[Debian]Debian lennyで１からサーバーを作ってみる – opensslをインストール

# aptitude install openssl
# aptitude clean openssl
# cd /etc/ssl/
# cp openssl.cnf openssl.cnf.default
# vi openssl.cnf

[usr_cert]
・・・
#nsCertType = server
↓
nsCertType = server
・・・
[v3_ca]
・・・
#nsCertType = sslCA, emailCA
↓
nsCertType = sslCA, emailCA

# cd /usr/lib/ssl/misc/
# ./CA.sh -newca

CA certificate filename (or enter to create) このままEnter

Making CA certificate ...
Generating a 1024 bit RSA private key
................++++++
..........++++++
writing new private key to './demoCA/private/./cakey.pem'
Enter PEM pass phrase: パスフレーズを入力
Verifying - Enter PEM pass phrase: もう一度パスフレーズを入力
-----
(省略)
-----
Country Name (2 letter code) [AU]: JPと入力
State or Province Name (full name) [Some-State]: Tokyoなど
Locality Name (eg, city) []: 地域名(Edogawaなど)
Organization Name (eg, company)
     [Internet Widgits Pty Ltd]: Enter
Organizational Unit Name (eg, section) []: Enter
Common Name (eg, YOUR name) []: WEBサーバー名
Email Address []: Enter

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []: Enter
An optional company name []: Enter
Using configuration from /usr/lib/ssl/openssl.cnf
Enter pass phrase for
    ./demoCA/private/./cakey.pem: またパスフレーズ

# openssl rsa -in demoCA/private/cakey.pem -out demoCA/private/cakey.pem

# openssl x509 -in demoCA/cacert.pem -out demoCA/cacert.crt

# mkdir /etc/apache2/ssl
# cp /usr/lib/ssl/misc/demoCA/private/cakey.pem /etc/apache2/ssl
# cp /usr/lib/ssl/misc/demoCA/cacert.crt /etc/apache2/ssl

# vi /etc/apache2/sites-available/default-ssl

<ifmodule mod_ssl.c>
<virtualhost _default_:443>
        ServerAdmin webmaster@saizensen.net
        Servername saizensen.net:443
 
        DocumentRoot /var/www/html
        <directory />
                Options FollowSymLinks
                AllowOverride None
 
        <directory /var/www/html>
                Options Includes ExecCGI FollowSymLinks
                AllowOverride All
                Order allow,deny
                allow from all
        </directory>
・・・
・・・
        CustomLog /var/log/apache2/ssl_access.log combined env=!no_log
・・・
・・・
        SSLCertificateFile /etc/apache2/ssl/cacert.crt
        SSLCertificateKeyFile /etc/apache2/ssl/cakey.pem
・・・
・・・
        <ifmodule mod_rewrite.c>
                RewriteEngine On
                RewriteLog "/var/log/apache2/rewrite_log"
                RewriteLogLevel 0
                RewriteCond %{HTTP_HOST} !saizensen.net$
                RewriteRule ^/(.*)?$ http://%{HTTP_HOST}/$1 [L,R]
        </ifmodule>
</virtualhost>
</ifmodule>

# a2enmod ssl
# a2ensite default-ssl
# /etc/init.d/apache2 restart

無効化するときは、a2dismod, a2dissite を使う。

# a2dissite default-ssl
# a2dismod ssl
# /etc/init.d/apache2 restart