フリーソフト/OpenSSL 独自認証局(CA)の構築 の履歴(No.1)

• 履歴一覧
• 差分 を表示
• 現在との差分 を表示
• ソース を表示
• フリーソフト/OpenSSL 独自認証局(CA)の構築 へ行く。
  • 1 (2011-01-26 (水) 14:19:40)

---

OpenSSL 独自認証局の構築手順と サーバ証明書の作成手順を書く．

プラットフォーム†

• Debian GNU/Linux 3.1

openssl.cnf の修正†

/etc/ssl/openssl.cnf を修正して，後々使いやすいようにしておく．

修正箇所

[ CA_default ]
dir           = /etc/ssl/demoCA               # Where everything is kept

[ req ]
default_bits          = 2048

[ req_distinguished_name ]
countryName_default           = JP
stateOrProvinceName_default   = Osaka
localityName_default          = Osaka
0.organizationName_default    = NullPyon
organizationalUnitName_default        = NullPyon

CA の証明書(Certificate)，秘密鍵の作成†

# mkdir -p /etc/ssl/demoCA/private
# chmod 700 /etc/ssl/demoCA/private
# cd /etc/ssl/demoCA
# openssl req -new -x509 -out cacert.pem -keyout private/cakey.pem 
Generating a 2048 bit RSA private key
..................+++
writing new private key to 'private/cakey.pem'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
...
-----
Country Name (2 letter code) [JP]:
State or Province Name (full name) [Osaka]:
Locality Name (eg, city) [Osaka]:
Organization Name (eg, company) [NullPyon]:
Organizational Unit Name (eg, section) [NullPyon]:
Common Name (eg, YOUR name) []:demoCA
Email Address []:tanaka@XXXX.jp
# chmod 600 private/cakey.pem
#

これにより，CA の証明書 cacert.pem と その鍵ファイル private/cakey.pem ができる．

証明書失効リスト(CRL:Certificate Revocation Lists)作成†

# cd /etc/ssl/demoCA
# touch index.txt
# echo "01" > serial
# openssl ca -gencrl -out ./cacrl.pem
Using configuration from /usr/lib/ssl/openssl.cnf
Enter pass phrase for /etc/ssl/demoCA/private/cakey.pem:

CRL のハッシュリンクの作成†

# cd /etc/ssl/demoCA
# mkdir newcerts
# ln -s cacert.pem newcerts/`openssl x509 -noout -hash < cacert.pem`.0
# mkdir crl
# ln -s cacrl.pem crl/`openssl crl -noout -hash < cacrl.pem`.r0

OpenLDAP サーバの証明書とキー作成†

秘密キーの作成†

# mkdir /etc/ldap/private
# cd /etc/ldap/private
# openssl genrsa -out LDAPserver.key
Generating RSA private key, 512 bit long modulus
......++++++++++++
..........................++++++++++++
e is 65537 (0x10001)

証明書発行要求(CSR)の作成†

CN にはサーバの FQDN を入力する．

# cd /etc/ldap/private
# openssl req -out LDAPserver.csr -new \
 -key LDAPserver.key -config /etc/ssl/openssl.cnf
...
-----
Country Name (2 letter code) [JP]:
State or Province Name (full name) [Osaka]:
Locality Name (eg, city) [Osaka]:
Organization Name (eg, company) [NullPyon]:
Organizational Unit Name (eg, section) [NullPyon]:
Common Name (eg, YOUR name) []:AAA.XXXX.jp
Email Address []:tanaka@XXXX.jp

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
# 

認証局による署名とサーバ証明書の発行†

# cd /etc/ldap/private
# openssl ca -config /etc/ssl/openssl.cnf \
> -out LDAPserver.crt -infiles LDAPserver.csr
Using configuration from /etc/ssl/openssl.cnf
Enter pass phrase for /etc/ssl/demoCA/private/cakey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
       Serial Number: 1 (0x1)
       Validity
           Not Before: Nov 16 05:00:16 2005 GMT
           Not After : Nov 16 05:00:16 2006 GMT
       Subject:
           countryName               = JP
           stateOrProvinceName       = Osaka
           organizationName          = NullPyon
           organizationalUnitName    = NullPyon
           commonName                = mendocino.example.co.jp
           emailAddress              = tanaka@XXXX.jp
       X509v3 extensions:
           X509v3 Basic Constraints:
               CA:FALSE
           Netscape Comment:
               OpenSSL Generated Certificate
           X509v3 Subject Key Identifier:
               4B:18:48:14:5F:F6:6F:CB:18:4C:B2:2E:A4:7F:2A:71:8F:6A:A1:FB
           X509v3 Authority Key Identifier:
               keyid:42:C1:D4:44:3C:3A:E1:EC:DE:50:1C:0C:11:78:79:1F:3E:4A:01:0A
               DirName:/C=JP/ST=Osaka/L=Osaka/O=NullPyon/OU=NullPyon/CN=demoCA/emailAddress=tanaka@XXXX.jp
               serial:B6:F6:D2:B1:AF:FA:94:28

Certificate is to be certified until Nov 16 05:00:16 2006 GMT (365 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

作成した証明書のベリファイ†

$ openssl verify -CAfile /etc/ssl/demoCA/cacert.pem LDAPserver.crt
LDAPserver.crt: OK

作成した証明書の確認†

内容をテキストで表示して確認する．

$ openssl x509 -text -noout < server.crt
Certificate:
   Data:
       Version: 3 (0x2)
       Serial Number: 5 (0x5)
       Signature Algorithm: md5WithRSAEncryption
...

関連†

• Mac/OpenLDAP への接続
• Sun/OpenLDAP への接続