SSL/TLS(https)を利用してWEBサーバーを運用する

# 認証局を作成cd /etc/pki/tls/misc/
ls
CA c_hash c_info c_issuer c_name
# CA.shを実行し、対話的に作成
./CA -newca
CA certificate filename (or enter to create)

Making CA certificate ...
Generating a 2048 bit RSA private key
.......................+++
..........................+++
# 中略

            X509v3 Basic Constraints: 
                CA:TRUE
Certificate is to be certified until Jun  1 10:58:08 2023 GMT (1095 days)

Write out database with 1 new entries
Data Base Updated
# 各ディレクトリ内に認証局の秘密鍵と自己署名証明書が作られているls /etc/pki/CA/private
# 秘密鍵cakey.pem
cakey.pem
ls /etc/pki/CA
# 自己署名証明書cacert.pem
cacert.pem certs index.txt index.txt.old private careq.pem crl index.txt.attr newcerts
# HTTPSサーバ構築する為のサーバ秘密鍵を作成する
openssl genrsa -out server.key 2048
Generating RSA private key, 2048 bit long modulus
...............................+++
....+++
e is 65537 (0x10001)# 認証局に証明書の発行を要求する為のCSR(証明書発行要求書)を作成する
openssl req -new-key server.key -out server.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
# 略ls
CA c_hash c_info c_issuer c_name server.csr server.key
# 認証局が署名を行い、サーバ証明書を作成する
openssl ca -out server.crt -infile /etc/pki/CA/server.csr
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for /etc/pki/CA/private/cakey.pem:
Check that the request matches the signature
Signature ok

# 中略

Certificate is to be certified until Jun  1 11:08:13 2021 GMT (365 days)
Sign the certificate? [y/n]:y
# エラーメッセージが出力された
failed to update database
TXT_DB error number 2
# メッセージをググってみると古いindex.txtを削除し、新たに作成する必要があるとの事ls /etc/pki/CA
cacert.pem certs index.txt index.txt.old private server.csr careq.pem crl index.txt.attr newcerts
rm /etc/pki/CA/index.*rm: remove regular file ‘/etc/pki/CA/index.txt’? y
rm: remove regular file ‘/etc/pki/CA/index.txt.attr’? y
rm: remove regular empty file ‘/etc/pki/CA/index.txt.old’? y
touch /etc/pki/CA/index.txt
# サーバ証明書の作成を再実行
openssl ca -out server.crt -infiles /etc/pki/CA/server.csr
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for /etc/pki/CA/private/cakey.pem:
Check that the request matches the signature
Signature ok

# 中略

Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
# 今度は無事作成できた
Write out database with 1 new entries
Data Base Updated

ls
CA c_hash c_info c_issuer c_name server.crt server.key
# サーバ証明書とサーバ秘密鍵をapache指定のディレクトリに移動するmkdir /etc/httpd/conf/ssl.crt
mkdir /etc/httpd/conf/ssl.key
mv server.crt /etc/httpd/conf/ssl.crt/server.crt
mv server.key /etc/httpd/conf/ssl.crt/server.key

#　80番ポートをコメントアウトする
#Listen 80
# ここから下部を追記(いらない部分もありそうだが参考書に書いてあるまま)
Listen443<VirtualHost_default_:443>
DocumentRoot"/var/www/html"ServerNamehost02.knowd.co.jp:443ErrorLoglogs/ssl_error_logTransferLoglogs/ssl_access_logLogLevelwarnSSLEngineonSSLProtocolall -SSLv2 -SSLv3SSLCertificateFile /etc/httpd/conf/ssl.crt/server.crtSSLCertificateKeyFile /etc/httpd/conf/ssl.key/server.key</VirtualHost>

apachectl configtest
httpd: Syntax error on line 354 of /etc/httpd/conf/httpd.conf: Cannot load modules/mod_ssl.so into server: /etc/httpd/modules/mod_ssl.so: cannot open shared object file: No such file or directory
# mod_ssl.soモジュールがない、みたいなエラーがでたのでインストールする
yum install mod_ssl.x86_64
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
 * base: ty1.mirror.newmediaexpress.com
　
# 中略

Installed:
  mod_ssl.x86_64 1:2.4.6-93.el7.centos                                          

Complete!

systemctl start httpd
# 設定後のここのエラー(98)Address already in use: AH00072: make_sock: could not bind to addres

lsof -i :443

# コメントアウトする(ここのListenディレクティブがhttpd.confのものと重複しているから？)
#Listen 443 https

systemctl start httpd

# これだけで良かった模様
SSLCertificateFile /etc/httpd/conf/ssl.crt/server.crtSSLCertificateKeyFile /etc/httpd/conf/ssl.key/server.key