openssl のインストール

なにはともあれ openssl をインストールしないと始まりません。

$ sudo apt-get install openssl

無事インストールできていることを確認します。

$ openssl version
OpenSSL 1.0.1f 6 Jan 2014

CAを作る

基本的には openssl に付属する CA.pl を実行するのみで、あとは聞かれたことに答えていくだけの簡単なお仕事です。

$ /usr/lib/ssl/misc/CA.pl -newca
CA certificate filename (or enter to create)

Making CA certificate ...
Generating a 2048 bit RSA private key
...........+++
...............................................+++
writing new private key to './demoCA/private/cakey.pem'
Enter PEM pass phrase: [Enter]
Verifying - Enter PEM pass phrase: [Enter]
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:JP
State or Province Name (full name) [Some-State]:Tokyo
Locality Name (eg, city) []: hoge
Organization Name (eg, company) [Internet Widgits Pty Ltd]:hoge
Organizational Unit Name (eg, section) []:hoge
Common Name (e.g. server FQDN or YOUR name) []:racchai.hatenablog.com           
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []: [Enter]
An optional company name []: [Enter]
Using configuration from /usr/lib/ssl/openssl.cnf
Enter pass phrase for ./demoCA/private/cakey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 12638702878509932104 (0xaf65b14e274a9e48)
        Validity
            Not Before: Apr  4 05:20:14 2016 GMT
            Not After : Apr  4 05:20:14 2019 GMT
        Subject:
            countryName               = JP
            stateOrProvinceName       = Tokyo
            organizationName          = hoge
            organizationalUnitName    = hoge
            commonName                = racchai.hatenablog.com
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                D9:62:CF:F8:69:5C:8B:0B:5A:7D:83:AD:E9:1A:ED:3D:85:53:A2:F1
            X509v3 Authority Key Identifier: 
                keyid:D9:62:CF:F8:69:5C:8B:0B:5A:7D:83:AD:E9:1A:ED:3D:85:53:A2:F1

            X509v3 Basic Constraints: 
                CA:TRUE
Certificate is to be certified until Apr  4 05:20:14 2019 GMT (1095 days)

Write out database with 1 new entries
Data Base Updated

カレントディレクトリ以下に demoCA が作成されたことが確認できればOKです。

$ find . 
.
./demoCA
./demoCA/careq.pem
./demoCA/serial
./demoCA/cacert.pem
./demoCA/index.txt
./demoCA/newcerts
./demoCA/newcerts/AF65B14E274A9E48.pem
./demoCA/index.txt.attr
./demoCA/index.txt.old
./demoCA/crl
./demoCA/private
./demoCA/private/cakey.pem
./demoCA/certs
./demoCA/crlnumber

念のため、秘密鍵の権限設定だけしておきましょう。

chmod 600 ./demoCA/private/cakey.pem 
sudo chown root:root ./demoCA/private/cakey.pem

なお、CAの期限はデフォルトで1095日(3年)となっているので、変更したい方は CA.pl 内で定義されている $CADAYS 変数を変更しましょう。

// オリジナルファイルを直接編集せず、複製したものを編集して利用することを推奨します

サーバー証明書を作る

CA が作れたら、実際に証明書を作ってみましょう。

CSR の作成

証明書の元となる CSR を作成します。

$ openssl req -new -keyout key.pem -out req.pem -newkey rsa:2048
Generating a 2048 bit RSA private key
.......................................................................................................................+++
...+++
writing new private key to 'key.pem'
Enter PEM pass phrase: racchai
Verifying - Enter PEM pass phrase: racchai
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:JP
State or Province Name (full name) [Some-State]:Tokyo
Locality Name (eg, city) []:hoge
Organization Name (eg, company) [Internet Widgits Pty Ltd]:hoge
Organizational Unit Name (eg, section) []:hoge
Common Name (e.g. server FQDN or YOUR name) []:racchai.hatenablog.com
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []: [Enter]
An optional company name []: [Enter]

これでカレントディレクトリに秘密鍵(key.pem)と署名対象となるCSR(req.pem)が作成されました。

CSR に署名し、証明書ファイルを作成する

$ openssl ca -out cert.pem -infiles req.pem
Using configuration from /usr/lib/ssl/openssl.cnf
Enter pass phrase for ./demoCA/private/cakey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 12638702878509932105 (0xaf65b14e274a9e49)
        Validity
            Not Before: Apr  4 05:54:35 2016 GMT
            Not After : Apr  4 05:54:35 2017 GMT
        Subject:
            countryName               = JP
            stateOrProvinceName       = Tokyo
            organizationName          = hoge
            organizationalUnitName    = hoge
            commonName                = racchai.hatenablog.com
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
                10:5E:F2:E9:C6:FA:9F:C1:2C:1B:A7:20:52:AD:CF:09:74:53:98:65
            X509v3 Authority Key Identifier: 
                keyid:D9:62:CF:F8:69:5C:8B:0B:5A:7D:83:AD:E9:1A:ED:3D:85:53:A2:F1

Certificate is to be certified until Apr  4 05:54:35 2017 GMT (365 days)
Sign the certificate? [y/n]:y

最後に、カレントディレクトリに証明書(cert.pem)が正しく作成されていることを確認しましょう。