考え方†
- mvc (=kgb.hmuna.com) には公式なサーバー証明書を導入済み
- mvc のログイン認証は local IP ゾーン（VPN 接続を含む）は認証なし、その他は One Time パスワード認証を要求
- これに加えクライアント認証を導入し、認証済クライアントはパスワード無しで接続できるようにしたい
- 発行済のサーバー証明書からクライアント証明書を発行する方法が無い（CoMoDo には別にクライアント認証オプションあり）
- 一方でオレオレ認証ベースでのクライアント証明書を発行する事例は多数参考記事がある
- （方針）クライアント証明書については、公式サーバー証明書とは別にオレオレ認証局で作り Apache2 に組み込んで動作確認する
- この考え方（＝サーバー証明書とクライアント証明書は別の認証局を使う）で正しいことを CyberTrust に確認した。
再挑戦 2020-10 (/etc/ssl/private2_for_clientcertificate で作業）†
まずクライアント証明書を発行するためのプライベート認証局を作成†
- この ページの手順に従って自己認証局を作成
- クライアント証明書を発行するための自己認証局設定ファイル（openssl-ca.cnf）を準備する
- /etc/ssl/openssl.cnf をコピーしてリネーム
openssl-ca.cnf
munakata@mvc:/etc/ssl/private2_for_client_certificate$ diff openssl-ca.cnf ../openssl.cnf
73c73
< default_days = 3650 # how long to certify for
---
> default_days = 365 # how long to certify for
170c170
< basicConstraints=CA:TRUE
---
> basicConstraints=CA:FALSE
183d182
< nsCertType = sslCA, emailCA
190d188
< keyUsage = cRLSign, keyCertSign
218d215
< keyUsage = cRLSign, keyCertSign
- 自己認証局の秘密鍵 (ca.key) の作成
- パスフレーズ = magumaguking (サーバー証明書発行とは別にする）
munakata@mvc:/etc/ssl/private2_for_client_certificate$ sudo openssl genrsa -des3 -out ca.key 2048
Generating RSA private key, 2048 bit long modulus (2 primes)
..............................+++++
..............................................................................................................................................................................+++++
e is 65537 (0x010001)
Enter pass phrase for ca.key: <-------------- magumaguking
Verifying - Enter pass phrase for ca.key: <--- magumaguking
- 自己認証局の証明書（ca.crt）の作成
- CN = kgb.hmuna.com <----- サーバー名を設定
munakata@mvc:/etc/ssl/private2_for_client_certificate$ sudo openssl req -new -x509 -days 3650 -sha256 -key ./ca.key -out ./ca.crt -config openssl-ca.cnf
Enter pass phrase for ./ca.key: <--------- magumaguking
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:JP
State or Province Name (full name) [Some-State]:Kanagawa
Locality Name (eg, city) []:Yokohama
Organization Name (eg, company) [Internet Widgits Pty Ltd]:IT
Organizational Unit Name (eg, section) []:Admin
Common Name (e.g. server FQDN or YOUR name) []:kgb.hmuna.com
Email Address []:admin@hmuna.com
作成した自己認証局を使ってクライアント証明書を作成†
- この ページの手順に従ってクライアント証明書を発行
- クライアント証明書を発行するための設定ファイル（openssl-client.cnf）を準備する
- /etc/ssl/openssl.cnf をコピーしてリネーム
- openssl-client.cnf
munakata@mvc:/etc/ssl/private2_for_client_certificate$ diff openssl-client.cnf ../openssl.cnf
42c42
< dir = ./ # Where everything is kept
---
> dir = ./demoCA # Where everything is kept
73c73
< default_days = 3650 # how long to certify for
---
> default_days = 365 # how long to certify for
185c185
< nsCertType = client, email, objsign
---
> # nsCertType = client, email, objsign
- クライアント証明書用の CSR（= Certificate Signing Request）の発行
- パスフレーズ = magumagumocha
- CN = kgb.hmuna.com
munakata@mvc:/etc/ssl/private2_for_client_certificate$ sudo openssl req -new -config openssl-client.cnf -sha256 -keyout cl.key -out cl.csr
Generating a RSA private key
.........................................+++++
....................................................+++++
writing new private key to 'cl.key'
Enter PEM pass phrase: <----------------- magumagumocha
Verifying - Enter PEM pass phrase: <------ magumagumocha
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:JP
State or Province Name (full name) [Some-State]:Kanagawa
Locality Name (eg, city) []:Yokohama
Organization Name (eg, company) [Internet Widgits Pty Ltd]:IT
Organizational Unit Name (eg, section) []:Admin
Common Name (e.g. server FQDN or YOUR name) []:kgb.hmuna.com
Email Address []:admin@hmuna.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
- クライアント証明書の発行 （上記のプライベート認証局でサイン）
munakata@mvc:/etc/ssl/private2_for_client_certificate$ sudo openssl ca -config ./openssl-client.cnf -md sha256 -cert ./ca.crt -keyfile
./ca.key -out cl.crt -infiles cl.csr
Using configuration from ./openssl-client.cnf
Enter pass phrase for ./ca.key: <----------- magumaguking
Can't open .//index.txt.attr for reading, No such file or directory
139929760797120:error:02001002:system library:fopen:No such file or directory:../crypto/bio/bss_file.c:72:fopen('.//index.txt.attr','r')
139929760797120:error:2006D080:BIO routines:BIO_new_file:no such file:../crypto/bio/bss_file.c:79:
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 4096 (0x1000)
Validity
Not Before: Oct 5 05:05:17 2020 GMT
Not After : Oct 3 05:05:17 2030 GMT
Subject:
countryName = JP
stateOrProvinceName = Kanagawa
organizationName = IT
organizationalUnitName = Admin
commonName = kgb.hmuna.com
emailAddress = admin@hmuna.com
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Cert Type:
SSL Client, S/MIME, Object Signing
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
A6:39:AC:A7:CA:E1:38:DD:4B:44:4B:E5:6E:AB:C1:24:59:19:B7:49
X509v3 Authority Key Identifier:
keyid:16:DE:FF:BE:3D:C1:27:74:5D:A7:6F:EA:C0:22:F7:AE:ED:AE:4C:36
Certificate is to be certified until Oct 3 05:05:17 2030 GMT (3650 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
- 端末にインストールするためのクライアント証明書を作成
自己認証局、クライアント証明書 の作成が終わった時点のファイル配置†
munakata@mvc:/etc/ssl/private2_for_client_certificate$ tree ./
./
├── ca.crt
├── ca.der
├── ca.key
├── cl.crt
├── cl.csr
├── cl.key
├── cl.pfx
├── index.txt
├── index.txt.attr
├── index.txt.old
├── newcerts
│ └── 1000.pem
├── openssl-ca.cnf
├── openssl-client.cnf
├── serial
└── serial.old
1 directory, 15 files
配布用クライアント証明書†
- &ref(): File not found: "cl.pfx" at page "HomeServer25";
JCAN 証明書†
参考 URL†
![[PukiWiki]](image/taikyoku.gif "[PukiWiki]")
