1. apache
覚書。NetBSD-1.6とpkgsrcのapache2で行いました。
http://httpd.apache.org/docs-2.0/ssl/ssl_faq.html を見ながら作業します。
$ cd /usr/pkg/etc/httpd $ mkdir ssl $ cd /usr/pkg/etc/httpd/ssl $ openssl genrsa -des3 -out server.key 1024 -rand /var/log/messages Generating RSA private key, 1024 bit long modulus ...................++++++ ...++++++ e is 65537 (0x10001) Enter PEM pass phrase: Verifying password - Enter PEM pass phrase: $ openssl req -new -key server.key -out server.csr Using configuration from /etc/openssl/openssl.cnf Enter PEM pass phrase: You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:JP State or Province Name (full name) [Some-State]:Chiba Locality Name (eg, city) []: Organization Name (eg, company) [Internet Widgits Pty Ltd]:Atikoro Organizational Unit Name (eg, section) []: Common Name (eg, YOUR name) []:xxxxxx.atikoro.net Email Address []:webmaster@atikoro.net Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: $ openssl genrsa -des3 -out ca.key 1024 -rand /var/log/messages Generating RSA private key, 1024 bit long modulus ..............................++++++ ...................++++++ e is 65537 (0x10001) Enter PEM pass phrase: Verifying password - Enter PEM pass phrase: $ openssl req -new -x509 -days 1460 -key ca.key -out ca.crt Using configuration from /etc/openssl/openssl.cnf Enter PEM pass phrase: You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:JP State or Province Name (full name) [Some-State]:Chiba Locality Name (eg, city) []: Organization Name (eg, company) [Internet Widgits Pty Ltd]:Atikoro Organizational Unit Name (eg, section) []: Common Name (eg, YOUR name) []:IYODA Atsushi Email Address []:iyoda-selfca@atikoro.net $ cd /tmp $ ftp http://www.modssl.org/source/mod_ssl-2.8.19-1.3.31.tar.gz $ tar zxf mod_ssl-2.8.19-1.3.31.tar.gz $ cd /usr/pkg/etc/httpd/ssl $ /tmp/mod_ssl-2.8.19-1.3.31/pkg.contrib/sign.sh server.csr CA signing: server.csr -> server.crt: Using configuration from ca.config Enter PEM pass phrase: Check that the request matches the signature Signature ok The Subjects Distinguished Name is as follows countryName :PRINTABLE:'JP' stateOrProvinceName :PRINTABLE:'Chiba' organizationName :PRINTABLE:'Atikoro' commonName :PRINTABLE:'xxxxxx.atikoro.net' emailAddress :IA5STRING:'webmaster@atikoro.net' Certificate is to be certified until Aug 6 11:53:41 2005 GMT (365 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated CA verifying: server.crt <-> CA cert server.crt: OK $ cp server.key server.key.org $ openssl rsa -in server.key.org -out server.key $ sudo chmod 400 server.key $ /usr/pkg/etc/httpd $ chmod 700 ssl $ mkdir ssl.key $ cp -p ssl/server.key ssl.key $ mkdir ssl.crt $ cp -p ssl/server.crt ssl.crt
