環境

パッケージ名	バージョン
openssl	x86_64 1.1.1k 5.el8_5
httpd	x86_64 2.4.37 43.module_el8.5.0+1022+b541f3b1
mod_ssl	x86_6 2.4.37 43.module_el8.5.0+1022+b541f3b1

イメージ図

ルートCA証明書作成

証明書類を作成するための環境を整える

mkdir /opt/pki
mkdir /opt/pki/config
mkdir /opt/pki/RootCA

openssl設定ファイルを作成する

vi /opt/pki/config/openssl_sign.cnf

[ ca ]
default_ca      = CA_default

[ CA_default ]
dir             = ./
certs           = $dir/certs
crl_dir         = $dir/crl
database        = $dir/index.txt
new_certs_dir   = $dir/newcerts
serial          = $dir/serial
crlnumber       = $dir/crlnumber
crl             = $dir/crl.pem
RANDFILE        = $dir/.rand

name_opt        = ca_default
cert_opt        = ca_default

default_days    = 365
default_crl_days= 30
default_bits    = 2048
default_md      = sha256
preserve        = no
policy          = policy_match

[ policy_match ]
countryName             = match
stateOrProvinceName     = match
organizationName        = match
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

[ v3_ca ]
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer
basicConstraints=CA:true
keyUsage = cRLSign,keyCertSign

[ v3_server ]
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
crlDistributionPoints = URI:http://192.168.0.254/crl/example.net.crl

[ v3_client ]
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth
crlDistributionPoints = URI:http://192.168.0.254/crl/example.net.crl

ルートCA秘密鍵の作成

作業ディレクトリに移動して環境を整える。
サーバ証明書作成時に使用

cd /opt/pki/RootCA
mkdir newcerts
echo "01" > serial
echo "00" > crlnumber
touch index.txt

ルートCA秘密鍵を作成する

ルートCA証明書著名要求書とルートCA・サーバ証明書で使用するkeyを作成

# openssl genrsa -out RootCA_key.pem -aes256 -passout pass:rootCaKeyPass 2048

ルートCA証明書著名要求を作成

先ほど作成したルートCA秘密鍵を使って作成

# openssl req -new -out RootCA_csr.pem -key RootCA_key.pem -passin pass:rootCaKeyPass

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:JP
State or Province Name (full name) []:Tokyo
Locality Name (eg, city) [Default City]:City
Organization Name (eg, company) [Default Company Ltd]:Company
Organizational Unit Name (eg, section) []:Section
Common Name (eg, your name or your server's hostname) []:CentOS8-CA
Email Address []:email@test.ca

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

ルートCA証明書作成

作成した証明書著名要求書に対して自身のルートCA秘密鍵で作成
する

openssl ca -config ../config/openssl_sign.cnf -batch -extensions v3_ca -out RootCA_crt.pem -in RootCA_csr.pem -selfsign -keyfile RootCA_key.pem -passin pass:rootCaKeyPass

サーバ証明書作成

cd /opt/pki　に移動

サーバ秘密鍵作成

サーバ証明書著名要求書で使用するkeyを作成

# openssl genrsa > server.key

サーバ証明書著名要求書を作成

先ほど作成したサーバ秘密鍵を使って作成

# openssl req -new -key server.key > server.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:JP
State or Province Name (full name) []:Tokyo
Locality Name (eg, city) [Default City]:City
Organization Name (eg, company) [Default Company Ltd]:Company	
Organizational Unit Name (eg, section) []:Section
Common Name (eg, your name or your server's hostname) []:CentOS8-HTTPS
Email Address []:hoge@piyo 

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

ブラウザでアクセス時の警告非表示

SAN をサーバ証明書に含めるために OpenSSL の設定ファイルにserverのホスト名とIPアドレスを追加。

openssl_sign.cnf

[ v3_server ]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
subjectAltName = DNS:CentOS8-HTTPS, IP:10.0.2.254

サーバ証明書作成

cd /opt/pki/RootCAへ移動。
作成したサーバ証明書著名要求書に対してルートCA秘密鍵で著名して証明書作成する。

# openssl ca -config ../config/openssl_sign.cnf -batch -extensions v3_server -out server.crt -in ../server.csr -cert RootCA_crt.pem -keyfile RootCA_key.pem -passin pass:rootCaKeyPass

証明書内容を確認

# openssl x509 -in server.crt -text -noout

#秘密鍵・証明書配置
apacheのwebサーバへ配置する

# mkdir /etc/httpd/conf/ssl.crt
# mkdir /etc/httpd/conf/ssl.key
# cp server.crt /etc/httpd/conf/ssl.crt/
# cp ../server.key /etc/httpd/conf/ssl.key/

apache起動

# systemctl start httpd && systemctl status httpd