Linux(CentOS 7)でWebサーバーの構築 ~SSL編~
[root@localhost ~]# cd /etc/pki/tls/certs
[root@localhost certs]# make server.key
umask 77 ; \
/usr/bin/openssl genrsa -aes128 2048 > server.key
Generating RSA private key, 2048 bit long modulus
...
...
e is 65537 (0x10001)
Enter pass phrase: # パスフレーズ設定
Verifying - Enter pass phrase: # 再入力# 秘密鍵からパスフレーズを削除
[root@localhost certs]# openssl rsa -in server.key -out server.key
Enter pass phrase for server.key: # パスフレーズ入力
writing RSA key[root@localhost certs]# make server.csr
umask 77 ; \
/usr/bin/openssl req -utf8 -new -key server.key -out server.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:JP # 国
State or Province Name (full name) :Nara # 地域（県）
Locality Name (eg, city) [Default City]:Nara # 都市
Organization Name (eg, company) [Default Company Ltd]:trompot # 組織名
Organizational Unit Name (eg, section) :server # 組織の部門名
Common Name (eg, your name or your server's hostname) :www.trompot.nara # サーバー
Email Address :root@trompot.nara # 管理者アドレス
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password : # Enter
An optional company name : # Enter# 有効期限が10年の自己署名証明書を作成
#SHA-2、ハッシュ長が512ビット を利用
[root@localhost certs]# openssl x509 -in server.csr -out server.crt -req -sha512 -signkey server.key -days 3650
Signature ok
subject=/C=JP/ST=Nara/L=Nara/O=trompot/OU=server/CN=www.trompot.nara/emailAddress=root@trompot.nara
Getting Private key
以上です
SSL SHA-2についてはこちら(wikipedia)もご覧ください
