HomeServer24
の編集
index.php?HomeServer24
[
トップ
] [
編集
|
差分
|
履歴
|
添付
|
リロード
] [
新規
|
一覧
|
検索
|
最終更新
|
ヘルプ
]
-- 雛形とするページ --
(no template pages)
#contents(); *** 証明書の購入 [#x7eb2e10] - [[namecheap:https://www.namecheap.com/]] から引き続き購入 (2020-07-03) -- user = wikihmuna -- pass = frex7785 - 今回はまた5年分の購入が可能だった。 -- 但し証明書自体は3年間有効で期限切れ前に無償で追加2年分の証明書を再発行する(告知メールが来る) To give you the best price and comply with security standards, SSL certificates valid for 3 years and more should be reissued in 2 years to avoid service interruption. It's easy and free. We'll send you an email reminder when it's time. - 購入履歴 ----> &ref(Order# 58826365.eml); Order Date: Jul 3, 2020 12:38:25 AM Order Number: 58826365 Transaction ID: 67193984 User Name: wikihmuna Final Cost: $24.40 - &color(red){SSL ID = 10352885}; *** 証明書発行に必要な CSR (=Certificate Signing Request) の作成 [#u38d0269] - /etc/ssl/official5 を作成 - 従来は wiki.hmuna.com として CSR を作成していたが Apache のサーバー名を kgb.hmuna.com に変更しているので &color(red){kgb.hmuna.com で作成}; -- 過去履歴を再確認したところ、CSR作成時(次ステップ)ではサーバー名を kgb.hmuna.com にしていた - private key の作成 -- 生成コマンド = sudo openssl genrsa -des3 -out kgb.hmuna.com.privatekey 2048 -- パスフレーズ(今回変更) = &color(red){nanamochamagu}; munakata@mvc:/etc/ssl/official5$ sudo openssl genrsa -des3 -out kgb.hmuna.com.privatekey 2048 Generating RSA private key, 2048 bit long modulus (2 primes) .............+++++ ...................................................................................................................................................................+++++ e is 65537 (0x010001) Enter pass phrase for kgb.hmuna.com.privatekey: Verifying - Enter pass phrase for kgb.hmuna.com.privatekey: munakata@mvc:/etc/ssl/official5$ ls -al 合計 12 drwxr-xr-x 2 root root 4096 7月 4 09:57 . drwxr-xr-x 11 root root 4096 7月 4 09:47 .. -rw------- 1 root root 1743 7月 4 09:57 kgb.hmuna.com.privatekey -- &ref(kgb.hmuna.com.privatekey); - CSR の作成 -- 生成コマンド = sudo openssl req -new -key kgb.hmuna.com.privatekey -out kgbhmunaCSR.csr -- 入力パラメータ munakata@mvc:/etc/ssl/official5$ sudo openssl req -new -key kgb.hmuna.com.privatekey -out kgbhmunaCSR.csr Enter pass phrase for kgb.hmuna.com.privatekey: You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:JP State or Province Name (full name) [Some-State]:Kanagawa Locality Name (eg, city) []:Yokohama Organization Name (eg, company) [Internet Widgits Pty Ltd]:IT admin Organizational Unit Name (eg, section) []:IT Common Name (e.g. server FQDN or YOUR name) []:kgb.hmuna.com Email Address []: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: munakata@mvc:/etc/ssl/official5$ ls -la 合計 16 drwxr-xr-x 2 root root 4096 7月 4 10:09 . drwxr-xr-x 11 root root 4096 7月 4 09:47 .. -rw------- 1 root root 1743 7月 4 09:57 kgb.hmuna.com.privatekey -rw-r--r-- 1 root root 1009 7月 4 10:09 kgbhmunaCSR.csr -- &ref(kgbhmunaCSR.csr); munakata@mvc:/etc/ssl/official5$ cat kgbhmunaCSR.csr -----BEGIN CERTIFICATE REQUEST----- MIICsDCCAZgCAQAwazELMAkGA1UEBhMCSlAxETAPBgNVBAgMCEthbmFnYXdhMREw DwYDVQQHDAhZb2tvaGFtYTERMA8GA1UECgwISVQgYWRtaW4xCzAJBgNVBAsMAklU MRYwFAYDVQQDDA1rZ2IuaG11bmEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A MIIBCgKCAQEApQLJ76TOOn+RuDWcp8e6wNbYeNRwgX34gKXIEICnPMU6/7Utx9Oq 0tEDx6ONmSOQdYVpp5J/YdMEVSnDF/DBwfWR1UBVPd3lJtrjUDiJU//3CIs+tBP1 4e9EqDfCLpwkhUP6lmHFyzgl4TqZ8Qfl8AS1dV2DCIYZUozmBJ4CS3wwluGU5jdT cTsk6wI0H6XmopWeXoJHMmG90g/hNEqlK762lx7CEvHZXcKdkObFD9TAnrQWy0MK tFpAXp+zRWSsScaRTtogeDPhrLtniHHKajUNTKPBL/UF+yRomgdzAsutAMj0yo4p pdDcvHYOP9fkgBTz5K1KXP8AgngUJNiHCwIDAQABoAAwDQYJKoZIhvcNAQELBQAD ggEBACN+J4sADFB5Fv9hKdgAedkuIvkW3Zlrd3FMfC4XMzIGgxrHOBwG3zj8YRBW 8Q25RbLlgrqecnYctflOoq5tB6NvRvcDAyLTXYxGV/BtbYqFbIEdQUY8H/ZaRtVn Th3zDTMbyrQrlWvr5H4HSj6KO11ZiXLVkQEhZzQ+Pwbvp+L4gWy71i8/ZdtMDbAq XsSCl8f+ECOFISWU+gSFI4h4Av8M+0Nm4Yg3qzbpfJ+x7IBy5RsCVfiLl9VmWF9S 7vGNqhfLFOBLE0oTIBq52MFwxga/5aaIxJfZ16n9dZVVFYnzf1X6xBjriUiaG+EE tmxbjeBoCX7BN6tBj54sTr5vcHI= -----END CERTIFICATE REQUEST----- *** メール転送の確認 [#wd1822f0] - https://mail.hmuna.com/postfixadmin/ にアクセス(vmailbox の管理ツール、AWS 上で稼働) -- user = mail-admin -- pass = admin7785 *** Namecheap に CSR を送って SSL 証明書を発行依頼 [#sb7b6211] - サーバー実在証明は postmaster@hmuna.com 宛てを指定 -- &color(red){実際には postmaster@hmuna.com は mail-admin@hmuna.com に転送される}; - 証明書は mail-admin@hmuna.com あてに送付させる &ref(in_progress.JPG); - 証明書発行メール => &ref(ORDER #367061647 - Your PositiveSSL Certificate for kgb.hmuna.com.eml); - ロゴ 発行メール => &ref(ORDER #367061647 - Your COMODO SSL TrustLogo is ready!.eml); - 証明書 (Jul 4, 2020 - &color(red){Nov 6, 2022};) => &ref(kgb_hmuna_com.crt); *** サーバー(kgb.hmuna.com を実行する apache2) へのインストール [#e39e6b37] - 上記の zip ファイルを /etc.ssl/official5 以下にコピーして展開したところ munakata@mvc:/etc/ssl/official5$ ls -l 合計 28 -rw------- 1 root root 1743 7月 4 09:57 kgb.hmuna.com.privatekey -rw-rw-rw- 1 root root 4135 3月 12 2019 kgb_hmuna_com.ca-bundle -rw-rw-rw- 1 root root 2378 7月 4 00:00 kgb_hmuna_com.crt -rwxrw---- 1 root root 6767 7月 4 10:58 kgb_hmuna_com.zip -rw-r--r-- 1 root root 1009 7月 4 10:09 kgbhmunaCSR.csr - /etc/apache2/site-available/kgb.hmuna.com を編集 142 >---# Server Certificate:↲ 143 >---#SSLCertificateFile /etc/ssl/official/wikihmunaSSLCertificateFile.pem↲ 144 >---#SSLCertificateFile /etc/ssl/official2/wikihmunaSSLCertificateFile2.pem↲ 145 >---#SSLCertificateFile /etc/ssl/official2/kgb_hmuna_com.crt↲ 146 >---#SSLCertificateFile /etc/ssl/official3/kgb_hmuna_com.crt↲ 147 >---#SSLCertificateFile /etc/ssl/official4/kgb_hmuna_com.crt↲ 148 >---SSLCertificateFile /etc/ssl/officiali5/kgb_hmuna_com.crt↲ 149 ↲ 150 >---# Server Private Key:↲ 151 >---#SSLCertificateKeyFile /etc/ssl/official/wikihmunaPrivateKey.key↲ 152 >---#SSLCertificateKeyFile /etc/ssl/official2/wiki.hmuna.com.privatekey↲ 153 >---#SSLCertificateKeyFile /etc/ssl/official2/kgb.hmuna.com.privatekey↲ 154 >---#SSLCertificateKeyFile /etc/ssl/official3/kgb201707.key↲ 155 >---#SSLCertificateKeyFile /etc/ssl/official4/wiki.hmuna.com.privatekey↲ 156 >---SSLCertificateKeyFile /etc/ssl/official5/kgb.hmuna.com.privatekey↲ 157 ↲ 158 >---# Server Certificate Chain:↲ 159 >---#SSLCertificateChainFile /etc/ssl/official/RapidSSL_CA_bundle.pem↲ 160 >---#SSLCertificateChainFile /etc/ssl/official2/GeoTrust_intermediate_Certificate.pem↲ 161 >---#SSLCertificateChainFile /etc/ssl/official2/COMODORSAAddTrustCA.crt↲ 162 >---#SSLCertificateChainFile /etc/ssl/official2/COMODORSADomainValidationSecureServerCA.crt↲ 163 >---#SSLCertificateChainFile /etc/ssl/official3/kgb_hmuna_com.ca-bundle↲ 164 >---# Apache 2.4.8 以降 SSLCertificateChainFile は無くなった? (らしいので無効にしてみる)↲ 165 >---#SSLCertificateChainFile /etc/ssl/official4/kgb_hmuna_com.ca-bundle↲ *** パスフレーズを Apache2 起動するたびに毎回聞かれないように key ファイルを更新 [#i2abf576] - key ファイル(wiki.hmuna.com.privatekey)をバックアップ - パスフレーズを取り除いたキーを作成 sudo openssl rsa -in wiki.hmuna.com.privatekey -out wiki.hmuna.com.privatekey Enter pass phrase for wiki.hmuna.com.privatekey: <--- ここでパスフレーズを入力する writing RSA key
タイムスタンプを変更しない
#contents(); *** 証明書の購入 [#x7eb2e10] - [[namecheap:https://www.namecheap.com/]] から引き続き購入 (2020-07-03) -- user = wikihmuna -- pass = frex7785 - 今回はまた5年分の購入が可能だった。 -- 但し証明書自体は3年間有効で期限切れ前に無償で追加2年分の証明書を再発行する(告知メールが来る) To give you the best price and comply with security standards, SSL certificates valid for 3 years and more should be reissued in 2 years to avoid service interruption. It's easy and free. We'll send you an email reminder when it's time. - 購入履歴 ----> &ref(Order# 58826365.eml); Order Date: Jul 3, 2020 12:38:25 AM Order Number: 58826365 Transaction ID: 67193984 User Name: wikihmuna Final Cost: $24.40 - &color(red){SSL ID = 10352885}; *** 証明書発行に必要な CSR (=Certificate Signing Request) の作成 [#u38d0269] - /etc/ssl/official5 を作成 - 従来は wiki.hmuna.com として CSR を作成していたが Apache のサーバー名を kgb.hmuna.com に変更しているので &color(red){kgb.hmuna.com で作成}; -- 過去履歴を再確認したところ、CSR作成時(次ステップ)ではサーバー名を kgb.hmuna.com にしていた - private key の作成 -- 生成コマンド = sudo openssl genrsa -des3 -out kgb.hmuna.com.privatekey 2048 -- パスフレーズ(今回変更) = &color(red){nanamochamagu}; munakata@mvc:/etc/ssl/official5$ sudo openssl genrsa -des3 -out kgb.hmuna.com.privatekey 2048 Generating RSA private key, 2048 bit long modulus (2 primes) .............+++++ ...................................................................................................................................................................+++++ e is 65537 (0x010001) Enter pass phrase for kgb.hmuna.com.privatekey: Verifying - Enter pass phrase for kgb.hmuna.com.privatekey: munakata@mvc:/etc/ssl/official5$ ls -al 合計 12 drwxr-xr-x 2 root root 4096 7月 4 09:57 . drwxr-xr-x 11 root root 4096 7月 4 09:47 .. -rw------- 1 root root 1743 7月 4 09:57 kgb.hmuna.com.privatekey -- &ref(kgb.hmuna.com.privatekey); - CSR の作成 -- 生成コマンド = sudo openssl req -new -key kgb.hmuna.com.privatekey -out kgbhmunaCSR.csr -- 入力パラメータ munakata@mvc:/etc/ssl/official5$ sudo openssl req -new -key kgb.hmuna.com.privatekey -out kgbhmunaCSR.csr Enter pass phrase for kgb.hmuna.com.privatekey: You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:JP State or Province Name (full name) [Some-State]:Kanagawa Locality Name (eg, city) []:Yokohama Organization Name (eg, company) [Internet Widgits Pty Ltd]:IT admin Organizational Unit Name (eg, section) []:IT Common Name (e.g. server FQDN or YOUR name) []:kgb.hmuna.com Email Address []: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: munakata@mvc:/etc/ssl/official5$ ls -la 合計 16 drwxr-xr-x 2 root root 4096 7月 4 10:09 . drwxr-xr-x 11 root root 4096 7月 4 09:47 .. -rw------- 1 root root 1743 7月 4 09:57 kgb.hmuna.com.privatekey -rw-r--r-- 1 root root 1009 7月 4 10:09 kgbhmunaCSR.csr -- &ref(kgbhmunaCSR.csr); munakata@mvc:/etc/ssl/official5$ cat kgbhmunaCSR.csr -----BEGIN CERTIFICATE REQUEST----- MIICsDCCAZgCAQAwazELMAkGA1UEBhMCSlAxETAPBgNVBAgMCEthbmFnYXdhMREw DwYDVQQHDAhZb2tvaGFtYTERMA8GA1UECgwISVQgYWRtaW4xCzAJBgNVBAsMAklU MRYwFAYDVQQDDA1rZ2IuaG11bmEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A MIIBCgKCAQEApQLJ76TOOn+RuDWcp8e6wNbYeNRwgX34gKXIEICnPMU6/7Utx9Oq 0tEDx6ONmSOQdYVpp5J/YdMEVSnDF/DBwfWR1UBVPd3lJtrjUDiJU//3CIs+tBP1 4e9EqDfCLpwkhUP6lmHFyzgl4TqZ8Qfl8AS1dV2DCIYZUozmBJ4CS3wwluGU5jdT cTsk6wI0H6XmopWeXoJHMmG90g/hNEqlK762lx7CEvHZXcKdkObFD9TAnrQWy0MK tFpAXp+zRWSsScaRTtogeDPhrLtniHHKajUNTKPBL/UF+yRomgdzAsutAMj0yo4p pdDcvHYOP9fkgBTz5K1KXP8AgngUJNiHCwIDAQABoAAwDQYJKoZIhvcNAQELBQAD ggEBACN+J4sADFB5Fv9hKdgAedkuIvkW3Zlrd3FMfC4XMzIGgxrHOBwG3zj8YRBW 8Q25RbLlgrqecnYctflOoq5tB6NvRvcDAyLTXYxGV/BtbYqFbIEdQUY8H/ZaRtVn Th3zDTMbyrQrlWvr5H4HSj6KO11ZiXLVkQEhZzQ+Pwbvp+L4gWy71i8/ZdtMDbAq XsSCl8f+ECOFISWU+gSFI4h4Av8M+0Nm4Yg3qzbpfJ+x7IBy5RsCVfiLl9VmWF9S 7vGNqhfLFOBLE0oTIBq52MFwxga/5aaIxJfZ16n9dZVVFYnzf1X6xBjriUiaG+EE tmxbjeBoCX7BN6tBj54sTr5vcHI= -----END CERTIFICATE REQUEST----- *** メール転送の確認 [#wd1822f0] - https://mail.hmuna.com/postfixadmin/ にアクセス(vmailbox の管理ツール、AWS 上で稼働) -- user = mail-admin -- pass = admin7785 *** Namecheap に CSR を送って SSL 証明書を発行依頼 [#sb7b6211] - サーバー実在証明は postmaster@hmuna.com 宛てを指定 -- &color(red){実際には postmaster@hmuna.com は mail-admin@hmuna.com に転送される}; - 証明書は mail-admin@hmuna.com あてに送付させる &ref(in_progress.JPG); - 証明書発行メール => &ref(ORDER #367061647 - Your PositiveSSL Certificate for kgb.hmuna.com.eml); - ロゴ 発行メール => &ref(ORDER #367061647 - Your COMODO SSL TrustLogo is ready!.eml); - 証明書 (Jul 4, 2020 - &color(red){Nov 6, 2022};) => &ref(kgb_hmuna_com.crt); *** サーバー(kgb.hmuna.com を実行する apache2) へのインストール [#e39e6b37] - 上記の zip ファイルを /etc.ssl/official5 以下にコピーして展開したところ munakata@mvc:/etc/ssl/official5$ ls -l 合計 28 -rw------- 1 root root 1743 7月 4 09:57 kgb.hmuna.com.privatekey -rw-rw-rw- 1 root root 4135 3月 12 2019 kgb_hmuna_com.ca-bundle -rw-rw-rw- 1 root root 2378 7月 4 00:00 kgb_hmuna_com.crt -rwxrw---- 1 root root 6767 7月 4 10:58 kgb_hmuna_com.zip -rw-r--r-- 1 root root 1009 7月 4 10:09 kgbhmunaCSR.csr - /etc/apache2/site-available/kgb.hmuna.com を編集 142 >---# Server Certificate:↲ 143 >---#SSLCertificateFile /etc/ssl/official/wikihmunaSSLCertificateFile.pem↲ 144 >---#SSLCertificateFile /etc/ssl/official2/wikihmunaSSLCertificateFile2.pem↲ 145 >---#SSLCertificateFile /etc/ssl/official2/kgb_hmuna_com.crt↲ 146 >---#SSLCertificateFile /etc/ssl/official3/kgb_hmuna_com.crt↲ 147 >---#SSLCertificateFile /etc/ssl/official4/kgb_hmuna_com.crt↲ 148 >---SSLCertificateFile /etc/ssl/officiali5/kgb_hmuna_com.crt↲ 149 ↲ 150 >---# Server Private Key:↲ 151 >---#SSLCertificateKeyFile /etc/ssl/official/wikihmunaPrivateKey.key↲ 152 >---#SSLCertificateKeyFile /etc/ssl/official2/wiki.hmuna.com.privatekey↲ 153 >---#SSLCertificateKeyFile /etc/ssl/official2/kgb.hmuna.com.privatekey↲ 154 >---#SSLCertificateKeyFile /etc/ssl/official3/kgb201707.key↲ 155 >---#SSLCertificateKeyFile /etc/ssl/official4/wiki.hmuna.com.privatekey↲ 156 >---SSLCertificateKeyFile /etc/ssl/official5/kgb.hmuna.com.privatekey↲ 157 ↲ 158 >---# Server Certificate Chain:↲ 159 >---#SSLCertificateChainFile /etc/ssl/official/RapidSSL_CA_bundle.pem↲ 160 >---#SSLCertificateChainFile /etc/ssl/official2/GeoTrust_intermediate_Certificate.pem↲ 161 >---#SSLCertificateChainFile /etc/ssl/official2/COMODORSAAddTrustCA.crt↲ 162 >---#SSLCertificateChainFile /etc/ssl/official2/COMODORSADomainValidationSecureServerCA.crt↲ 163 >---#SSLCertificateChainFile /etc/ssl/official3/kgb_hmuna_com.ca-bundle↲ 164 >---# Apache 2.4.8 以降 SSLCertificateChainFile は無くなった? (らしいので無効にしてみる)↲ 165 >---#SSLCertificateChainFile /etc/ssl/official4/kgb_hmuna_com.ca-bundle↲ *** パスフレーズを Apache2 起動するたびに毎回聞かれないように key ファイルを更新 [#i2abf576] - key ファイル(wiki.hmuna.com.privatekey)をバックアップ - パスフレーズを取り除いたキーを作成 sudo openssl rsa -in wiki.hmuna.com.privatekey -out wiki.hmuna.com.privatekey Enter pass phrase for wiki.hmuna.com.privatekey: <--- ここでパスフレーズを入力する writing RSA key
テキスト整形のルールを表示する
添付ファイル:
kgb_hmuna_com.crt
9件
[
詳細
]
ORDER #367061647 - Your PositiveSSL Certificate for kgb.hmuna.com.eml
36件
[
詳細
]
ORDER #367061647 - Your COMODO SSL TrustLogo is ready!.eml
33件
[
詳細
]
in_progress.JPG
11件
[
詳細
]
kgbhmunaCSR.csr
10件
[
詳細
]
kgb.hmuna.com.privatekey
12件
[
詳細
]
Order# 58826365.eml
35件
[
詳細
]