5. ¹®Á¦Çذá

Á¦±âµÉ ¼ö ÀÖ´Â ´Ù¼ÒÀÇ °øÅëµÇ´Â ¹®Á¦°¡ ÀÖ´Ù.

5.1. ¼­¹ö´Â ±¸µ¿µÈ µí Çѵ¥, º¸¾È »çÀÌÆ®¿¡ ¾×¼¼½º ÇÒ ¼ö ¾ø´Ù(Server Appears to start, but you cannot access the secure site).

error_log ÆÄÀÏÀ» Ã¼Å©ÇØ¶ó. ¿¡·¯ ·Î±×¸¦ ÀÛ¼ºÇϵµ·Ï °¡»ó È£½ºÆ®¸¦ ¼³Á¤ÇÏÁö ¾Ê¾Ò´Ù¸é À̸¦ ´Ù½Ã °í·ÁÇÏ°í ½ÍÀ» ¼ö ÀÖ´Ù. ¿¹Á¦ SSL °¡»ó È£½ºÆ®´Â ¿¡·¯ ·Î±× ÆÄÀÏÀ» ÀÛ¼ºÇϴµ¥ ¾Æ¸¶µµ ´ëºÎºÐ ·Î±× ³¡ºÎºÐ¿¡ ºñ¹Ð۰¡ ÀÎÁõ¼­¿Í ÀÏÄ¡ÇÏÁö ¾Ê´Â´Ù´Â °ÍÀ» ¸»ÇÏ´Â ¾à°£ÀÇ °æ°íµé°ú ¿¡·¯°¡ ÀÖÀ» °ÍÀÌ´Ù.

¿¹:


   [Tue Nov 21 09:09:02 2000] [notice] Apache/1.3.14 (Unix) mod_ssl/2.7.1
   OpenSSL/0.9.6 configured -- resuming normal operations
   [Tue Nov 21 09:09:16 2000] [notice] caught SIGTERM, shutting down
   [Tue Nov 21 14:39:54 2000] [notice] Apache/1.3.14 (Unix) mod_ssl/2.7.1
   OpenSSL/0.9.6 configured -- resuming normal operations
   [Tue Nov 21 14:40:31 2000] [notice] caught SIGTERM, shutting down
   [Tue Nov 21 14:43:53 2000] [error] mod_ssl: Init: (esi.fin.equifax.com:443)
   Unable to configure RSA server private key (OpenSSL library error follows)
   [Tue Nov 21 14:43:53 2000] [error] OpenSSL: error:0B080074:x509 certificate
   routines:X509_check_private_key:key values mismatch

À§¿¡¼­ ¿¡·¯ ¸Þ¼¼Áö¸¦ ¾ò´Â´Ù¸é Ű¿Í ÀÎÁõ¼­°¡ ÀÏÄ¡ÇÏÁö ¾Ê´Â °æ¿ìÀε¥ µðÆúÆ® server.key ÆÄÀÏÀ» »ç¿ëÇÏÁö ¾Ê¾Ò´ÂÁö È®½ÅÇØ¶ó. ¶ÇÇÑ Áö½Ã°¡ Á¤È®ÇÑ ºñ¹ÐŰ¿Í ÀÎÁõ¼­¸¦ °¡¸®Å°°í ÀÖ´ÂÁö È®½ÅÇϱâ À§ÇØ httpd.confÆÄÀÏÀ» Ã¼Å©ÇØ¾ß ÇÑ´Ù.

ºñ¹ÐŰ¿Í ÀÎÁõ¼­°¡ Á¤È®ÇÑ Æ÷¸ËÀÌ°í ¼­·Î ÀÏÄ¡ÇÏ´ÂÁö È®½ÅÇϱâ À§ÇØ Ã¼Å©ÇÒ ¼ö ÀÖ´Ù. À̸¦ À§ÇØ °¢°¢ÀÇ Å͹̳ΠÀ©µµ¿ì¿¡¼­ ºñ¹ÐŰ¿Í ÀÎÁõ¼­¸¦ º¹È£È­Çϱâ À§ÇØ ¾Æ·¡ÀÇ ¸í·ÉÀ» ½ÇÇà½ÃÄѶó. °¢ ŰÀÇ ¸ðµâ·¯½º¿Í Áö¼ö°¡ ºñ±³ÇÒ ´ë»óÀÌ´Ù. Ű¿Í ÀÎÁõ¼­ÀÇ ¸ðµâ·¯½º¿Í Áö¼ö°¡ ÀÏÄ¡ÇÑ´Ù¸é ÀÎÁõ¼­¿Í ۰¡ Á¤È®ÇÑ ½ÖÀÎÁö È®½ÅÇØ¶ó.

¸ðµç ´Ù¸¥ °ÍÀÌ ½ÇÆÐÇÑ´Ù¸é »õ·Î¿î ºñ¹ÐŰ, CSR ¶Ç´Â ÀÚÇÊ ¼­¸í ÀÎÁõ¼­¸¦ »ý¼ºÇضó. À̸¦ Çϱâ Àü¿¡ CAÀÇ Àç¹ß±Þ Á¤Ã¥À» Ã¼Å©ÇØ¶ó. Àç¹ß±Þ½Ã ºñ¿ëÀÌ µé ¼ö ÀÖ´Ù.

ÀÎÁõ¼­ ³»¿ëÀ» º¸·Á¸é ´ÙÀ½ ¸í·ÉÀ» ½ÇÇà½ÃŲ´Ù:

   openssl x509 -noout -text -in filename.crt

ºñ¹ÐŰ ³»¿ëÀ» º¸·Á¸é ´ÙÀ½ ¸í·ÉÀ» ½ÇÇà½ÃŲ´Ù:

 
   openssl rsa -noout -text -in filename.key

5.2. Ŭ¶óÀÌ¾ðÆ® ºê¶ó¿ìÀú¿¡¼­ ÀÎÁõ¼­ À̸§ üũ °æ°í°¡ ³ªÅ¸³­´Ù(Certificate Name Check Warning is issued by the client's browser).

ÀÌ´Â ´ëºÎºÐ CSRÀ» »ý¼ºÇÒ ¶§ µµ¸ÞÀÎ ³×ÀÓ ½ÃÀۺκп¡¼­ "www"¸¦ »ý·«Ç߱⠶§¹®ÀÌ´Ù. °¡»ó È£½ºÆ®¿¡ ´ëÇØ "ServerName" Áö½Ã¿¡ ÀÇÇØ Á¤ÀÇµÈ À̸§Àº ÀÎÁõ¼­¿¡ ³ªÅ¸³­ µµ¸ÞÀÎ ³×ÀÓ°ú Á¤È®È÷ ÀÏÄ¡µÇ¾ß Çϴµ¥ ±×·¸Áö ¾Ê´Ù¸é ºê¶ó¿ìÀú°¡ Ŭ¶óÀÌ¾ðÆ®¿¡°Ô ¾Ë·ÁÁÙ °ÍÀÌ´Ù. ¿¹¿Ü´Â ¿ÍÀϵå Ä«µå ÀÎÁõ¼­ÀÌ´Ù. ¿ÍÀϵå Ä«µå ÀÎÁõ¼­ÀÇ µµ¸ÞÀÎ ³×ÀÓÀº *.somedomain.com °°ÀÌ º¸ÀÏ °ÍÀÌ´Ù. ÀÌ´Â somedomain.com ÀÇ ¾î¶² ÇÏÀ§ µµ¸ÞÀε鿡 ´ëÇØ ÇϳªÀÇ ÀÎÁõ¼­¸¦ »ç¿ëÇÒ ¼ö ÀÖµµ·Ï ÇÒ °ÍÀÌ´Ù (¿¹¸¦µé¸é host1.somedomain.com°ú host2.somedomain.com).

5.3. Ŭ¶óÀÌ¾ðÆ® À¥ºê¶ó¿ìÀú°¡ "ÀÎÁõ¼­°¡ ½Å·ÚµÇÁö ¾Ê´Â CA¿¡ ÀÇÇØ ¼­¸íµÇ¾ú´Ù"¶ó´Â °æ°í¸¦ ³ªÅ¸³½´Ù(Certificate was Signed by an Untrusted Certificate Authority Warning is issued by the client's browser).

ÀÚÇÊ ¼­¸í ÀÎÁõ¼­¸¦ »ç¿ëÇϰí ÀÖ´Ù¸é ÀÌ °æ°í¸¦ ¾òÀ» °ÍÀÌ´Ù. Ŭ¶óÀÌ¾ðÆ®¿¡ ÀÎÁõ¼­ ½Å·Ú ¿©ºÎ¸¦ ¼±ÅÃÇÒ ¼ö ÀÖ°Ô ¿É¼ÇÀ» ÁÙ ¼ö ÀÖ´Ù. CA°¡ ¼­¸íÇÑ ÀÎÁõ¼­°¡ ÀÖ°í untrusted °æ°í¸¦ ¾ò´Â´Ù¸é ¾Æ¸¶µµ intermediate (root) ÀÎÁõ¼­¸¦ ¼³Ä¡ÇÒ Çʿ䰡 ÀÖ´Ù.

5.4. ¾ÆÆÄÄ¡¸¦ ±¸µ¿ÇÒ ¶§ SSLEngine on ÀÌ ÀνĵÇÁö ¾Ê´Â ¸í·É¾îÀÌ´Ù(SSLEngine on is an un-recognized command (when starting Apache)).

ModSSLÀÌ ¾ÆÆÄÄ¡¿Í ÇÔ²² ÄÄÆÄÀϵÇÁö ¾ÊÀº °æ¿ì ÀÌ ¿¡·¯ ¸Þ¼¼Áö°¡ ³ªÅ¸³­´Ù. ¾î¶² SSL ÆÐŰÁö´Â °¡»ó È£½ºÆ®³»¿¡¼­ SSLÀ» ½Ãµ¿Çϱâ À§ÇØ ´Ù¸¥ Áö½Ã¸¦ »ç¿ëÇϴµ¥ ÀÌ·¯ÇÑ ÆÐŰÁö¸¦ »ç¿ëÇϰí ÀÖ´Ù¸é ÀÌ ¿¡·¯ ¸Þ¼¼Áö¸¦ ¹ÞÀ» °ÍÀÌ´Ù.

5.5. PEM passphrase¸¦ Àؾú´Âµ¥ À̸¦ Àç¼³Á¤ÇÏ´Â ¹æ¹ýÀ» ¾Ë°í ½Í´Ù(You have forgotten your "PEM Passphrase" and you would like to know how to reset it).

ÀÌ passphrase¸¦ Àç¼³Á¤ÇÒ ¹æ¹ýÀº ¾øÀ¸¸ç passphrase¸¦ ±â¾ïÇϰí Àְųª »õ·Î¿î ºñ¹Ð۸¦ »ý¼ºÇÏ´Â °ÍÀÌ À¯ÀÏÇÑ ÇØ°áÃ¥ÀÌ´Ù. »õ·Î¿î ÀÎÁõ¼­¸¦ ¾ò°Å³ª »õ·ÎÀÌ ÀÚ½ÅÀÌ ¼­¸íÇÑ ÀÎÁõ¼­¸¦ »ý¼ºÇÒ Çʿ䰡 ÀÖ´Ù.