オレオレ証明書を作ってみる
SSL/TSL での証明書が必要ななる場合がしばしばある。そこで、ネットにある情報では作り方が古いことも多いので、記事にしてみる事にしました。
※ 現在では「オレオレ証明書」は推奨されていません。代わりに「Apache に無料の SSL 証明書をインストールする」をご利用下さい。
Makefile をバックアップしておく
# cd /etc/pki/tls/certs
# cp Makefile Makefile.org
# cp Makefile Makefile.org
有効期間を１０年にしておく
※ ハードディクスの寿命は、電源を入れっぱなしの状態で、約２年半くらいなので、１０年で十分。
# vi Makefile
DAYS=3650
DAYS=3650
早速、作ってみる
※ ここではキーの名前を「 magic-object.crt」にしてあります。必要に応じて、各所を変更してください。
※ 赤字の部分には特に注意して下さい。
# make magic-object.crt
umask 77 ; \
/usr/bin/openssl genrsa -aes128 2048 > magic-object.key
Generating RSA private key, 2048 bit long modulus
………………………………………+++
…………………………………………………………………….+++
e is 65537 (0x10001)
Enter pass phrase:
Verifying – Enter pass phrase:
umask 77 ; \
/usr/bin/openssl req -utf8 -new -key magic-object.key -x509 -days 3650 -out magic-object.crt
Enter pass phrase for magic-object.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
—–
Country Name (2 letter code) [XX]:JP
State or Province Name (full name) []:Hyogo
Locality Name (eg, city) [Default City]:
Organization Name (eg, company) [Default Company Ltd]:Magic Object
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server’s hostname) []:titan.magic-object.mydns.jp
Email Address []:****@magic-object.mydns.jp
[root@titan certs]# openssl x509 -in magic-object.crt -noout -subject -issuer -dates
subject= /C=JP/ST=Hyogo/L=Default City/O=Magic Object/CN=titan.magic-object.mydns.jp/emailAddress=****@magic-object.mydns.jp
issuer= /C=JP/ST=Hyogo/L=Default City/O=Magic Object/CN=titan.magic-object.mydns.jp/emailAddress=****@magic-object.mydns.jp
notBefore=May 27 15:01:04 2017 GMT
notAfter=May 25 15:01:04 2027 GMT
# ls
Makefile Makefile.org ca-bundle.crt ca-bundle.trust.crt localhost.crt magic-object.crt magic-object.key make-dummy-cert renew-dummy-cert
#
# # スフレーズを削除した秘密鍵を/etc/pki/tls/private/に作成し、パーミッションを落としておく。
# umask 77
# openssl rsa -in magic-object.key -out ../private/magic-object.key
Enter pass phrase for magic-object.key:
writing RSA key
#
umask 77 ; \
/usr/bin/openssl genrsa -aes128 2048 > magic-object.key
Generating RSA private key, 2048 bit long modulus
………………………………………+++
…………………………………………………………………….+++
e is 65537 (0x10001)
Enter pass phrase:
Verifying – Enter pass phrase:
umask 77 ; \
/usr/bin/openssl req -utf8 -new -key magic-object.key -x509 -days 3650 -out magic-object.crt
Enter pass phrase for magic-object.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
—–
Country Name (2 letter code) [XX]:JP
State or Province Name (full name) []:Hyogo
Locality Name (eg, city) [Default City]:
Organization Name (eg, company) [Default Company Ltd]:Magic Object
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server’s hostname) []:titan.magic-object.mydns.jp
Email Address []:****@magic-object.mydns.jp
[root@titan certs]# openssl x509 -in magic-object.crt -noout -subject -issuer -dates
subject= /C=JP/ST=Hyogo/L=Default City/O=Magic Object/CN=titan.magic-object.mydns.jp/emailAddress=****@magic-object.mydns.jp
issuer= /C=JP/ST=Hyogo/L=Default City/O=Magic Object/CN=titan.magic-object.mydns.jp/emailAddress=****@magic-object.mydns.jp
notBefore=May 27 15:01:04 2017 GMT
notAfter=May 25 15:01:04 2027 GMT
# ls
Makefile Makefile.org ca-bundle.crt ca-bundle.trust.crt localhost.crt magic-object.crt magic-object.key make-dummy-cert renew-dummy-cert
#
# # スフレーズを削除した秘密鍵を/etc/pki/tls/private/に作成し、パーミッションを落としておく。
# umask 77
# openssl rsa -in magic-object.key -out ../private/magic-object.key
Enter pass phrase for magic-object.key:
writing RSA key
#
