ApacheでSSLサーバを構築

ApacheでSSLサーバを立てるには、ちょっと前ならApache + Apache-SSL(ApacheをSSL対応にするためのパッチ) + SSLeayが主流だったようですが、最近ではApache + mod_ssl + OpenSSLが主流のようです。

現在のところApache-SSLはApache1.3.11に対応していないようなので、今回はmod_sslとOpenSSLを使った方法でいきます。ソースにパッチをあてる方式よりも、モジュールで組み込むほうが個人的には好きだし。

ここではApacheでSSLサーバを立てることだけを目標としますので、細かい概念や用語説明は一切しません。この辺りについては、「OpenSSLによるCA構築」で説明する予定です。

まず、以下のサイトから必要なファイルをダウンロードします。2000年1月30日現在の最新版です。

• Apache 1.3.11.tar.gz
• mod_ssl-2.5.0-1.3.11.tar.gz
• openssl-0.9.4.tar.gz

CAを立ち上げる場合には、以下のパッチも必要です。

• openssl-0.9.4-patches-02.tar.gz (OpenCAのサイトはつながらない…)

% tar zxvf openssl-0.9.4.tar.gz % tar zxvf openssl-0.9.4-patches-02.tar.gz % cd openssl-0.9.4-patches-02 % make Enter the OpenSSL SOURCES dir : ../openssl-0.9.4 Installing patches in ../openssl-0.9.4 ... Done.. % cd ../openssl-0.9.4 % ./config % make % su # make install

% tar zxvf apache_1.3.11.tar.gz % tar zxvf mod_ssl-2.5.0-1.3.11.tar.gz % cd mod_ssl-2.5.0-1.3.11 % ./configure --with-apache=../apache_1.3.11 --with-ssl=/usr/local/ssl % cd ../apache_1.3.11 % make % su # make install

mod_sslのconfigureを実行すると、Apache側のconfigureも自動的にしてくれるので、apacheのディレクトリにcdした後に./configureを実行する必要はありません。
make certificateも実行しなくて良いです。証明書は後で作るので。

CAやサーバ用の証明書、ドキュメントルートやCGIディレクトリ、アイコンディレクトリなどを作成します。ここでは例として以下のようなディレクトリ構成にします。

/home/httpsd
/home/httpsd/cache	キャッシュディレクトリ
/home/httpsd/certs/ca	CAディレクトリ
/home/httpsd/certs/ca/crl	CRLディレクトリ
/home/httpsd/certs/ca/newcerts
/home/httpsd/certs/ca/private
/home/httpsd/certs/etc	設定ファイルなど
/home/httpsd/certs/httpsd	サーバ証明書用ディレクトリ
/home/httpsd/certs/httpsd/private	サーバ秘密鍵用ディレクトリ
/home/httpsd/cgi-bin	CGIディレクトリ
/home/httpsd/docs	ドキュメントルートディレクトリ
/home/httpsd/icons	アイコンディレクトリ
/home/httpsd/logs	ログディレクトリ

証明書管理用データベースの初期設定

# cd /home/httpsd/certs/ca # touch index.txt # echo 01 > serial

秘密鍵の作成

# /usr/local/ssl/bin/openssl genrsa -out private/key.pem 1024 1120 semi-random bytes loaded Generating RSA private key, 1024 bit long modulus ......................+++++ ........................................+++++ e is 65537 (0x10001)

証明書の作成

# openssl req -new -x509 -key private/key.pem -out cert.pem Using configuration from /usr/local/ssl/openssl.cnf You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:US State or Province Name (full name) [Some-State]:California Locality Name (eg, city) []:Sunnyvale Organization Name (eg, company) [Internet Widgits Pty Ltd]:mizzy.org Organizational Unit Name (eg, section) []: Common Name (eg, YOUR name) []:webmaster@mizzy.org Email Address []:webmaster@mizzy.org 青い字の部分は適宜変更してください。CAの情報に反映されます。

CA証明書のコピー

# cp cert.pem ../httpsd/cacert.pem

秘密鍵の作成

# cd /home/httpsd/certs/httpsd # /usr/local/ssl/bin/openssl genrsa -out private/key.pem 1024 1120 semi-random bytes loaded Generating RSA private key, 1024 bit long modulus ......................+++++ ........................................+++++ e is 65537 (0x10001)

CSRの作成

# /usr/local/ssl/bin/openssl req -new -key private/key.pem -out csr.pem Using configuration from /usr/local/ssl/openssl.cnf You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:US State or Province Name (full name) [Some-State]:California Locality Name (eg, city) []: Organization Name (eg, company) [Internet Widgits Pty Ltd]:mizzy.org Organizational Unit Name (eg, section) []: Common Name (eg, YOUR name) []:www.mizzy.org Email Address []:webmaster@mizzy.org Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: 青い字の部分は適宜変更してください。サーバの証明書情報に反映されます。 Common NameにはサーバのFQDNを入力してください。

CSRにCAの秘密鍵で署名
まず、以下のような設定ファイル(/home/httpsd/certs/etc/ca_https.conf)を作成します。

[ ca ] default_ca = CA_default x509_extensions = usr_cert [ CA_default ] dir = /home/httpsd/certs/ca certs = $dir/certs crl_dir = $dir/crl # CA_DB = new_certs_dir = $dir/newcerts certificate = $dir/cert.pem serial = $dir/serial crl = $dir/crl.pem private_key = $dir/private/key.pem database = $dir/index.txt # RANDFILE = default_days = 30 # default_startdate = # default_enddate = default_crl_days = 30 # default_crl_hours = default_md = md5 # preserve = no policy = policy_match x509_extensions = x509v3_extensions # crl_extensions = # msie_hack = [ policy_match ] countryName = optional stateOrProvinceName = optional organizationName = optional organizationalUnitName = optional commonName = supplied emailAddress = optional [ usr_cert ] basicConstraints=CA:FALSE nsCertType = sslCA, emailCA, server, client, email, objsign # nsCertType = objsign # nsCertType = client, email # nsCertType = client, email, objsign # nsComment = "OpenSSL Generated Certificate" subjectKeyIdentifier=hash authorityKeyIdentifier=keyid,issuer:always [ x509v3_extensions ] subjectKeyIdentifier=hash basicConstraints = CA:true nsCertType = sslCA, emailCA, server, client, email, objsign

署名する

# /usr/local/ssl/bin/openssl ca -batch -config ../etc/ca_https.conf -out cert.pem -infiles csr.pem Using configuration from ../etc/ca_https.conf Check that the request matches the signature Signature ok The Subjects Distinguished Name is as follows countryName :PRINTABLE:'US' stateOrProvinceName :PRINTABLE:'California' localityName :PRINTABLE:'Sunnyvale' organizationName :PRINTABLE:'mizzy.org' commonName :PRINTABLE:'www.mizzy.org' emailAddress :IA5STRING:'webmaster@mizzy.org' Certificate is to be certified until Jan 29 03:33:00 2000 GMT (30 days) Write out database with 1 new entries Data Base Updated

# cd /home/httpsd/certs/ca # openssl ca -gencrl -config ../etc/ca_https.conf -out crl.pem Using configuration from ../etc/ca_https.conf # cp crl.pem ../httpsd

ServerName www.mizzy.org ServerType standalone ServerAdmin webmaster@mizzy.org User nobody Group nobody ServerRoot "/usr/local/apache" Port 443 Listen 443 SSLEngine on DocumentRoot /home/httpsd/docs TransferLog /home/httpsd/logs/access.log ErrorLog /home/httpsd/logs/error.log CustomLog /home/httpsd/logs/custom.log \ "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b" SSLLog /home/httpsd/logs/ssl.log SSLLogLevel info ScriptAlias /cgi-bin/ /home/httpsd/cgi-bin/ Alias /icons/ /home/httpsd/icons/ AddType application/x-x509-ca-cert .crt AddType application/x-pkcs7-crl .crl SSLPassPhraseDialog builtin SSLSessionCache dbm:/home/httpsd/cache/mod_ssl_cache SSLSessionCacheTimeout 300 SSLMutex file:/home/httpsd/cache/mod_ssl_mutex SSLRandomSeed startup builtin SSLRandomSeed connect builtin SSLCipherSuite ALL SSLCertificateFile /home/httpsd/certs/httpsd/cert.pem SSLCertificateKeyFile /home/httpsd/certs/httpsd/private/key.pem SSLCACertificateFile /home/httpsd/certs/httpsd/cacert.pem SSLCARevocationFile /home/httpsd/certs/httpsd/crl.pem #SSLVerifyClient require #SSLVerifyDepth 10 #SSLOptions +FakeBasicAuth +ExportCertData SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown 既に存在するディレクティブは修正、存在しないディレクティブは追加 してください。

# /usr/local/apache/bin/apachctl start

うまく起動しない場合は、/home/httpsd/logs/error.logを参照してください。

前のページへ戻る