-rwxr-xr-x 1 root root 5875 May  8  2008 CA.pl
-rwxr-xr-x 1 root root 3758 May  8  2008 CA.sh
-rwxr-xr-x 1 root root  119 May  8  2008 c_hash
-rwxr-xr-x 1 root root  152 May  8  2008 c_info
-rwxr-xr-x 1 root root  112 May  8  2008 c_issuer
-rwxr-xr-x 1 root root  110 May  8  2008 c_name
% cd /usr/lib/ssl/misc/
% sudo ./CA.sh

きちんと入力するのは、

Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Enter pass phrase for ./demoCA/private/./cakey.pem:

入力例

CA certificate filename (or enter to create)

Making CA certificate ...
Generating a 1024 bit RSA private key
...........................++++++
..............................++++++
writing new private key to './demoCA/private/./cakey.pem'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:JP
State or Province Name (full name) [Some-State]:TOKYO
Locality Name (eg, city) []:CHIYODA
Organization Name (eg, company) [Internet Widgits Pty Ltd]: <- 空白
Organizational Unit Name (eg, section) []: <- 空白
Common Name (eg, YOUR name) []:WEB
Email Address []: <- 空白
A challenge password []: <- 空白
An optional company name []: <- 空白
Enter pass phrase for ./demoCA/private/./cakey.pem:

Apache 起動時にパスフレーズを求められないようにする

セキュリティ上はパスフレーズの入力を省かないようにするほうがよい。

% openssl rsa -in ./demoCA/private/cakey.pem -out ./demoCA/private/cakey.pem
Password: <- sudo のパスワードを入力
Enter pass phrase for ./demoCA/private/cakey.pem: <- 秘密鍵生成時のパスフレーズを入力する
writing RSA key
%

証明書を作成し、ブラウザに読み込ませる DER を生成する

% sudo openssl x509 -in ./demoCA/cacert.pem -out ./demoCA/cacert.crt
% sudo openssl x509 -inform pem -in ./demoCA/cacert.pem -outform der -out ./demoCA/ca.der