[사설 인증서 생성 및 설치]
1. key 생성
openssl genrsa -out server.key 1024
2. 요청서 생성
openssl req -new -days 36500 -key server.key -out server.csr
Enter pass phrase for server.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:KR
State or Province Name (full name) []:Seoul
Locality Name (eg, city) [Default City]:Seoul
Organization Name (eg, company) [Default Company Ltd]:company name
Organizational Unit Name (eg, section) []:iOffice
Common Name (eg, your name or your server's hostname) []:xx.xxx.xxx.xx (serverIP)
Email Address []:email@aaa.com
Please enter the following 'extra' attributesa
to be sent with your certificate request
A challenge password []:
An optional company name []:
3. 인증서 생성
vi v3.ext
|
subjectKeyIdentifier=hash authorityKeyIdentifier=keyid:always,issuer:always basicConstraints=CA:true
|
openssl x509 -req -days 36500 -in server.csr -signkey server.key -out server.crt -extfile v3.ext
4. key 암호 제거
openssl rsa -in server.key -out server_nopass.key
4-1. apache 인증서 설치
cp * /usr/local/apache/conf/
config 수정
vi /usr/local/apache/conf/extra/httpd-ssh.conf
|
SSLCertificateFile "/usr/local/apache/conf/server.crt" .. SSLCertificateKeyFile "/usr/local/apache/conf/server.key" .. |
apache 재부팅
5. 인증서 설치
1) Windows (IE, Chrome 적용)
인증서 실행 → [인증서 설치] → [모든 인증서를 다음 저장소에 저장] 선택 후,
'신뢰할 수 있는 루트 인증 기관'에 저장
2) Java
(1) cmd 창 띄운 뒤, 아래 위치로 이동 및 인증서 파일 복사
위치 : %JAVA_HOME%/jre/lib/security
(2) cacerts list 확인 (password : changeit)
keytool -list -keystore cacerts
(3) 인증서 설치 (password : changeit, yes 선택)
keytool -keystore cacerts -importcert -alias securagedev -file server.cer
(4) cacerts list 확인 (password : changeit)
아래 내용이 출력되는지 확인
securagedev, 2014. 6. 25, trustedCertEntry,
인증서 지문(SHA1): E4:68:79:D3:6E:C7:E2:AE:C0:F6:E0:72:07:A4:0E:97:CA:A1:7B:BE
[인증서를 추가하는 방법 (linux) ]
java home으로 이동
cd /usr/java/jdk.x.x.x/bin
아래 구문 실행
./keytool -importcert -keystore ../jre/lib/security/cacerts -storepass changeit -file /home/server.crt -alias lesstif.com |