#author("2020-07-04T11:23:07+09:00","","")
#contents();
*** 証明書の購入 [#x7eb2e10]
- [[namecheap:https://www.namecheap.com/]] から引き続き購入 (2020-07-03)
-- user = wikihmuna
-- pass = frex7785
- 今回はまた5年分の購入が可能だった。
-- 但し証明書自体は3年間有効で期限切れ前に無償で追加2年分の証明書を再発行する（告知メールが来る）
To give you the best price and comply with security standards, SSL certificates valid for 3 years
and more should be reissued in 2 years to avoid service interruption. It's easy and free.
We'll send you an email reminder when it's time.
- 購入履歴 ----> &ref(Order# 58826365.eml);
Order Date: Jul 3, 2020 12:38:25 AM
Order Number: 58826365
Transaction ID: 67193984
User Name: wikihmuna
Final Cost: $24.40
- &color(red){SSL ID = 10352885};
*** 証明書発行に必要な CSR (=Certificate Signing Request) の作成 [#u38d0269]
- /etc/ssl/official5 を作成
- 従来は wiki.hmuna.com として CSR を作成していたが Apache のサーバー名を kgb.hmuna.com に変更しているので &color(red){kgb.hmuna.com で作成};
-- 過去履歴を再確認したところ、CSR作成時（次ステップ）ではサーバー名を kgb.hmuna.com にしていた
- private key の作成
-- 生成コマンド = sudo openssl genrsa -des3 -out kgb.hmuna.com.privatekey 2048
-- パスフレーズ（今回変更） = &color(red){nanamochamagu};
munakata@mvc:/etc/ssl/official5$ sudo openssl genrsa -des3 -out kgb.hmuna.com.privatekey 2048
Generating RSA private key, 2048 bit long modulus (2 primes)
.............+++++
...................................................................................................................................................................+++++
e is 65537 (0x010001)
Enter pass phrase for kgb.hmuna.com.privatekey:
Verifying - Enter pass phrase for kgb.hmuna.com.privatekey:
munakata@mvc:/etc/ssl/official5$ ls -al
合計 12
drwxr-xr-x 2 root root 4096 7月 4 09:57 .
drwxr-xr-x 11 root root 4096 7月 4 09:47 ..
-rw------- 1 root root 1743 7月 4 09:57 kgb.hmuna.com.privatekey
-- &ref(kgb.hmuna.com.privatekey);
- CSR の作成
-- 生成コマンド = sudo openssl req -new -key kgb.hmuna.com.privatekey -out kgbhmunaCSR.csr
-- 入力パラメータ
munakata@mvc:/etc/ssl/official5$ sudo openssl req -new -key kgb.hmuna.com.privatekey -out kgbhmunaCSR.csr
Enter pass phrase for kgb.hmuna.com.privatekey:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:JP
State or Province Name (full name) [Some-State]:Kanagawa
Locality Name (eg, city) []:Yokohama
Organization Name (eg, company) [Internet Widgits Pty Ltd]:IT admin
Organizational Unit Name (eg, section) []:IT
Common Name (e.g. server FQDN or YOUR name) []:kgb.hmuna.com
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
munakata@mvc:/etc/ssl/official5$ ls -la
合計 16
drwxr-xr-x 2 root root 4096 7月 4 10:09 .
drwxr-xr-x 11 root root 4096 7月 4 09:47 ..
-rw------- 1 root root 1743 7月 4 09:57 kgb.hmuna.com.privatekey
-rw-r--r-- 1 root root 1009 7月 4 10:09 kgbhmunaCSR.csr
-- &ref(kgbhmunaCSR.csr);
munakata@mvc:/etc/ssl/official5$ cat kgbhmunaCSR.csr
-----BEGIN CERTIFICATE REQUEST-----
MIICsDCCAZgCAQAwazELMAkGA1UEBhMCSlAxETAPBgNVBAgMCEthbmFnYXdhMREw
DwYDVQQHDAhZb2tvaGFtYTERMA8GA1UECgwISVQgYWRtaW4xCzAJBgNVBAsMAklU
MRYwFAYDVQQDDA1rZ2IuaG11bmEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
MIIBCgKCAQEApQLJ76TOOn+RuDWcp8e6wNbYeNRwgX34gKXIEICnPMU6/7Utx9Oq
0tEDx6ONmSOQdYVpp5J/YdMEVSnDF/DBwfWR1UBVPd3lJtrjUDiJU//3CIs+tBP1
4e9EqDfCLpwkhUP6lmHFyzgl4TqZ8Qfl8AS1dV2DCIYZUozmBJ4CS3wwluGU5jdT
cTsk6wI0H6XmopWeXoJHMmG90g/hNEqlK762lx7CEvHZXcKdkObFD9TAnrQWy0MK
tFpAXp+zRWSsScaRTtogeDPhrLtniHHKajUNTKPBL/UF+yRomgdzAsutAMj0yo4p
pdDcvHYOP9fkgBTz5K1KXP8AgngUJNiHCwIDAQABoAAwDQYJKoZIhvcNAQELBQAD
ggEBACN+J4sADFB5Fv9hKdgAedkuIvkW3Zlrd3FMfC4XMzIGgxrHOBwG3zj8YRBW
8Q25RbLlgrqecnYctflOoq5tB6NvRvcDAyLTXYxGV/BtbYqFbIEdQUY8H/ZaRtVn
Th3zDTMbyrQrlWvr5H4HSj6KO11ZiXLVkQEhZzQ+Pwbvp+L4gWy71i8/ZdtMDbAq
XsSCl8f+ECOFISWU+gSFI4h4Av8M+0Nm4Yg3qzbpfJ+x7IBy5RsCVfiLl9VmWF9S
7vGNqhfLFOBLE0oTIBq52MFwxga/5aaIxJfZ16n9dZVVFYnzf1X6xBjriUiaG+EE
tmxbjeBoCX7BN6tBj54sTr5vcHI=
-----END CERTIFICATE REQUEST-----
*** メール転送の確認 [#wd1822f0]
- https://mail.hmuna.com/postfixadmin/ にアクセス（vmailbox の管理ツール、AWS 上で稼働）
-- user = mail-admin
-- pass = admin7785
*** Namecheap に CSR を送って SSL 証明書を発行依頼 [#sb7b6211]
- サーバー実在証明は postmaster@hmuna.com 宛てを指定
-- &color(red){実際には postmaster@hmuna.com は mail-admin@hmuna.com に転送される};
- 証明書は mail-admin@hmuna.com あてに送付させる
&ref(in_progress.JPG);
- 証明書発行メール => &ref(ORDER #367061647 - Your PositiveSSL Certificate for kgb.hmuna.com.eml);
- ロゴ 発行メール => &ref(ORDER #367061647 - Your COMODO SSL TrustLogo is ready!.eml);
- 証明書 (Jul 4, 2020 - &color(red){Nov 6, 2022};) => &ref(kgb_hmuna_com.crt);
*** サーバー(kgb.hmuna.com を実行する apache2) へのインストール [#e39e6b37]
- 上記の zip ファイルを /etc.ssl/official5 以下にコピーして展開したところ
munakata@mvc:/etc/ssl/official5$ ls -l
合計 28
-rw------- 1 root root 1743 7月 4 09:57 kgb.hmuna.com.privatekey
-rw-rw-rw- 1 root root 4135 3月 12 2019 kgb_hmuna_com.ca-bundle
-rw-rw-rw- 1 root root 2378 7月 4 00:00 kgb_hmuna_com.crt
-rwxrw---- 1 root root 6767 7月 4 10:58 kgb_hmuna_com.zip
-rw-r--r-- 1 root root 1009 7月 4 10:09 kgbhmunaCSR.csr
- /etc/apache2/site-available/kgb.hmuna.com を編集
142 >---# Server Certificate:↲
143 >---#SSLCertificateFile /etc/ssl/official/wikihmunaSSLCertificateFile.pem↲
144 >---#SSLCertificateFile /etc/ssl/official2/wikihmunaSSLCertificateFile2.pem↲
145 >---#SSLCertificateFile /etc/ssl/official2/kgb_hmuna_com.crt↲
146 >---#SSLCertificateFile /etc/ssl/official3/kgb_hmuna_com.crt↲
147 >---#SSLCertificateFile /etc/ssl/official4/kgb_hmuna_com.crt↲
148 >---SSLCertificateFile /etc/ssl/officiali5/kgb_hmuna_com.crt↲
149 ↲
150 >---# Server Private Key:↲
151 >---#SSLCertificateKeyFile /etc/ssl/official/wikihmunaPrivateKey.key↲
152 >---#SSLCertificateKeyFile /etc/ssl/official2/wiki.hmuna.com.privatekey↲
153 >---#SSLCertificateKeyFile /etc/ssl/official2/kgb.hmuna.com.privatekey↲
154 >---#SSLCertificateKeyFile /etc/ssl/official3/kgb201707.key↲
155 >---#SSLCertificateKeyFile /etc/ssl/official4/wiki.hmuna.com.privatekey↲
156 >---SSLCertificateKeyFile /etc/ssl/official5/kgb.hmuna.com.privatekey↲
157 ↲
158 >---# Server Certificate Chain:↲
159 >---#SSLCertificateChainFile /etc/ssl/official/RapidSSL_CA_bundle.pem↲
160 >---#SSLCertificateChainFile /etc/ssl/official2/GeoTrust_intermediate_Certificate.pem↲
161 >---#SSLCertificateChainFile /etc/ssl/official2/COMODORSAAddTrustCA.crt↲
162 >---#SSLCertificateChainFile /etc/ssl/official2/COMODORSADomainValidationSecureServerCA.crt↲
163 >---#SSLCertificateChainFile /etc/ssl/official3/kgb_hmuna_com.ca-bundle↲
164 >---# Apache 2.4.8 以降 SSLCertificateChainFile は無くなった？ （らしいので無効にしてみる）↲
165 >---#SSLCertificateChainFile /etc/ssl/official4/kgb_hmuna_com.ca-bundle↲
*** パスフレーズを Apache2 起動するたびに毎回聞かれないように key ファイルを更新 [#i2abf576]
- key ファイル（wiki.hmuna.com.privatekey）をバックアップ
- パスフレーズを取り除いたキーを作成
sudo openssl rsa -in wiki.hmuna.com.privatekey -out wiki.hmuna.com.privatekey
Enter pass phrase for wiki.hmuna.com.privatekey: <--- ここでパスフレーズを入力する
writing RSA key
![[PukiWiki]](image/taikyoku.gif "[PukiWiki]")
