[root@RedHat8SV conf.d]# vi /etc/selinux/config ← config ファイルを開いて編集します。
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing – SELinux security policy is enforced.
# permissive – SELinux prints warnings instead of enforcing.
# disabled – No SELinux policy is loaded. #SELINUX=enforcing ← デフォルトの設定をコメントアウトします。 SELINUX=disable← SELINUX=disable の設定を追加します。
# SELINUXTYPE= can take one of these two values:
# targeted – Targeted processes are protected,
# mls – Multi Level Security protection.
SELINUXTYPE=targeted
# List the protocol versions which clients are allowed to connect with.
# The OpenSSL system profile is used by default. See
# update-crypto-policies(8) for more details. #SSLProtocol all -SSLv3 #SSLProxyProtocol all -SSLv3
[root@RedHat8SV ~]# yum info openssl
メタデータの期限切れの最終確認: 0:18:38 時間前の 2019年11月10日 13時04分01秒 に実施しました。
インストール済みパッケージ
名前 : openssl
エポック : 1
バージョン : 1.1.1
リリース : 8.el8
アーキテクチ : x86_64
サイズ : 1.1 M
ソース : openssl-1.1.1-8.el8.src.rpm
Repo : @System
repo から : anaconda
概要 : Utilities from the general purpose cryptography library with TLS implementation
URL : http://www.openssl.org/
ライセンス : OpenSSL
説明 : The OpenSSL toolkit provides support for secure communications between
: machines. OpenSSL includes a certificate management tool and shared
: libraries which provide various cryptographic algorithms and
: protocols.
利用可能なパッケージ
名前 : openssl
エポック : 1
バージョン : 1.1.1c
リリース : 2.el8
アーキテクチ : x86_64
サイズ : 686 k
ソース : openssl-1.1.1c-2.el8.src.rpm
Repo : rhel-8-baseos-rhui-rpms
概要 : Utilities from the general purpose cryptography library with TLS implementation
URL : http://www.openssl.org/
ライセンス : OpenSSL
説明 : The OpenSSL toolkit provides support for secure communications between
: machines. OpenSSL includes a certificate management tool and shared
: libraries which provide various cryptographic algorithms and
: protocols.
[root@RedHat8SV ~]#
■OpenSSL のバージョン確認
[root@RedHat8SV ~]# openssl version OpenSSL 1.1.1 FIPS 11 Sep 2018
[root@RedHat8SV ~]#
* 金 9月 14 2018 Toma? Mraz <tmraz@redhat.com> 1.1.1-1
– update to the final 1.1.1 version
– for consistent support of security policies we build
RC4 support in TLS (not default) and allow SHA1 in SECLEVEL 2
– use only /dev/urandom if getrandom() is not available
– disable SM4
[root@RedHat8SV KEY]# openssl rsa -text < test-server.private_key
Enter pass phrase:
140457904592704:error:28078065:UI routines:UI_set_result_ex:result too small:crypto/ui/ui_lib.c:903:You must type in 4 to 1023 characters
Enter pass phrase:
140457904592704:error:2807106B:UI routines:UI_process:processing error:crypto/ui/ui_lib.c:543:while reading strings
Enter pass phrase:
140457904592704:error:28078065:UI routines:UI_set_result_ex:result too small:crypto/ui/ui_lib.c:903:You must type in 4 to 1023 characters
Enter pass phrase:
140457904592704:error:2807106B:UI routines:UI_process:processing error:crypto/ui/ui_lib.c:543:while reading strings
Enter pass phrase:
140457904592704:error:28078065:UI routines:UI_set_result_ex:result too small:crypto/ui/ui_lib.c:903:You must type in 4 to 1023 characters
Enter pass phrase:
unable to load Private Key
140457904592704:error:2807106B:UI routines:UI_process:processing error:crypto/ui/ui_lib.c:543:while reading strings
140457904592704:error:28078065:UI routines:UI_set_result_ex:result too small:crypto/ui/ui_lib.c:903:You must type in 4 to 1023 characters
140457904592704:error:2807106B:UI routines:UI_process:processing error:crypto/ui/ui_lib.c:543:while reading strings
140457904592704:error:28078065:UI routines:UI_set_result_ex:result too small:crypto/ui/ui_lib.c:903:You must type in 4 to 1023 characters
140457904592704:error:2807106B:UI routines:UI_process:processing error:crypto/ui/ui_lib.c:543:while reading strings
140457904592704:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:crypto/evp/evp_enc.c:575:
140457904592704:error:0906A065:PEM routines:PEM_do_header:bad decrypt:crypto/pem/pem_lib.c:461:
[root@RedHat8SV KEY]#
【補足】openssl コマンドで秘密鍵を作成する際に指定できる暗号化一覧
RSA 暗号方式の秘密鍵を作成するには「openssl genrsa」コマンドを実行します。
秘密鍵は作成する時に「暗号化」が可能です。
何を「暗号化」しているのか混乱してしまうかもしれませんが
× 通信を暗号化
○ 秘密鍵を暗号化（他人に知られたくないから）
です。
暗号化された秘密鍵を読むためには「復号化」しなければいけません。
秘密鍵を「復号化」するために「パスフレーズ」が必要になります。
ただし、毎回秘密鍵を読む際に「パスフレーズ」を入力するのが面倒な時があります。
その場合は「パスフレーズ」なしで秘密鍵を作成することもできます。
その代りセキュリティが甘くなります。
■パスフレーズなしで秘密鍵を作成するコマンド例
[root@RedHat8SV test]# openssl genrsa 2048 > server_no_pass.key
Generating RSA private key, 2048 bit long modulus
……………………………….+++
……………………………………………………………………………………………+++
e is 65537 (0x10001)
[root@RedHat8SV test]#
■パスフレーズありのコマンド例
DES、DES3、AES128、AES192、AES256が指定できます。
[root@RedHat8SV test]# openssl genrsa -des3 -out server_des3.key 2048 ← トリプル DES で暗号化しています。
Generating RSA private key, 2048 bit long modulus
…………………+++
…+++
e is 65537 (0x10001)
Enter pass phrase for server_des3.key:
Verifying – Enter pass phrase for server_des3.key:
[root@RedHat8SV test]#
[root@RedHat8SV test]# openssl genrsa -des -out server_des.key 2048 ← DES で暗号化しています。
Generating RSA private key, 2048 bit long modulus
…………………………………………………………………………………………………………………………..+++
…………………………………+++
e is 65537 (0x10001)
Enter pass phrase for server_des.key:
Verifying – Enter pass phrase for server_des.key:
[root@RedHat8SV test]#
[root@RedHat8SV KEY]# openssl req -new -key /root/KEY/server.private_key -out /root/KEY/server.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
—–
Country Name (2 letter code) [XX]:JP ← 2文字の国名コードを指定します。
State or Province Name (full name) []:TOKYO ← 都道府県名を指定します。
Locality Name (eg, city) [Default City]:NAKANO-KU ← 都市名を指定します。
Organization Name (eg, company) [Default Company Ltd]:Test Company Ltd. ← 企業名を指定します。
Organizational Unit Name (eg, section) []:IT Section 01 ← 部署名を指定します。
Common Name (eg, your name or your server’s hostname) []:RedHat8SV.xxxxx.com ← Web サーバーの FQDN を指定します。
Email Address []:
Please enter the following ‘extra’ attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@RedHat8SV KEY]#
[root@RedHat8SV CA]# openssl req -new -key /etc/ssl/CA/ca.private_key -out /etc/ssl/CA/ca.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
—–
Country Name (2 letter code) [XX]:JP ← サーバー証明書用の CSR ファイル作成時と合せます。
State or Province Name (full name) []:TOKYO ← サーバー証明書用の CSR ファイル作成時と合せます。
Locality Name (eg, city) [Default City]:NAKANO-KU ← サーバー証明書用の CSR ファイル作成時と合せます。
Organization Name (eg, company) [Default Company Ltd]:Test Company Ltd. ← サーバー証明書用の CSR ファイル作成時と合せます。
Organizational Unit Name (eg, section) []:IT Section 01 ← サーバー証明書用の CSR ファイル作成時と合せます。
Common Name (eg, your name or your server’s hostname) []:RedHat8SV.xxxxxx.com ← サーバー証明書用の CSR ファイル作成時と合せます。
Email Address []:
Please enter the following ‘extra’ attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@RedHat8SV CA]#
通常はここから更に上位の認証局に SSL 証明書を作成してもらいますが、今回はオレオレ認証局なので CA が自分自身で電子署名を行ない、CA 用のオレオレ証明書（自己署名証明書）を作成します。
[root@RedHat8SV CA]# openssl x509 -in /etc/ssl/CA/ca.csr -days 3650 -req -signkey /etc/ssl/CA/ca.private_key -out /etc/ssl/CA/ca.cert
Signature ok subject=C = JP, ST = TOKYO, L = NAKANO-KU, O = Test Company Ltd., OU = IT Section 01, CN = RedHat8SV.xxxxxx.com
Getting Private key
[root@RedHat8SV CA]#
[root@RedHat8SV ~]# vi /etc/ssl/CA/openssl.cnf
#
# OpenSSL example configuration file.
# This is mostly being used for generation of certificate requests.
#
# Note that you can include other files from the main configuration
# file using the .include directive.
#.include filename
# This definition stops the following lines choking if HOME isn’t
# defined.
HOME = .
#RANDFILE = $ENV::HOME/.rnd
# To use this configuration file with the “-extfile” option of the
# “openssl x509” utility, name here the section containing the
# X.509v3 extensions to use:
# extensions =
# (Alternatively, use a configuration file that has only
# X.509v3 extensions in its main [= default] section.)
# We can add new OIDs in here for use by ‘ca’, ‘req’ and ‘ts’.
# Add a simple OID like this:
# testoid1=1.2.3.4
# Or use config file substitution like this:
# testoid2=${testoid1}.5.6
# Policies used by the TSA examples.
tsa_policy1 = 1.2.3.4.1
tsa_policy2 = 1.2.3.4.5.6
tsa_policy3 = 1.2.3.4.5.7
####################################################################
[ ca ]
default_ca = CA_default # The default ca section
#dir = /etc/pki/CA # Where everything is kept dir = /etc/ssl/CA # Where everything is kept ← 新規の CA のデフォルトディレクトリを設定します。
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crl # Where the issued crl are kept database = $dir/index.txt # database index file.
#unique_subject = no # Set to ‘no’ to allow creation of
# several certs with same subject.
new_certs_dir = $dir/newcerts # default place for new certs.
certificate = $dir/cacert.pem # The CA certificate serial = $dir/serial # The current serial number
crlnumber = $dir/crlnumber # the current crl number
# must be commented out to leave a V1 CRL
crl = $dir/crl.pem # The current CRL
private_key = $dir/private/cakey.pem# The private key
RANDFILE = $dir/private/.rand # private random number file
x509_extensions = usr_cert # The extensions to add to the cert
# Comment out the following two lines for the “traditional”
# (and highly broken) format.
name_opt = ca_default # Subject Name options
cert_opt = ca_default # Certificate field options
# Extension copying option: use with caution.
# copy_extensions = copy
# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
# so this is commented out by default to leave a V1 CRL.
# crlnumber must also be commented out to leave a V1 CRL.
# crl_extensions = crl_ext
default_days = 365 # how long to certify for
default_crl_days= 30 # how long before next CRL
default_md = sha256 # use SHA-256 by default
preserve = no # keep passed DN ordering
# A few difference way of specifying how similar the request should look
# For type CA, the listed attributes must be the same, and the optional
# and supplied fields are just that 🙂
policy = policy_match
# For the CA policy
[ policy_match ]
countryName = match
stateOrProvinceName = match
organizationName = match
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
# For the ‘anything’ policy
# At this point in time, you must list all acceptable ‘object’
# types.
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
####################################################################
[ req ]
default_bits = 2048
default_md = sha256
default_keyfile = privkey.pem
distinguished_name = req_distinguished_name
attributes = req_attributes
x509_extensions = v3_ca # The extensions to add to the self signed cert
# Passwords for private keys if not present they will be prompted for
# input_password = secret
# output_password = secret
# This sets a mask for permitted string types. There are several options.
# default: PrintableString, T61String, BMPString.
# pkix : PrintableString, BMPString (PKIX recommendation before 2004)
# utf8only: only UTF8Strings (PKIX recommendation after 2004).
# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
# MASK:XXXX a literal mask value.
# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
string_mask = utf8only
# req_extensions = v3_req # The extensions to add to a certificate request
[ req_distinguished_name ]
countryName = Country Name (2 letter code)
countryName_default = XX
countryName_min = 2
countryName_max = 2
stateOrProvinceName = State or Province Name (full name)
#stateOrProvinceName_default = Default Province
localityName = Locality Name (eg, city)
localityName_default = Default City
0.organizationName = Organization Name (eg, company)
0.organizationName_default = Default Company Ltd
# we can do this but it is not needed normally 🙂
#1.organizationName = Second Organization Name (eg, company)
#1.organizationName_default = World Wide Web Pty Ltd
organizationalUnitName = Organizational Unit Name (eg, section)
#organizationalUnitName_default =
commonName = Common Name (eg, your name or your server\’s hostname)
commonName_max = 64
# These extensions are added when ‘ca’ signs a request.
# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.
basicConstraints=CA:FALSE
# Here are some examples of the usage of nsCertType. If it is omitted
# the certificate can be used for anything *except* object signing.
# This is OK for an SSL server.
# nsCertType = server
# For an object signing certificate this would be used.
# nsCertType = objsign
# For normal client use this is typical
# nsCertType = client, email
# and for everything including object signing:
# nsCertType = client, email, objsign
# This is typical in keyUsage for a client certificate.
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
# This will be displayed in Netscape’s comment listbox.
nsComment = “OpenSSL Generated Certificate”
# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer
# This stuff is for subjectAltName and issuerAltname.
# Import the email address.
# subjectAltName=email:copy
# An alternative to produce certificates that aren’t
# deprecated according to PKIX.
# subjectAltName=email:move
# Key usage: this is typical for a CA certificate. However since it will
# prevent it being used as an test self-signed certificate it is best
# left out by default.
# keyUsage = cRLSign, keyCertSign
# Some might want this also
# nsCertType = sslCA, emailCA
# Include email address in subject alt name: another PKIX recommendation
# subjectAltName=email:copy
# Copy issuer details
# issuerAltName=issuer:copy
# DER hex encoding of an extension: beware experts only!
# obj=DER:02:03
# Where ‘obj’ is a standard or added object
# You can even override a supported extension:
# basicConstraints= critical, DER:30:03:01:01:FF
[ crl_ext ]
# CRL extensions.
# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
[ proxy_cert_ext ]
# These extensions should be added when creating a proxy certificate
# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.
basicConstraints=CA:FALSE
# Here are some examples of the usage of nsCertType. If it is omitted
# the certificate can be used for anything *except* object signing.
# This is OK for an SSL server.
# nsCertType = server
# For an object signing certificate this would be used.
# nsCertType = objsign
# For normal client use this is typical
# nsCertType = client, email
# and for everything including object signing:
# nsCertType = client, email, objsign
# This is typical in keyUsage for a client certificate.
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
# This will be displayed in Netscape’s comment listbox.
nsComment = “OpenSSL Generated Certificate”
# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer
# This stuff is for subjectAltName and issuerAltname.
# Import the email address.
# subjectAltName=email:copy
# An alternative to produce certificates that aren’t
# deprecated according to PKIX.
# subjectAltName=email:move
default_tsa = tsa_config1 # the default TSA section
[ tsa_config1 ]
# These are used by the TSA reply generation only.
dir = /etc/pki/CA # TSA root directory
serial = $dir/tsaserial # The current serial number (mandatory)
crypto_device = builtin # OpenSSL engine to use for signing
signer_cert = $dir/tsacert.pem # The TSA signing certificate
# (optional)
certs = $dir/cacert.pem # Certificate chain to include in reply
# (optional)
signer_key = $dir/private/tsakey.pem # The TSA private key (optional)
signer_digest = sha256 # Signing digest to use. (Optional)
default_policy = tsa_policy1 # Policy if request did not specify it
# (optional)
other_policies = tsa_policy2, tsa_policy3 # acceptable policies (optional)
digests = sha1, sha256, sha384, sha512 # Acceptable message digests (mandatory)
accuracy = secs:1, millisecs:500, microsecs:100 # (optional)
clock_precision_digits = 0 # number of digits after dot. (optional)
ordering = yes # Is ordering defined for timestamps?
# (optional, default: no)
tsa_name = yes # Must the TSA name be included in the reply?
# (optional, default: no)
ess_cert_id_chain = no # Must the ESS cert id chain be included?
# (optional, default: no)
ess_cert_id_alg = sha1 # algorithm to compute certificate
# identifier (optional, default: sha1)
[root@RedHat8SV ~]#
[root@RedHat8SV CA]# openssl ca -config /etc/ssl/CA/openssl.cnf -in /root/KEY/server.csr -keyfile /etc/ssl/CA/ca.private_key -cert /etc/ssl/CA/ca.cert -out /root/KEY/server.cert -extfile /etc/ssl/CA/san.ext
Using configuration from /etc/ssl/CA/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 0 (0x0)
Validity
Not Before: Nov 2 11:46:42 2019 GMT
Not After : Nov 1 11:46:42 2020 GMT
Subject:
countryName = JP
stateOrProvinceName = TOKYO
organizationName = Test Company Ltd.
organizationalUnitName = IT Section 01
commonName = RedHat8SV.xxxxxx.com
X509v3 extensions: X509v3 Subject Alternative Name: DNS:RedHat8SV.xxxxxx.com ← Subject Alternative Name が登録されます。
Certificate is to be certified until Nov 1 11:46:42 2020 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
[root@RedHat8SV CA]#
■openssl ca コマンドの man コマンドの結果
CA(1) OpenSSL CA(1)
NAME
openssl-ca, ca – sample minimal CA application
DESCRIPTION
The ca command is a minimal CA application. It can be used to sign certificate requests in a variety of forms and generate CRLs it also maintains a text database of issued certificates and their status. caコマンドは最小限のCAアプリケーションです。 さまざまな形式で証明書要求に署名し、発行された証明書とそのステータスのテキストデータベースを保持するCRLを生成するために使用できます。
The options descriptions will be divided into each purpose.
[root@RedHat8SV ~]# systemctl status httpd.service ● httpd.service – The Apache HTTP Server
Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; vendor preset: disabled)
Active: active (running) since Sat 2019-11-02 22:53:17 JST; 4s ago
Docs: man:httpd.service(8)
Main PID: 3289 (httpd)
Status: “Started, listening on: port 443, port 80”
Tasks: 213 (limit: 4933)
Memory: 25.8M
CGroup: /system.slice/httpd.service
tq3289 /usr/sbin/httpd -DFOREGROUND
tq3291 /usr/sbin/httpd -DFOREGROUND
tq3292 /usr/sbin/httpd -DFOREGROUND
tq3293 /usr/sbin/httpd -DFOREGROUND
mq3294 /usr/sbin/httpd -DFOREGROUND
11月 02 22:53:16 RedHat8SV systemd[1]: Starting The Apache HTTP Server…
11月 02 22:53:17 RedHat8SV httpd[3289]: AH00558: httpd: Could not reliably determine the server’s fully qualified domain name,>
11月 02 22:53:17 RedHat8SV httpd[3289]: Server configured, listening on: port 443, port 80
11月 02 22:53:17 RedHat8SV systemd[1]: Started The Apache HTTP Server.
[root@RedHat8SV ~]#
/etc/httpd/conf/httpd.conf ファイルの編集
「/etc/httpd/conf/httpd.conf」ファイルを設定します。
特に以下の項目を設定します。
Listen
ServerName
DocumentRoot
[root@RedHat8SV ~]# vi /etc/httpd/conf/httpd.conf
# Change this to Listen on specific IP addresses as shown below to
# prevent Apache from glomming onto all bound IP addresses (0.0.0.0)
#
#Listen 12.34.56.78:80 Listen 80← デフォルトの80番で問題ありません。
# If your host doesn’t have a registered DNS name, enter its IP address here.
# You will have to access it by its address anyway, and this will make
# redirections work in a sensible way.
#
#ServerName www.example.com:80 ServerName redhat8sv.xxxxxx.com:80← サーバーの FQDN と合わせます。
# DocumentRoot: The directory out of which you will serve your
# documents. By default, all requests are taken from this directory, but
# symbolic links and aliases may be used to point to other locations.
#
DocumentRoot “/var/www/html” ← デフォルトの /var/www/html で問題ありません。
# Server Certificate:
# Point SSLCertificateFile at a PEM encoded certificate. If
# the certificate is encrypted, then you will be prompted for a
# pass phrase. Note that a kill -HUP will prompt again. A new
# certificate can be generated using the genkey(1) command. SSLCertificateFile /etc/pki/tls/certs/localhost.crt
# Server Private Key:
# If the key is not combined with the certificate, use this
# directive to point at the key file. Keep in mind that if
# you’ve both a RSA and a DSA private key you can configure
# both in parallel (to also allow the use of DSA ciphers, etc.) SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
# Server Certificate Chain:
# Point SSLCertificateChainFile at a file containing the
# concatenation of PEM encoded CA certificates which form the
# certificate chain for the server certificate. Alternatively
# the referenced file can be the same as SSLCertificateFile
# when the CA certificates are directly appended to the server
# certificate for convenience. #SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt
～省略～
[root@RedHat8SV conf.d]#
変更する箇所は以下の設定の部分のみです。
SSLCertificateFile ← サーバー証明書（SSL 証明書）
SSLCertificateKeyFile ← サーバー証明書（SSL 証明書）の秘密鍵
SSLCertificateChainFile ← 中間認証局の証明書
変更する前に、最初にバックアップを取ります。
[root@RedHat8SV conf.d]# cp -ip ssl.conf ~/backup/ssl.conf_20170715
[root@RedHat8SV conf.d]# vi ssl.conf
# Server Certificate:
# Point SSLCertificateFile at a PEM encoded certificate. If
# the certificate is encrypted, then you will be prompted for a
# pass phrase. Note that a kill -HUP will prompt again. A new
# certificate can be generated using the genkey(1) command. #SSLCertificateFile /etc/pki/tls/certs/localhost.crt ← デフォルトの行をコメントアウトします。 SSLCertificateFile /etc/httpd/conf/server.csr ← 上のデフォルトの行をコピーして CSR ファイルを指定します。
# Server Private Key:
# If the key is not combined with the certificate, use this
# directive to point at the key file. Keep in mind that if
# you’ve both a RSA and a DSA private key you can configure
# both in parallel (to also allow the use of DSA ciphers, etc.) #SSLCertificateKeyFile /etc/pki/tls/private/localhost.key ← デフォルトの行をコメントアウトします。 SSLCertificateKeyFile /etc/httpd/conf/server.key ← 上のデフォルトの行をコピーして秘密鍵ファイルを指定します。
# Server Certificate Chain:
# Point SSLCertificateChainFile at a file containing the
# concatenation of PEM encoded CA certificates which form the
# certificate chain for the server certificate. Alternatively
# the referenced file can be the same as SSLCertificateFile
# when the CA certificates are directly appended to the server
# certificate for convenience. #SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt
SSLCertificateChainFile /etc/ssl/CA/ca.cert
「ssl.conf」の編集が完了したらコンフィグファイルの構文チェックをします。
■構文の確認
[root@RedHat8SV CA]# httpd -t Syntax OK ← 構文的に問題がなければ「Syntax OK」が表示されます。
Google Chrome バージョン 78 の場合は Subject Alternative Name が必要
2019年11月現在の最新バージョン：Google Chrome バージョン 78
Subject Alternative Name がないと下図のようなエラーになります。
■san.ext ファイルを作成
[root@RedHat8SV CA]# vi /etc/ssl/CA/san.ext subjectAltName=DNS:RedHat8SV.xxxxxx.com
[root@RedHat8SV CA]#
■認証局用（CA 用）の openssl.cnf（最終）
[root@RedHat8SV CA]# cat /etc/ssl/CA/openssl.cnf
#
# OpenSSL example configuration file.
# This is mostly being used for generation of certificate requests.
#
# Note that you can include other files from the main configuration
# file using the .include directive.
#.include filename
# This definition stops the following lines choking if HOME isn’t
# defined.
HOME = .
#RANDFILE = $ENV::HOME/.rnd
# To use this configuration file with the “-extfile” option of the
# “openssl x509” utility, name here the section containing the
# X.509v3 extensions to use:
# extensions =
# (Alternatively, use a configuration file that has only
# X.509v3 extensions in its main [= default] section.)
# We can add new OIDs in here for use by ‘ca’, ‘req’ and ‘ts’.
# Add a simple OID like this:
# testoid1=1.2.3.4
# Or use config file substitution like this:
# testoid2=${testoid1}.5.6
# Policies used by the TSA examples.
tsa_policy1 = 1.2.3.4.1
tsa_policy2 = 1.2.3.4.5.6
tsa_policy3 = 1.2.3.4.5.7
####################################################################
[ ca ]
default_ca = CA_default # The default ca section
#dir = /etc/pki/CA # Where everything is kept dir = /etc/ssl/CA # Where everything is kept
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crl # Where the issued crl are kept
database = $dir/index.txt # database index file.
#unique_subject = no # Set to ‘no’ to allow creation of
# several certs with same subject.
new_certs_dir = $dir/newcerts # default place for new certs.
certificate = $dir/cacert.pem # The CA certificate
serial = $dir/serial # The current serial number
crlnumber = $dir/crlnumber # the current crl number
# must be commented out to leave a V1 CRL
crl = $dir/crl.pem # The current CRL
private_key = $dir/private/cakey.pem# The private key
RANDFILE = $dir/private/.rand # private random number file
x509_extensions = usr_cert # The extensions to add to the cert
# Comment out the following two lines for the “traditional”
# (and highly broken) format.
name_opt = ca_default # Subject Name options
cert_opt = ca_default # Certificate field options
# Extension copying option: use with caution.
# copy_extensions = copy
# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
# so this is commented out by default to leave a V1 CRL.
# crlnumber must also be commented out to leave a V1 CRL.
# crl_extensions = crl_ext
default_days = 365 # how long to certify for
default_crl_days= 30 # how long before next CRL
default_md = sha256 # use SHA-256 by default
preserve = no # keep passed DN ordering
# A few difference way of specifying how similar the request should look
# For type CA, the listed attributes must be the same, and the optional
# and supplied fields are just that 🙂
policy = policy_match
# For the CA policy
[ policy_match ]
countryName = match
stateOrProvinceName = match
organizationName = match
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
# For the ‘anything’ policy
# At this point in time, you must list all acceptable ‘object’
# types.
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
####################################################################
[ req ]
default_bit = 2048
default_md = sha256
default_keyfile = privkey.pem
distinguished_name = req_distinguished_name
attributes = req_attributes x509_extensions = v3_ca # The extensions to add to the self signed cert
# Passwords for private keys if not present they will be prompted for
# input_password = secret
# output_password = secret
# This sets a mask for permitted string types. There are several options.
# default: PrintableString, T61String, BMPString.
# pkix : PrintableString, BMPString (PKIX recommendation before 2004)
# utf8only: only UTF8Strings (PKIX recommendation after 2004).
# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
# MASK:XXXX a literal mask value.
# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.
string_mask = utf8only
# req_extensions = v3_req # The extensions to add to a certificate request
[ req_distinguished_name ]
countryName = Country Name (2 letter code)
countryName_default = XX
countryName_min = 2
countryName_max = 2
stateOrProvinceName = State or Province Name (full name)
#stateOrProvinceName_default = Default Province
localityName = Locality Name (eg, city)
localityName_default = Default City
0.organizationName = Organization Name (eg, company)
0.organizationName_default = Default Company Ltd
# we can do this but it is not needed normally 🙂
#1.organizationName = Second Organization Name (eg, company)
#1.organizationName_default = World Wide Web Pty Ltd
organizationalUnitName = Organizational Unit Name (eg, section)
#organizationalUnitName_default =
commonName = Common Name (eg, your name or your server\’s hostname)
commonName_max = 64
# These extensions are added when ‘ca’ signs a request.
# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.
basicConstraints=CA:FALSE
# Here are some examples of the usage of nsCertType. If it is omitted
# the certificate can be used for anything *except* object signing.
# This is OK for an SSL server.
# nsCertType = server
# For an object signing certificate this would be used.
# nsCertType = objsign
# For normal client use this is typical
# nsCertType = client, email
# and for everything including object signing:
# nsCertType = client, email, objsign
# This is typical in keyUsage for a client certificate.
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
# This will be displayed in Netscape’s comment listbox.
nsComment = “OpenSSL Generated Certificate”
# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer
# This stuff is for subjectAltName and issuerAltname.
# Import the email address.
# subjectAltName=email:copy
# An alternative to produce certificates that aren’t
# deprecated according to PKIX.
# subjectAltName=email:move
# Key usage: this is typical for a CA certificate. However since it will
# prevent it being used as an test self-signed certificate it is best
# left out by default.
# keyUsage = cRLSign, keyCertSign
# Some might want this also
# nsCertType = sslCA, emailCA
# Include email address in subject alt name: another PKIX recommendation
# subjectAltName=email:copy
# Copy issuer details
# issuerAltName=issuer:copy
# DER hex encoding of an extension: beware experts only!
# obj=DER:02:03
# Where ‘obj’ is a standard or added object
# You can even override a supported extension:
# basicConstraints= critical, DER:30:03:01:01:FF
[ crl_ext ]
# CRL extensions.
# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
[ proxy_cert_ext ]
# These extensions should be added when creating a proxy certificate
# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.
basicConstraints=CA:FALSE
# Here are some examples of the usage of nsCertType. If it is omitted
# the certificate can be used for anything *except* object signing.
# This is OK for an SSL server.
# nsCertType = server
# For an object signing certificate this would be used.
# nsCertType = objsign
# For normal client use this is typical
# nsCertType = client, email
# and for everything including object signing:
# nsCertType = client, email, objsign
# This is typical in keyUsage for a client certificate.
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
# This will be displayed in Netscape’s comment listbox.
nsComment = “OpenSSL Generated Certificate”
# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer
# This stuff is for subjectAltName and issuerAltname.
# Import the email address.
# subjectAltName=email:copy
# An alternative to produce certificates that aren’t
# deprecated according to PKIX.
# subjectAltName=email:move
default_tsa = tsa_config1 # the default TSA section
[ tsa_config1 ]
# These are used by the TSA reply generation only.
dir = /etc/pki/CA # TSA root directory
serial = $dir/tsaserial # The current serial number (mandatory)
crypto_device = builtin # OpenSSL engine to use for signing
signer_cert = $dir/tsacert.pem # The TSA signing certificate
# (optional)
certs = $dir/cacert.pem # Certificate chain to include in reply
# (optional)
signer_key = $dir/private/tsakey.pem # The TSA private key (optional)
signer_digest = sha256 # Signing digest to use. (Optional)
default_policy = tsa_policy1 # Policy if request did not specify it
# (optional)
other_policies = tsa_policy2, tsa_policy3 # acceptable policies (optional)
digests = sha1, sha256, sha384, sha512 # Acceptable message digests (mandatory)
accuracy = secs:1, millisecs:500, microsecs:100 # (optional)
clock_precision_digits = 0 # number of digits after dot. (optional)
ordering = yes # Is ordering defined for timestamps?
# (optional, default: no)
tsa_name = yes # Must the TSA name be included in the reply?
# (optional, default: no)
ess_cert_id_chain = no # Must the ESS cert id chain be included?
# (optional, default: no)
ess_cert_id_alg = sha1 # algorithm to compute certificate
# identifier (optional, default: sha1)
[root@RedHat8SV CA]#
[root@RedHat8SV conf.d]# httpd -t httpd: Could not reliably determine the server’s fully qualified domain name, using 127.0.0.1 for ServerName
Syntax OK
[root@RedHat8SV conf.d]#
[root@RedHat8SV sysconfig]# httpd -t httpd: Could not reliably determine the server’s fully qualified domain name, using RedHat8SV.localdomain for ServerName
Syntax OK
[root@RedHat8SV sysconfig]#
再度「httpd: Could not reliably determine the server’s fully qualified domain name, using RedHat8SV.localdomain for ServerName」のメッセージが表示されましたが、この原因は「/etc/hosts」だけでなく「/etc/httpd/conf/httpd.conf」にも「ServerName」の設定がされていないからでした。
「/etc/httpd/conf/httpd.conf」も設定をします。
[root@RedHat8SV conf]# cp -ip httpd.conf ~/backup/httpd.conf_20170716
[root@RedHat8SV conf]# vi httpd.conf
# ServerName gives the name and port that the server uses to identify itself.
# This can often be determined automatically, but we recommend you specify
# it explicitly to prevent problems during startup.
#
# If this is not set to valid DNS name for your host, server-generated
# redirections will not work. See also the UseCanonicalName directive.
#
# If your host doesn’t have a registered DNS name, enter its IP address here.
# You will have to access it by its address anyway, and this will make
# redirections work in a sensible way.
# #ServerName www.example.com:80← デフォルトの設定はコメントアウトにしておきます。 ServerName RedHat8SV.localdomain:80 ← その下の行に ServerName の設定を追加します。
再度、構文チェックをします。
[root@RedHat8SV conf]# httpd -t Syntax OK
今度は問題なさそうです。
Init: Unable to read server certificate from file ～ の場合
httpd の再起動に失敗した際のエラーです。
[root@RedHat8SV conf]# service httpd restart
httpd を停止中: [ OK ]
httpd を起動中: [失敗]
[root@RedHat8SV ~]# openssl s_client -host RedHat8SV.xxxxx.com -port 443 -tls1_2
CONNECTED(00000004) depth=1 C = JP, ST = TOKYO, L = NAKANO-KU, O = Test Company Ltd., OU = IT Section 01, CN = RedHat8SV.xxxxx.com
verify error:num=19:self signed certificate in certificate chain
—
Certificate chain 0 s:C = JP, ST = TOKYO, O = Test Company Ltd., OU = IT Section 01, CN = RedHat8SV.xxxxx.com i:C = JP, ST = TOKYO, L = NAKANO-KU, O = Test Company Ltd., OU = IT Section 01, CN = RedHat8SV.xxxxx.com 1 s:C = JP, ST = TOKYO, L = NAKANO-KU, O = Test Company Ltd., OU = IT Section 01, CN = RedHat8SV.xxxxx.com i:C = JP, ST = TOKYO, L = NAKANO-KU, O = Test Company Ltd., OU = IT Section 01, CN = RedHat8SV.xxxxx.com
—
Server certificate
—–BEGIN CERTIFICATE—–
MIIDkzCCAnugAwIBAgIBAjANBgkqhkiG9w0BAQsFADCBhDELMAkGA1UEBhMCSlAx
DjAMBgNVBAgMBVRPS1lPMRIwEAYDVQQHDAlOQUtBTk8tS1UxGjAYBgNVBAoMEVRl
c3QgQ29tcGFueSBMdGQuMRYwFAYDVQQLDA1JVCBTZWN0aW9uIDAxMR0wGwYDVQQD
DBRSZWRIYXQ4U1YuYm94LWNtLmNvbTAeFw0xOTExMDQxMjA0MDBaFw0yMDExMDMx
MjA0MDBaMHAxCzAJBgNVBAYTAkpQMQ4wDAYDVQQIDAVUT0tZTzEaMBgGA1UECgwR
VGVzdCBDb21wYW55IEx0ZC4xFjAUBgNVBAsMDUlUIFNlY3Rpb24gMDExHTAbBgNV
BAMMFFJlZEhhdDhTVi5ib3gtY20uY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
MIIBCgKCAQEApHNpGZj8Ez/HLPsdyEB9F/J1IuL4j5v9/8Zb6Ygcq8c9/0kOnmfH
DuBojLGeVg8H2+hQ1JQh1Wx4Ry+rwzIIg/0tu4ZdKsu2XauH5UweCAmGgyLpB4vv
P6tKw3oaK1nX7kCVMQkLT2O/qgsfCzJV8OkCuJVcs88+O++KsJ5BYl8emEccEUzf
P7883A2R9nRAN7ZL2a3vj5CT4zGupRmDnteUUjfEaqvcbaPCsUH2PG4iwo4Vz7sZ
orSBz48/ic9hZQT1ecyQq69aX47uFBeZP62dCekohTwWr9fXB6QcKgd5nnlG3mB4
l/tlOgNWA15auSn2sv1jvROXTl5wSiMsuQIDAQABoyMwITAfBgNVHREEGDAWghRS
ZWRIYXQ4U1YuYm94LWNtLmNvbTANBgkqhkiG9w0BAQsFAAOCAQEAjXlkoVuhPTyz
dbYu8MMPvQDyzfyHRkXBmYdFi1n/7jbkwrVb83FU1VKoc1gtFJ1LG/U+Irflw/pM
/xKNmjLKNR405MjmnSjcGyICjGvvzmUEOjbqckLwR98CvMYITC2UubZW5w/Jj6hU
5fYMcF9S/SmsQmohKq9n7JCtrTT4POjKDQzzCzSS65orwaxxsupf8K7DbXHcrRbK
4YGgkEVu4yjJb8xRu3DEQ7GOkPBq32mv8YkdWzd6UzNoOqRKfUeyOGEjxhW6XoMq
j5RbBjL0H4HjMl90pueJWoaO1fWUjhvBbACgWPuSp4FZyR7awq3NrAjWoHTmE4jO
y6vsQ6qLIA==
—–END CERTIFICATE—– subject=C = JP, ST = TOKYO, O = Test Company Ltd., OU = IT Section 01, CN = RedHat8SV.xxxxx.com
issuer=C = JP, ST = TOKYO, L = NAKANO-KU, O = Test Company Ltd., OU = IT Section 01, CN = RedHat8SV.xxxxx.com
—
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
—
SSL handshake has read 2532 bytes and written 324 bytes
Verification error: self signed certificate in certificate chain
—
New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session: Protocol : TLSv1.2 ← TLSv1.2 で通信していることが確認できます。
Cipher : ECDHE-RSA-AES256-GCM-SHA384
Session-ID: 8B565ABBC555D9AF2F001214CDA02208587D561ECB87B2010B2BF1E5D35E57E5
Session-ID-ctx:
Master-Key: C2BD970E2AA3FC36A2353C1C19128F422D0DA9C1C0D792AECCC4FF27103C51340966C5D5AEA5F225E23757D2F7062241
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 300 (seconds)
TLS session ticket:
0000 – 55 fb 60 50 2f b9 b7 33-a1 0c 12 40 30 e7 f4 8e U.`P/..3…@0…
0010 – a3 3f 1f 22 34 9f d2 8b-18 3d 25 26 88 14 90 a3 .?.”4….=%&….
0020 – 80 be 6b 19 c1 84 d5 78-f3 db 9f 32 77 ad 66 ec ..k….x…2w.f.
0030 – 58 0d 9f 43 a4 d7 db 3c-d3 12 89 69 9f 8d f7 e4 X..C…<…i….
0040 – 2d a0 a4 d1 67 8d 1e 5c-8f 0c 9b b7 b2 8e 20 b4 -…g..\…… .
0050 – 64 b5 f4 bb 2a cf 91 93-85 5d 54 e9 bd d5 0d 3d d…*….]T….=
0060 – be f8 4b 70 65 5f b2 c2-39 45 5e 05 b2 c2 6e 74 ..Kpe_..9E^…nt
0070 – 5e b3 21 5c 8c 25 32 ed-79 35 05 2d e1 6b c3 a1 ^.!\.%2.y5.-.k..
0080 – 58 51 67 14 eb 81 00 0f-0f 9e 70 e7 21 09 b5 a2 XQg…….p.!…
0090 – 10 34 aa 51 cc 35 a0 53-8d 1e fc c5 4c b2 04 cc .4.Q.5.S….L…
00a0 – 86 d2 03 e9 aa c9 47 c9-ce 0d de c8 4e fc 59 49 ……G…..N.YI
00b0 – 00 21 b7 ca f7 7a bf 60-39 b6 d7 63 4f 8b ec e4 .!…z.`9..cO…
00c0 – 47 eb 62 40 46 d7 e0 2c-35 87 a5 5c 11 d4 51 76 G.b@F..,5..\..Qv
00d0 – 47 41 da 6b 90 9e f9 1a-2f 22 36 86 df f4 a3 d2 GA.k…./”6…..
HTTP/1.1 400 Bad Request
Date: Sun, 10 Nov 2019 13:38:29 GMT Server: Apache/2.4.37 (Red Hat Enterprise Linux) OpenSSL/1.1.1
Content-Length: 226
Connection: close
Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC “-//IETF//DTD HTML 2.0//EN”>
<html><head>
<title>400 Bad Request</title>
</head><body>
<h1>Bad Request</h1>
<p>Your browser sent a request that this server could not understand.<br />
</p>
</body></html>
closed
[root@RedHat8SV ~]#
tcpdump で動作確認
tcpdumpでも「TLS 1.2」で通信していることを確認します。
[root@RedHat8SV ~]# tcpdump -nn port 443
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
23:03:26.933494 IP 172.31.32.20.42456 > <グローバルIP>.443: Flags [S], seq 4044175662, win 26883, options [mss 8961,sackOK,TS val 3123738470 ecr 0,nop,wscale 7], length 0
23:03:26.933729 IP <グローバルIP>.42456 > 172.31.32.20.443: Flags [S], seq 4044175662, win 26883, options [mss 1460,sackOK,TS val 3123738470 ecr 0,nop,wscale 7], length 0
23:03:26.933740 IP 172.31.32.20.443 > <グローバルIP>.42456: Flags [S.], seq 934194410, ack 4044175663, win 26847, options [mss 8961,sackOK,TS val 3123738470 ecr 3123738470,nop,wscale 7], length 0
23:03:26.933920 IP <グローバルIP>.443 > 172.31.32.20.42456: Flags [S.], seq 934194410, ack 4044175663, win 26847, options [mss 1460,sackOK,TS val 3123738470 ecr 3123738470,nop,wscale 7], length 0
23:03:26.933931 IP 172.31.32.20.42456 > <グローバルIP>.443: Flags [.], ack 1, win 211, options [nop,nop,TS val 3123738471 ecr 3123738470], length 0
23:03:26.934087 IP <グローバルIP>.42456 > 172.31.32.20.443: Flags [.], ack 1, win 211, options [nop,nop,TS val 3123738471 ecr 3123738470], length 0
23:03:26.934125 IP 172.31.32.20.42456 > <グローバルIP>.443: Flags [P.], seq 1:232, ack 1, win 211, options [nop,nop,TS val 3123738471 ecr 3123738470], length 231
23:03:26.934309 IP <グローバルIP>.42456 > 172.31.32.20.443: Flags [P.], seq 1:232, ack 1, win 211, options [nop,nop,TS val 3123738471 ecr 3123738470], length 231
23:03:26.934324 IP 172.31.32.20.443 > <グローバルIP>.42456: Flags [.], ack 232, win 219, options [nop,nop,TS val 3123738471 ecr 3123738471], length 0
23:03:26.934472 IP <グローバルIP>.443 > 172.31.32.20.42456: Flags [.], ack 232, win 219, options [nop,nop,TS val 3123738471 ecr 3123738471], length 0
23:03:26.935477 IP 172.31.32.20.443 > <グローバルIP>.42456: Flags [P.], seq 1:2243, ack 232, win 219, options [nop,nop,TS val 3123738472 ecr 3123738471], length 2242
23:03:26.935697 IP <グローバルIP>.443 > 172.31.32.20.42456: Flags [.], seq 1:1449, ack 232, win 219, options [nop,nop,TS val 3123738472 ecr 3123738471], length 1448
23:03:26.935704 IP 172.31.32.20.42456 > <グローバルIP>.443: Flags [.], ack 1449, win 233, options [nop,nop,TS val 3123738472 ecr 3123738472], length 0
23:03:26.935722 IP <グローバルIP>.443 > 172.31.32.20.42456: Flags [P.], seq 1449:2243, ack 232, win 219, options [nop,nop,TS val 3123738472 ecr 3123738471], length 794
23:03:26.935724 IP 172.31.32.20.42456 > <グローバルIP>.443: Flags [.], ack 2243, win 256, options [nop,nop,TS val 3123738472 ecr 3123738472], length 0
23:03:26.935862 IP <グローバルIP>.42456 > 172.31.32.20.443: Flags [.], ack 1449, win 233, options [nop,nop,TS val 3123738472 ecr 3123738472], length 0
23:03:26.935885 IP <グローバルIP>.42456 > 172.31.32.20.443: Flags [.], ack 2243, win 256, options [nop,nop,TS val 3123738472 ecr 3123738472], length 0
23:03:26.936453 IP 172.31.32.20.42456 > <グローバルIP>.443: Flags [P.], seq 232:325, ack 2243, win 256, options [nop,nop,TS val 3123738473 ecr 3123738472], length 93
23:03:26.936621 IP <グローバルIP>.42456 > 172.31.32.20.443: Flags [P.], seq 232:325, ack 2243, win 256, options [nop,nop,TS val 3123738473 ecr 3123738472], length 93
23:03:26.936868 IP 172.31.32.20.443 > <グローバルIP>.42456: Flags [P.], seq 2243:2533, ack 325, win 219, options [nop,nop,TS val 3123738473 ecr 3123738473], length 290
23:03:26.937059 IP <グローバルIP>.443 > 172.31.32.20.42456: Flags [P.], seq 2243:2533, ack 325, win 219, options [nop,nop,TS val 3123738473 ecr 3123738473], length 290
23:03:26.977652 IP 172.31.32.20.42456 > <グローバルIP>.443: Flags [.], ack 2533, win 278, options [nop,nop,TS val 3123738514 ecr 3123738473], length 0
23:03:26.977857 IP <グローバルIP>.42456 > 172.31.32.20.443: Flags [.], ack 2533, win 278, options [nop,nop,TS val 3123738514 ecr 3123738473], length 0
23:03:29.969553 IP 172.31.32.20.42456 > <グローバルIP>.443: Flags [F.], seq 325, ack 2533, win 278, options [nop,nop,TS val 3123741506 ecr 3123738473], length 0
23:03:29.969717 IP <グローバルIP>.42456 > 172.31.32.20.443: Flags [F.], seq 325, ack 2533, win 278, options [nop,nop,TS val 3123741506 ecr 3123738473], length 0
23:03:29.970051 IP 172.31.32.20.443 > <グローバルIP>.42456: Flags [P.], seq 2533:2564, ack 326, win 219, options [nop,nop,TS val 3123741507 ecr 3123741506], length 31
23:03:29.970084 IP 172.31.32.20.443 > <グローバルIP>.42456: Flags [F.], seq 2564, ack 326, win 219, options [nop,nop,TS val 3123741507 ecr 3123741506], length 0
23:03:29.970222 IP <グローバルIP>.443 > 172.31.32.20.42456: Flags [P.], seq 2533:2564, ack 326, win 219, options [nop,nop,TS val 3123741507 ecr 3123741506], length 31
23:03:29.970238 IP 172.31.32.20.42456 > <グローバルIP>.443: Flags [R], seq 4044175988, win 0, length 0
23:03:29.970258 IP <グローバルIP>.443 > 172.31.32.20.42456: Flags [F.], seq 2564, ack 326, win 219, options [nop,nop,TS val 3123741507 ecr 3123741506], length 0
23:03:29.970264 IP 172.31.32.20.42456 > <グローバルIP>.443: Flags [R], seq 4044175988, win 0, length 0
23:03:29.970406 IP <グローバルIP>.42456 > 172.31.32.20.443: Flags [R], seq 4044175988, win 0, length 0
23:03:29.970428 IP <グローバルIP>.42456 > 172.31.32.20.443: Flags [R], seq 4044175988, win 0, length 0
「自己署名証明書（オレオレ証明書）」を作成して HTTPS でアクセスできるように構築する手順” width=”1002″ height=”760″ class=”alignnone size-full wp-image-13457″ />
「自己
コメント