システム開発おぼえがき: さくらのVPSを使ってみる：HTTPSサーバの構築

「通信データを暗号化できればよい」場合、自社でSSL証明書を発行してHTTPSサーバを立ち上げることができます。

秘密鍵の作成

# cd /etc/hhtpd/conf

# openssl genrsa -des3 1024 > server.key

Generating RSA private key, 1024 bit long modulus
........++++++
..................................++++++
e is 65537 (0x10001)
Enter pass phrase:(パスワードを入力)
Verifying - Enter pass phrase:(パスワードを入力)

公開鍵の作成

# openssl req -new -key server.key > server.csr

Enter pass phrase for server.key:(パスワードを入力)
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:JP
State or Province Name (full name) []:Tokyo
Locality Name (eg, city) [Default City]:Shibuya-Ku
Organization Name (eg, company) [Default Company Ltd]:XXX Co.ltd.
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:www.example.com
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

デジタル証明書の作成

# openssl x509 -in server.csr -days 365 -req -signkey server.key > server.crt

Signature ok
subject=/C=JP/ST=Tokyo/L=Shibuya-Ku/O=XXX Co.ltd./CN=www.example.com
Getting Private key
Enter pass phrase for server.key:(パスワードを入力)

このままではApache立ち上げ時にパスワードを要求されるので、以下の作業を行っておく。
# mv server.key server.key.org

# openssl rsa -in server.key.org > server.key

Enter pass phrase for server.key.org:(パスワードを入力)
writing RSA key

Apacheの設定

# yum install mod_ssl

# vi /etc/httpd/conf.d/ssl.conf

LoadModule ssl_module modules/mod_ssl.so
Listen 443
AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl    .crl
SSLPassPhraseDialog  builtin
SSLSessionCache         shmcb:/var/cache/mod_ssl/scache(512000)
SSLSessionCacheTimeout  300
SSLMutex default
SSLRandomSeed startup file:/dev/urandom  256
SSLRandomSeed connect builtin
SSLCryptoDevice builtin


 ErrorLog logs/ssl_error_log
 TransferLog logs/ssl_access_log
 LogLevel warn
 SSLEngine on
 SSLProtocol all -SSLv2
 SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW
 SSLCertificateFile /etc/httpd/conf/server.crt
 SSLCertificateKeyFile /etc/httpd/conf/server.key
 
  SSLOptions +StdEnvVars
 
 
  SSLOptions +StdEnvVars
 
 SetEnvIf User-Agent ".*MSIE.*" \
   nokeepalive ssl-unclean-shutdown \
   downgrade-1.0 force-response-1.0
 CustomLog logs/ssl_request_log \
    "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"