Apache 設定ファイルの中の SSL 関連ファイル指定†
- SSLCACertificateFile はクライアント証明書を発行したオレオレ認証局の 中間証明書＋root証明書
- pkcs#12 形式のクライアント証明書を配布する
独自認証局の秘密鍵、ルート証明書(CA)の作成†
munakata@mvc:$ cd /etc/ssl/client_unofficial
munakata@mvc:/etc/ssl/client_unofficial$ sudo mkdir -p demoCA/{private,newcerts}
munakata@mvc:/etc/ssl/client_unofficial$ cd demoCA
munakata@mvc:/etc/ssl/client_unofficial/demoCA$ sudo sh -c "echo 01 > serial"
- cakey.pem のパスワード = magumagunana
munakata@mvc:/etc/ssl/client_unofficial/demoCA$ sudo openssl req -x509 -days 3650 -newkey rsa:2048 -keyout private/cakey.pem -out cacert.pem -subj "/C=JP/ST=Kanagawa/O=local/OU=IT admin/CN=$(hostname)"
Generating a 2048 bit RSA private key
................................................................................+++
......................................................................+++
writing new private key to 'private/cakey.pem'
Enter PEM pass phrase: <---- magumagunana
Verifying - Enter PEM pass phrase:
-----
| file | 備考 | |
| private/cakey.pem | 秘密鍵 | &ref(): File not found: "cakey.pem" at page "HomeServer17"; |
| cacert.pem | 認証局(CA)証明書 |  cacert.pem |
秘密鍵とサーバ署名要求(CSR)の作成†
- newkey.pem のパスワード = nanamocha
munakata@mvc:/etc/ssl/client_unofficial$ sudo openssl req -newkey rsa:2048 -keyout newkey.pem -out newreq.pem -subj "/C=JP/ST=Kanagawa/O=local/OU=IT Admin/CN=$(hostname)"
Generating a 2048 bit RSA private key
..+++
.....................+++
writing new private key to 'newkey.pem'
Enter PEM pass phrase: <----- nanamocha
Verifying - Enter PEM pass phrase:
-----
| file | 備考 | |
| newkey.pem | ホストキー(パスワードあり) | &ref(): File not found: "newkey.pem" at page "HomeServer17"; |
| newreq.pem | ホスト証明書 | newreq.pem |
パスワードなしのホストキー作成 (apache に組み込む用)†
munakata@mvc:/etc/ssl/client_unofficial$ sudo openssl rsa -in newkey.pem -out nokey.pem
Enter pass phrase for newkey.pem: <----- nanamocha
writing RSA key
CSRへの署名†
munakata@mvc:/etc/ssl/client_unofficial$ sudo openssl ca -in demoCA/newreq.pem -days 3650 -out demoCA/cert.pem -notext
Using configuration from /usr/lib/ssl/openssl.cnf
Enter pass phrase for ./demoCA/private/cakey.pem: <---- magumagunana
Can't open ./demoCA/index.txt.attr for reading, No such file or directory
139919263568320:error:02001002:system library:fopen:No such file or
directory:../crypto/bio/bss_file.c:74:fopen('./demoCA/index.txt.attr','r')
139919263568320:error:2006D080:BIO routines:BIO_new_file:no such file:../crypto/bio/bss_file.c:81:
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Mar 18 02:07:50 2019 GMT
Not After : Mar 15 02:07:50 2029 GMT
Subject:
countryName = JP
stateOrProvinceName = Kanagawa
organizationName = local
organizationalUnitName = IT Admin
commonName = mvc
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
C7:72:07:0B:AB:C0:08:A9:96:92:05:4E:AB:A2:A8:A4:3D:45:A2:B4
X509v3 Authority Key Identifier:
keyid:18:72:B0:E7:32:18:BA:7A:AB:4C:20:CD:9F:81:31:95:AF:11:A1:78
Certificate is to be certified until Mar 15 02:07:50 2029 GMT (3650 days)
Sign the certificate? [y/n]:Y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
openssl.cnfを編集†
munakata@mvc:/etc/ssl/client_unofficial$ cd demoCA/
munakata@mvc:/etc/ssl/client_unofficial/demoCA$ sudo cp -a /etc/ssl/openssl.cnf .
munakata@mvc:/etc/ssl/client_unofficial/demoCA$ ls -l
合計 56
-rw-r--r-- 1 root root 1261 3月 18 09:53 cacert.pem
-rw-r--r-- 1 root root 1306 3月 18 11:08 cert.pem
-rw-r--r-- 1 root root 73 3月 18 11:08 index.txt
-rw-r--r-- 1 root root 21 3月 18 11:08 index.txt.attr
-rw-r--r-- 1 root root 0 3月 18 10:54 index.txt.old
drwxr-xr-x 2 root root 4096 3月 18 11:08 newcerts
-rw------- 1 root root 1854 3月 18 10:23 newkey.pem
-rw-r--r-- 1 root root 972 3月 18 10:23 newreq.pem
-rw------- 1 root root 1675 3月 18 10:44 nokey.pem
-rw-r--r-- 1 root root 10835 4月 8 2014 openssl.cnf
drwxr-xr-x 2 root root 4096 3月 18 09:53 private
-rw-r--r-- 1 root root 3 3月 18 11:08 serial
-rw-r--r-- 1 root root 3 3月 18 09:47 serial.old
- openssl.cnf
- &ref(): File not found: "diff_openssl.cnf" at page "HomeServer17";
証明書失効リスト用†
munakata@mvc:/etc/ssl/client_unofficial/demoCA$ sudo sh -c "echo "00" > crlnumber"
3種類の認証を組み合わせ†
- ローカルネットからは無条件でログイン可能
- クライアント証明書が確認できたらパスワード無しでログイン可能
- その他のケースでは Google Authentificator（OTP）を使ったログインを要求
<Directory /mnt/raid_vol/html/pukiwiki>↲↲
<RequireAny>↲
# ローカルネットからはパスワードなしアクセスを許可↲
Require ip 172.0.0.1↲
Require ip 192.168.1↲
↲
# それ以外は Google Authentificator を利用↲
<RequireAll>↲
AuthType Basic↲
AuthName "Enter OTP password"↲
AuthBasicProvider OTP↲
Require valid-user↲
OTPAuthUsersFile /mnt/raid_vol/html/otp/users↲
OTPAuthMaxLinger 3600↲
OTPAuthLogoutOnIPChange On↲
</RequireAll>↲
</RequireAny>↲
参考 URL†
![[PukiWiki]](image/taikyoku.gif "[PukiWiki]")
