Àý´ë·Î ·çÆ® ÀÎÁõ ±â°ü ÀÎÁõ¼¸¦ Apache¿¡¼ »ç¿ëÇÏ¸é ¾ÈµÈ´Ù. ¿Ö³ÄÇϸé ApacheÀÇ Private Key´Â ¾ÏÈ£¹®(Passphrase)À» Á¦°ÅÇØ¾ß¸¸ »ç¿ëÇÒ ¼ö Àֱ⠶§¹®ÀÌ´Ù.
¿ì¼± ÀÎÁõ ¿ä±¸¼¸¦ ¹ßÇàÇØ¾ß ÇÑ´Ù. ÀÌ ¶§ ¹Ýµå½Ã Common Name(CN)À» www.mysite.com°ú °°Àº À¥ µµ¸ÞÀÎÀ¸·Î ÇØ¾ß ÇÑ´Ù.
´ÙÀ½¿¡ Apache°¡ Á¤»óÀûÀ¸·Î ÀÛµ¿Çϱâ À§Çؼ ¾ÏÈ£¹®À» Á¦°ÅÇØ¾ß ÇÑ´Ù. ¾Æ·¡´Â Private Key¸¦ Æ÷ÇÔÇϰí ÀÖ´Â newreq.pemÆÄÀÏ¿¡¼ ¾ÏÈ£¹®À» Á¦°ÅÇÏ´Â ¹æ¹ýÀÌ´Ù.
openssl rsa -in newreq.pem -out wwwkeyunsecure.pem |
Private Key°¡ Á¦°ÅµÈ »óÅÂÀ̱⠶§¹®¿¡ ¹Ýµå½Ã ±ÇÇÑ(Permission)µîÀ» öÀúÇÏ°Ô Ã¼Å©ÇØ¾ß ÇÑ´Ù. ¸¸¾à ´Ù¸¥ »ç¶÷ÀÌ Private Key¸¦ ¾ò°Ô µÇ¸é ±× »çÀÌÆ®´Â º¸¾ÈÀÌ ¸Á°¡Áö°Ô µÇ¸ç, ±× »ç¶÷ÀÌ ¾ÇÀǷΠ۸¦ »ç¿ëÇÒ ¼ö ÀÖ´Ù. ÀÌ ÀÛ¾÷ÀÌ ³¡³ª¸é newcert¿Í wwwkeyunsecure.pemÀ» Apache¿¡¼ »ç¿ëÇÏ¸é µÈ´Ù.
wwwkeyunsecure.pem°ú newcert.pemÀ» /etc/httpd/conf/ssl/¿¡ wwwkeyunsecure.pem °ú wwwcert.crt¶ó´Â À̸§À¸·Î º¹»çÇÑ´Ù. (¿ªÁÖ:ÀÌ ¶§ wwwkeyunsecure.pemÀÌ ¼¹ö À¯Àú¿¡°Ô ³ëÃâµÇÁö ¾Êµµ·Ï ÆÛ¹Ì¼ÇÀ» Àß °ü¸®ÇÑ´Ù.)
/etc/httpd/conf/ssl/ssl.default-vhost.conf ÆÄÀÏÀ» ¼öÁ¤ÇÑ´Ù.
---- # Server Certificate: # Point SSLCertificateFile at a PEM encoded certificate. If # the certificate is encrypted, then you will be prompted for a # pass phrase. Note that a kill -HUP will prompt again. A test # certificate can be generated with `make certificate' under # built time. #SSLCertificateFile conf/ssl/ca.crt SSLCertificateFile wwwcert.crt # Server Private Key: # If the key is not combined with the certificate, use this # directive to point at the key file. #SSLCertificateKeyFile conf/ssl/ca.key.unsecure SSLCertificateKeyFile wwwkeyunsecure.pem ---- |
httpd ÇÁ·Î¼¼½º¸¦ Á×À̰í(/etc/rc.d/init.d/httpd stop), ¸ðµç ÇÁ·Î¼¼½º°¡ Á×¾ú´ÂÁö È®ÀÎÇÑ ÈÄ(killall httpd), Àç½ÃÀÛÇÑ´Ù. (etc/rc.d/init.d/httpd start)
(¿ªÁÖ:Apache-SSLÀÇ °æ¿ì Apache¿Í º°µµÀÇ ÇÁ·Î¼¼½º¿¡¼ µ¹¾Æ°¡¸ç, httpd.conf¿¡ SSL°ü·Ã ¼³Á¤ÀÌ ³»ÀåµÇ¾î ÀÖ´Ù.)
¸¶ÀÌÅ©·Î¼ÒÇÁÆ® Ű ¸Å´ÏÀú(Microsoft Key Manager)¿¡¼ ۸¦ ¸¸µé±â À§Çؼ´Â »ç¿ëÇÒ ¼ºñ½º(¿¹ÄÁµ¥ IMAPÀ̳ª WWW)¸¦ ¼±ÅÃÇØ¾ß ÇÑ´Ù. »õ·Î¿î ۸¦ »ý¼ºÇÏ·Á¸é ¸¶¹ý»ç(Wizard)¸¦ »ç¿ëÇÏ¸é µÈ´Ù. ¾Õ¿¡¼´Â Common Name(CN)À» »çÀÌÆ® ÁÖ¼Ò¿Í µ¿ÀÏÇÏ°Ô Àû¾úÀ¸³ª, ¿©±â¼´Â Distinguished NameÀ» ´Ù¸£°Ô Àû¾îµµ µÈ´Ù. ¸¶¹ý»ç´Â C:\NewKeyRq.txt À̶õ ÆÄÀÏ¿¡ ÀÎÁõ ¿ä±¸¼¸¦ ÀúÀåÇÏ°Ô µÈ´Ù. Ű ¸Å´ÏÀú´Â ±× ۰¡ ¼¸íµÇÁö ¾Ê¾Ò´Ù°í °æ°íÇÒ °ÍÀÌ´Ù.
/var/ssl µð·ºÅ丮¿¡ ±× ÆÄÀÏÀ» ¹Þ¾Æ¿Í¼ newreq.pemÀ¸·Î À̸§À» ¹Ù²Ù°í ¼¸íÇÑ´Ù.
CA.pl -sign |
´ÙÀ½¿¡ newcert.pemÀ» È®ÀÎÇØº¸¸é ---CERTIFICATE---ºÎºÐ°ú ´Ù¸¥ ÅØ½ºÆ®µéÀÌ ÀÖ´Â °ÍÀ» º¼ ¼ö ÀÖ´Ù. ---CERTIFICATE---ºÎºÐÀ» Á¦¿ÜÇÑ ÅØ½ºÆ®¸¦ Á¦°ÅÇØ¾ß ºñ·Î¼Ò Ű ¸Å´ÏÀú°¡ ÀνÄÇÒ ¼ö ÀÖ°Ô µÈ´Ù. ¾Æ·¡¿Í °°ÀÌ ½±°Ô Á¦°ÅÇÒ ¼ö ÀÖ´Ù.
openssl x509 -in newcert.pem -out newcertx509.pem |
°£´ÜÇÏ°Ô ÅØ½ºÆ® ¿¡µðÅ͸¦ ÀÌ¿ëÇØ¼ Áö¿öµµ µÈ´Ù. (ÀÌ ¶§ ---CERTIFICATE---ºÎºÐÀÌ Áö¿öÁöÁö ¾Êµµ·Ï ÁÖÀÇÇÏÀÚ)
ÀÌ·± ÀÛ¾÷À» °ÅÄ¡¸é newcertx509.pem¿¡´Â ---CERTIFICATE---ºÎºÐ¸¸ ³²°Ô µÈ´Ù.
newcertx509.pem ÆÄÀÏÀ» Ű ¸Å´ÏÀú°¡ µ¹¾Æ°¡°í ÀÖ´Â ÄÄÇ»ÅÍ·Î Àü¼ÛÇϰí, ¸¶¿ì½º ¿À¸¥ÂÊ ¹öưÀ» ´©¸£¸é ¼³Ä¡ÇÒ ¼ö ÀÖ´Ù. ´ÙÀ½¿¡ ¾ÏÈ£¹®À» ÀÔ·ÂÇÏ¸é ±× Å°´Â ¿Ïº®ÇÏ°Ô ÀÛµ¿ÇÏ°Ô µÈ´Ù.