Jeans & Development コンピューターのことなどを綴ったメモ (旧：目から鱗 w/SQLite)

ローカルで使用しているApacheで、https のテストが出来るように、SSL環境を構築。ここのページを参考にして行った。

ポイントとしては、

・Windows版のバイナリーは SSL に対応していないので、対応版を入手する
・conf/ssl ディレクトリを作成し、そこにopenssl.confを作る。
・openssl.exe req -config openssl.conf -new -out my-server.csr を実行（あらかじめ、/conf/ssl ディレクトリに移動しておくこと）
・openssl.exe rsa -in privkey.pem -out my-server.key を実行
・openssl.exe x509 -in my-server.csr -out my-server.cert -req -signkey my-server.key -days 365 を実行
・ssl.conf を次のように設定
　　Listen 127.0.0.1:443
　　SSLCertificateFile conf/ssl/my-server.cert
　　SSLCertificateKeyFile conf/ssl/my-server.key
・apache.exe に引数『-D SSL』を与えて起動

というところ。あとは、https://localhost/ にアクセスして、証明書を受け入れるように設定すれば、OK。忘れてはいけないのは、ポートスキャンを行って外部にポートが開いていないことを確認すること。

openssl.confの内容

#
# SSLeay example configuration file.
# This is mostly being used for generation of certificate requests.
#
 
RANDFILE = .rnd
####################################################################
[ ca ]
default_ca = CA_default              # The default ca section
 
####################################################################
[ CA_default ]
dir = .                              # Where everything is kept
certs = $dir\certs                   # Where the issued certs are kept
crl_dir = $dir\crl                   # Where the issued crl are kept
database = $dir\index.txt            # database index file.
new_certs_dir = $dir\newcerts        # default place for new certs.
 
certificate = $dir\cacert.pem        # The CA certificate
serial = $dir\serial                 # The current serial number
crl = $dir\crl.pem                   # The current CRL
private_key = $dir\private\cakey.pem # The private key
RANDFILE = $dir\private\private.rnd  # private random number file
 
x509_extensions = x509v3_extensions  # The extentions to add to the cert
default_days = 365                   # how long to certify for
default_crl_days= 30                 # how long before next CRL
default_md = md5                     # which md to use.
preserve = no                        # keep passed DN ordering
 
# A few difference way of specifying how similar the request should look
# For type CA, the listed attributes must be the same, and the optional
# and supplied fields are just that :-)
policy = policy_match
 
# For the CA policy
[ policy_match ]
countryName = optional
stateOrProvinceName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
 
# For the 'anything' policy
# At this point in time, you must list all acceptable 'object'
# types.
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
 
####################################################################
[ req ]
default_bits = 1024
default_keyfile = privkey.pem
distinguished_name = req_distinguished_name
attributes = req_attributes
 
[ req_distinguished_name ]
countryName = Country Name (2 letter code)
countryName_min = 2
countryName_max = 2
 
stateOrProvinceName = State or Province Name (full name)
 
localityName = Locality Name (eg, city)
 
0.organizationName = Organization Name (eg, company)
 
organizationalUnitName = Organizational Unit Name (eg, section)
 
commonName = Common Name (eg, your website's domain name)
commonName_max = 64
 
emailAddress = Email Address
emailAddress_max = 40
 
[ req_attributes ]
challengePassword = A challenge password
challengePassword_min = 4
challengePassword_max = 20
 
[ x509v3_extensions ]
# under ASN.1, the 0 bit would be encoded as 80
nsCertType = 0x40
 
#nsBaseUrl
#nsRevocationUrl
#nsRenewalUrl
#nsCaPolicyUrl
#nsSslServerName
#nsCertSequence
#nsCertExt
#nsDataType