手順概要
- 秘密鍵作成
- CSR作成
- サーバ証明書作成
<実行コマンド サマリー>
command
$ openssl genrsa -des3 -rand file1:file2:file3 2048 > server.key
$ openssl rsa -in server.key -out server.key.nopass
command
$ openssl req -new -key server.key -out server.csr -sha1
command
$ openssl x509 -in server.csr -out server.crt -req -signkey server.key.nopass -days 3650
手順詳細
1. 秘密鍵作成
command
$ openssl genrsa -des3 -rand file1:file2:file3 2048 > server.key
結果
0 semi-random bytes loaded
Generating RSA private key, 2048 bit long modulus
.............................+++
.......................................................+++
e is 65537 (0x10001)
Enter pass phrase: #←秘密鍵のパスワード（すぐ後で解除するので一時的なもの）
Verifying - Enter pass phrase: #←再入力
<秘密鍵の作成結果>
command
$ ls -l
秘密鍵の作成結果
total 4
-rw-r--r-- 1 root root 1743 Nov 5 12:24 server.key
※このまま秘密鍵を利用すると、Apacheを再起動する度にPWを聞かれるため、あらかじめ秘密鍵のパスワードを解除しておく。
command
$ openssl rsa -in server.key -out server.key.nopass
Enter pass phrase for server.key: #←先ほど入力した秘密鍵のパスワード
writing RSA key
2. CSR作成
command
$ openssl req -new -key server.key -out server.csr -sha1
(実行結果参考)
結果
Enter pass phrase for server.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
（以下対話式で証明書のサブジェクトの情報を入力）
Country Name (2 letter code) [XX]: ←（国名(JP)）
State or Province Name (full name) []: ←（都道府県(Tokyoなど)）
Locality Name (eg, city) [Default City]: ←（所在地(～区など)）
Organization Name (eg, company) [Default Company Ltd]: ←（会社名）
Organizational Unit Name (eg, section) []: ←（組織名）
Common Name (eg, your name or your server's hostname) []: ←（コモンネーム(ドメイン名)）
Email Address []: ←（Emailアドレス(空欄でもOK)）
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []: ←空欄Enter
An optional company name []: ← 〃
(CSR作成完了後)
command
$ ls -l
total 12
-rw-r--r-- 1 root root 1041 Nov 5 14:34 server.csr
-rw-r--r-- 1 root root 1743 Nov 5 12:24 server.key
-rw-r--r-- 1 root root 1675 Nov 5 14:26 server.key.nopass
3. サーバ証明書作成
command
$ openssl x509 -in server.csr -out server.crt -req -signkey server.key.nopass -days 3650
Signature ok
subject=/C=JP/ST=Tokyo/L=xxxxxxx/O=xxxxxxxxxxxxxx/OU=xxxxxxxxxxxx/CN=xxx.xxx.jp
Getting Private key
command
$ ls -l
total 16
-rw-r--r-- 1 root root 1281 Nov 5 14:37 server.crt
-rw-r--r-- 1 root root 1041 Nov 5 14:34 server.csr
-rw-r--r-- 1 root root 1743 Nov 5 12:24 server.key
-rw-r--r-- 1 root root 1675 Nov 5 14:26 server.key.nopass