오레레 인증 기관이되어 오레레 SSL 인증서를 발급하는 방법

우리 인증 기관이 되십시오.

오레레 인증 기관의 비밀 키 만들기

openssl genrsa -des3 -out myCA.key 2048

Generating RSA private key, 2048 bit long modulus
.+++
.......................+++
e is 65537 (0x10001)

오레레 인증 기관 증명서 만들기

openssl req -x509 -new -nodes -key myCA.key -sha256 -days 1825 -out myCA.pem

Enter pass phrase for myCA.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) []:JP
State or Province Name (full name) []:Tokyo
Locality Name (eg, city) []:Minato-ku
Organization Name (eg, company) []:Localhost, Inc.
Organizational Unit Name (eg, section) []:
Common Name (eg, fully qualified host name) []:Localhost
Email Address []:noreply@localhost

오레 인증 기관의 인증서를 Mac에 신뢰

오레레 증명서 받기

오레레 증명서의 비밀 열쇠 만들기

openssl genrsa -out localhost.key 2048

내 서명 요청 만들기

openssl req -new -key localhost.key -out localhost.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) []:JP
State or Province Name (full name) []:Tokyo
Locality Name (eg, city) []:Minato-ku
Organization Name (eg, company) []:Localhost, Inc.
Organizational Unit Name (eg, section) []:
Common Name (eg, fully qualified host name) []:Localhost
Email Address []:noreply@localhost

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:

authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names

[alt_names]
DNS.1 = localhost

오레레 인증 기관으로 오레 증명서를 발급 해 드리겠습니다.

openssl x509 -req -in localhost.csr -CA myCA.pem -CAkey myCA.key -CAcreateserial -out localhost.crt -days 1825 -sha256 -extfile localhost.ext
Signature ok
subject=/C=JP/ST=Tokyo/L=Minato-ku/O=Localhost, Inc./CN=Localhost/emailAddress=noreply@localhost
Getting CA Private Key

Apache SSL 설정

증명서 보관소 확인

grep SSL /etc/httpd/conf.d/ssl.conf | grep File

SSLCertificateFile /etc/pki/tls/certs/localhost.crt
SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt

인증서 등을 배치

cp localhost.crt /etc/pki/tls/certs/localhost.crt
cp localhost.key /etc/pki/tls/private/localhost.key
cp myCA.pem /etc/pki/tls/certs/ca-bundle.crt