[B! OpenSSL] kuwalabã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

kuwalab id:kuwalab

OpenSSLã«é–¢ã™ã‚‹kuwalabã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (8)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ãƒãƒƒãƒˆä¸Šã®ã‚µã‚¤ãƒˆã®ç´„66ï¼…ãŒä½¿ç”¨ã™ã‚‹OpenSSLã«é‡å¤§ãªãƒã‚°ãŒç™ºè¦‹ã•ã‚Œã‚‹
By Nguyen Hung Vu ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆä¸Šã§æ¨™æº–çš„ã«åˆ©ç”¨ã•ã‚Œã‚‹æš—å·é€šä¿¡ãƒ—ãƒãƒˆã‚³ãƒ«ã®SSL/TLSã‚’å®Ÿè£…ã—ãŸã‚ªãƒ¼ãƒ—ãƒ³ã‚½ãƒ¼ã‚¹ã®ãƒ©ã‚¤ãƒ–ãƒ©ãƒªã€ŒOpenSSLã€ã«ã€SSL/TLSã®æš—å·åŒ–ã«ã‚ˆã£ã¦ä¿è·ã•ã‚Œã¦ã„ã‚‹æƒ…å ±ãŒç‰¹æ®Šãªç’°å¢ƒä¸‹ã§ãªãã¦ã‚‚ç›—ã¾ã‚Œã¦ã—ã¾ã†è„†å¼±æ€§ãŒç™ºè¦šã—ã¾ã—ãŸã€‚ Heartbleed Bug http://heartbleed.com/ ã€ŒHeartbleed Bugã€ã¨åä»˜ã‘ã‚‰ã‚ŒãŸè„†å¼±æ€§ã¯ã€OpenSSLã®1.0.1ã‹ã‚‰1.0.1fã¾ã§ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã§ç™ºè¦‹ã•ã‚ŒãŸã‚‚ã®ã§ã€è„†å¼±æ€§ãŒæ‚ªç”¨ã•ã‚Œã‚‹ã¨ã€ã“ã‚Œã‚‰ã®OpenSSLã§ä¿è·ã•ã‚ŒãŸã‚·ã‚¹ãƒ†ãƒ ã®ãƒ¡ãƒ¢ãƒªãŒèª°ã§ã‚‚é–²è¦§ã§ãã‚‹ã‚ˆã†ã«ãªã‚Šã¾ã™ã€‚ãƒ¡ãƒ¢ãƒªãŒé–²è¦§ã•ã‚Œã‚‹ã“ã¨ã«ã‚ˆã£ã¦ã€ã‚µãƒ¼ãƒ“ã‚¹ãƒ—ãƒãƒã‚¤ãƒ€ã‚’è˜åˆ¥ã—ãƒ¦ãƒ¼ã‚¶ãƒ¼ã®ãƒˆãƒ©ãƒ•ã‚£ãƒƒã‚¯ãƒ»åå‰ãƒ»ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãªã©ã®æƒ…å ±ã‚’æš—å·åŒ–ã™ã‚‹ç§˜å¯†éµãŒå±é™ºã«ã•ã‚‰ã•ã‚Œã€æ‚ªæ„ã®ã‚ã‚‹æ”»æ’ƒè€…ãŒã‚µãƒ¼ãƒ“ã‚¹ã‚„ãƒ¦ãƒ¼ã‚¶ãƒ¼ã‹ã‚‰ç›´æŽ¥é€šä¿¡ã‚’å‚å—ã—ãŸã‚Šã€ãƒ‡ãƒ¼
kuwalab 2014/04/08
OpenSSL
ãƒªãƒ³ã‚¯
ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆè¨¼æ˜Žæ›¸ã‚’è¦æ±‚ã™ã‚‹ã‚µã‚¤ãƒˆã®æ§‹ç¯‰ï¼ˆApache+OpenSSLï¼‰ - ã¬ã‘ãƒ©ãƒœ
åå‰ã¯èžã„ãŸã“ã¨ã‚ã£ã¦ã‚‚ä½•ã ã‹è‰¯ãåˆ†ã‹ã‚‰ãªã‹ã£ãŸOpenSSLã€‚ ãã‚“ãªOpenSSLã‚’çªç„¶ä½¿ã†ã“ã¨ã«ãªã‚Šæ§‹ç¯‰ã™ã‚‹ã¾ã§ã®ãƒ¡ãƒ¢ã€‚ ä¼šç¤¾ã«ã¦ ã²ã‚ã™ > ä»•äº‹ãŒç„¡ã„ï¼ä»•äº‹ï¼ éƒ¨é•· > ã˜ã‚ƒã‚ã€éµãŒç„¡ã„ã¨ã‚¢ã‚¯ã‚»ã‚¹å‡ºæ¥ãªã„ã‚µã‚¤ãƒˆã‚’æ§‹ç¯‰ã—ã¦ãƒ¼ ã²ã‚ã™ > ã¯ã„ã€ã‚„ã‚Šã¾ã™ï¼ ã“ã†ã—ã¦è¨¼æ˜Žæ›¸èªè¨¼ãŒå¿…è¦ãªã‚µã‚¤ãƒˆã‚’æ§‹ç¯‰ã™ã‚‹äº‹ã«ã€‚(â†æ¤œè¨¼ç”¨ã«ä½¿ã†ãŸã‚ï¼Ÿ) ãã‚Œã§èª¿ã¹ã¦ã¿ãŸã‚‰OpenSSLã‚’ä½¿ãˆã°è‰¯ã„ã‚‰ã—ã„(Â´ãƒ»Ï‰ãƒ»ï½€) ã‚µãƒ¼ãƒOSã®æŒ‡å®šã¯ç‰¹ã«ç„¡ã‹ã£ãŸã®ã§ã€ä¸€ç•ªå¥½ããªCentOSã§ã€‚ ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆOSã¯Windowsã€‚ # cat /etc/redhat-release CentOS release 5.6 (Final) # uname -r 2.6.18-238.9.1.el5 çµå±€OpenSSLã£ã¦ä½•ï¼Ÿ ãŠãªã˜ã¿ã®wikipediaã«ã‚ˆã‚‹ã¨... OpenSSLã¯ã€SSLãƒ—ãƒãƒˆã‚³ãƒ«ãƒ»TLSãƒ—ãƒãƒˆã‚³ãƒ«ã®ã‚ªãƒ¼
kuwalab 2012/08/24
Apache

OpenSSL
ãƒªãƒ³ã‚¯
openssl.cnf æ—¥æœ¬èªžè§£èª¬ç‰ˆ
# openssl.cnf æ—¥æœ¬èªžè§£èª¬ç‰ˆ 2005/1/31 # ã“ã®ãƒ‰ã‚ãƒ¥ãƒ¡ãƒ³ãƒˆã¯openssl projectã¨ã¯é–¢ä¿‚ã‚ã‚Šã¾ã›ã‚“ # æ—¥æ›¿ã‚ã‚Šå®Ÿé¨“å®¤ã®ç®¡ç†äººãŒæš‡ã¤ã¶ã—ã«ç¿»è¨³ã—ã¦æ‹¡å¼µã—ãŸã‚‚ã®ã§ã™ã€‚ # ã“ã®ãƒ‰ã‚ãƒ¥ãƒ¡ãƒ³ãƒˆã«é–¢ã™ã‚‹è³ªå•ã‚„æŒ‡æ‘˜ã¯openssl projectã«ã¯ã—ãªã„ã§ãã ã•ã„ # é–“é•ã„ã®æŒ‡æ‘˜ãªã©ã¯ã“ã¡ã‚‰ã¸ãŠé¡˜ã„ã—ã¾ã™ # URL:http://www.yggdrasil.jp/ # Mailto:meguro at yggdrasil.jp s/ at /@/ #################################################################### [ ca ] default_ca = CA_default # ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã®CAã‚»ã‚¯ã‚·ãƒ§ãƒ³ã‚’æŒ‡å®š ########################################
kuwalab 2012/06/14
ç¿»è¨³ã•ã‚Œã¦ãŸã€‚

OpenSSL

SSL
ãƒªãƒ³ã‚¯
opensslã§ä½œæˆã—ãŸSSLè¨¼æ˜Žæ›¸ã¨éµã‚’keytoolã«ã‚¤ãƒ³ãƒãƒ¼ãƒˆã™ã‚‹ | æ™©æˆãƒ—ãƒã‚°ãƒ©ãƒžã®æŒ‘æˆ¦
opensslã‚³ãƒžãƒ³ãƒ‰ã§ä½œæˆã—ãŸ ç§˜å¯†éµã¨è¨¼æ˜Žæ›¸ã‚’tomcatã®SSLã‚³ãƒã‚¯ã‚¿ã«ã‚‚å…±æœ‰ã•ã›ãŸã„ã¨ããŒã‚ã‚‹ã€‚nativeã®APRã‚’ä½¿ãˆã°ã€SSLCertificateFileå±žæ€§ãªã©ãŒä½¿ãˆã¦ãã®ã¾ã¾è¨å®šãƒ•ã‚¡ã‚¤ãƒ«ã«CRTãƒ•ã‚¡ã‚¤ãƒ«ã‚’æŒ‡å®šã§ãã‚‹ãŒã€keytool ã§å¤‰æ›ã§ãã‚‹ã€‚ ã¾ãšã€ä»¥ä¸‹ã®ã‚ˆã†ã«pkcs12ã«å¤‰æ›ã™ã‚‹ã€‚ # openssl pkcs12 -export -in /etc/pki/tls/certs/ssl.crt -inkey /etc/pki/tls/private/ssl.key -out /usr/local/tomcat/keystore.pkcs12 -name "tomcat"ï¼ˆå®Ÿéš›ã¯ï¼‘è¡Œã§å…¥åŠ›ï¼‰ ã“ã®å ´åˆã® -name "tomcat" ã®å€¤ã¯ã€æ¬¡ã®å¤‰æ›ã§ä½¿ç”¨ã™ã‚‹ã€‚ ã•ã‚‰ã«æ¬¡ã®ã‚³ãƒžãƒ³ãƒ‰ã§ pkcs12å½¢å¼ã®ãƒ‡ãƒ¼ã‚¿ã‚’ã‚¤ãƒ³ãƒãƒ¼ãƒˆã™ã‚‹ã€‚ # keytool -import
kuwalab 2012/06/12
ã“ã‚Œã§ã§ããŸã€‚

OpenSSL

Java

Tomcat
ãƒªãƒ³ã‚¯
OpenSSLã«ã¤ã„ã¦ã€€ãã®ï¼” - coLinuxæ—¥è¨˜
å‰å›žã‚ã‹ã£ãŸã“ã¨ã‹ã‚‰ã€openssl ca ã‚³ãƒžãƒ³ãƒ‰å®Ÿè¡Œæ™‚ã«ã€€/etc/pki/tls/openssl.cnf ã‚’ã„ã¡ã„ã¡ä¿®æ£ã™ã‚‹ã“ã¨ã«ã—ã¾ã—ãŸã€‚ CAè¨¼æ˜Žæ›¸ã‚’ä½œã‚‹ã¨ãã¯ã€[ usr_cert ] ã‚»ã‚¯ã‚·ãƒ§ãƒ³ã« basicConstraints = CA:true nsCertType = sslCA, em ailCA keyUsage = cRLSign, keyCertSign ã‚µãƒ¼ãƒè¨¼æ˜Žæ›¸ã‚’ä½œã‚‹ã¨ãã¯ã€[ usr_cert ] ã‚»ã‚¯ã‚·ãƒ§ãƒ³ã« basicConstraints = CA:FALSE nsCertType = server,client,em ail ã‚’æŒ‡å®šã—ã¦ã¿ã¾ã—ãŸã€‚keyUsage ã‚’æŒ‡å®šã—ãŸã®ã¯ã€å…¬å¼ãª CA ã®è¨¼æ˜Žæ›¸ RSA Security Inc - RSA Security 1024 v3 ãªã©ã‹ã‚‰ã®é¡žæŽ¨ã§ã™ã€‚ä½œæˆã—ãŸCAè¨¼æ˜Žæ›¸ cacert.der ã‚’ F
kuwalab 2012/06/07
OpenSSL
ãƒªãƒ³ã‚¯
openssl ã‚³ãƒžãƒ³ãƒ‰
opensslã‚³ãƒžãƒ³ãƒ‰ [ã‚µãƒ¼ãƒã®å®Ÿé¨“å®¤ Slackware] ä½œæˆ : 2003/02/16 ä¿®æ£ : 2003/10/13 ä¿®æ£ : 2011/05/22 "ã‚µãƒ¼ãƒã®å®Ÿé¨“å®¤"ã®æ¤œç´¢ ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã§ä½¿ç”¨ã•ã‚Œã‚‹ãƒ©ãƒ³ãƒ€ãƒ æƒ…å ±ãƒ•ã‚¡ã‚¤ãƒ«ã‚„ãƒãƒªã‚·ãƒ¼ã€CA ã®ç§˜å¯†éµãƒ•ã‚¡ã‚¤ãƒ«ã‚„è¨¼æ˜Žæ›¸ãƒ•ã‚¡ã‚¤ãƒ«ã¯ã€openssl.cnf ã§å®šç¾©ã•ã‚Œã‚‹ã€‚ openssl.cnf ã¯ã€/usr/local/ssl ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªï¼ˆãƒ‡ãƒ•ã‚©ãƒ«ãƒˆï¼‰ã«ç½®ã‹ã‚Œã‚‹ã€‚ CA ã®é–‹è¨ CA ã‚’é–‹è¨ã™ã‚‹ã«ã¯ã€/usr/local/ssl/misc/CA.sh ã‚’ä½¿ç”¨ã™ã‚‹ã€‚ ./demoCA ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªã«ã€cacert.pemï¼ˆCA è¨¼æ˜Žæ›¸ï¼‰ã‚„ private/cakey.pemï¼ˆCA ç§˜å¯†éµï¼‰ãŒä½œæˆã•ã‚Œã‚‹ã€‚ CA.sh ã‹ã‚‰ /usr/local/ssl/bin/openssl ã‚’å®Ÿè¡Œã—ã¦ã„ã‚‹ã®ã§ã€ãƒ‘ã‚¹ã‚’é€šã—ã¦ãŠãã“ã¨ã€‚ # misc/CA.s
kuwalab 2012/04/19
OpenSSL
ãƒªãƒ³ã‚¯
Apache HTTP ã‚µãƒ¼ãƒãƒ¼ for Windows (with SSL) ã§ã¯ã¾ã‚‹ - ç§ã®äºŒæ¬¡è¨˜æ†¶
WebDAV ã§ç°¡æ˜“ãƒ•ã‚¡ã‚¤ãƒ«å…±æœ‰ã‚’ã—ãŸãã¦ã€ã‹ã¤ã€Windows XP ã§ã¯ WebDAV ã® Basic èªè¨¼ãŒç„¡åŠ¹*1ãªã®ã§ã€SSL ä»˜ãã® Apache ã‚’ Windows XP ã«ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã—ã¾ã—ãŸã€‚ã“ã“ã§æ³¨æ„ã—ã¦ãŠã‹ãªãã¦ã¯ã„ã‘ãªã„ã®ã¯ã€ç§ã¯ Windows ã‚’ã‚µãƒ¼ãƒãƒ¼ã¨ã—ã¦ä½¿ã†æ°—æŒã¡ã¯æ¯›é ãªãã¦ã€ã‚ãã¾ã§ã‚‚ PC é–“ã§ã®ãƒ•ã‚¡ã‚¤ãƒ«ã‚³ãƒ”ãƒ¼ã¨ã€Apache ã®å®Ÿé¨“ç›®çš„ã«ä½¿ã†ã ã‘ã§ã™ã€‚æœ¬å½“ã¯ã€VMware ä¸Šã® NetBSD ã§ Samba ã‚’å‹•ã‹ã™ã¨ã„ã†ã‚¢ã‚¤ãƒ‡ã‚¢ã‚‚ã‚ã‚Šã¾ã—ãŸãŒã€ã‚ã¾ã‚Šã«é å›žã‚Šãªã®ã§è«¦ã‚ã¾ã—ãŸã€‚ ã•ã¦ã€ä¸Šè¨˜ã‚’ç°¡å˜ã«å®Ÿç¾ã§ããŸã‹ã¨ã„ã†ã¨ã€å®Ÿã¯éžå¸¸ã«ã¯ã¾ã‚Šã¾ã—ãŸã€‚çµè«–ã‹ã‚‰è¨€ã„ã¾ã™ãŒã€ Cygwin ã‚’ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã—ã¦ã„ã‚‹æ™‚ã¯è¦æ³¨æ„ã€‚ã‚»ãƒƒãƒˆã‚¢ãƒƒãƒ—ã« Cygwin ã‚’ä½¿ã†ã¨ã€ã„ã‚ã‚“ãªæ„å‘³ã§ã¯ã¾ã‚Šã¾ã™ã€‚ ã“ã®ãƒãƒ¥ãƒ¼ãƒˆãƒªã‚¢ãƒ«ã‚’è‰¯ãèªã¿ã¾ã—ã‚‡ã†ã€‚å¤ã„æƒ…å ±ã¯ã€ä»Šã¨ãªã£ã¦ã¯æ£ç¢ºã§ãªã„å ´
kuwalab 2012/01/25
@echoã‹ã€@ãŒã„ã‚‹ã‚“ã ã€‚ã£ã¦ã„ã†ã‹ã€Apacheã˜ã‚ƒãªãã¦Windowsã®ä½¿ã„æ–¹ã ãã€‚

Apache

OpenSSL
ãƒªãƒ³ã‚¯
OpenSSLã®ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã¨ã‚ãƒ¼ãƒšã‚¢ã®ç”Ÿæˆ
OpenSSLã¯ãƒ•ãƒªãƒ¼ã®SSLå®Ÿè£…ã§ã€mod_sslã‚„Apache-SSLã€ã‚ã‚‹ã„ã¯OpenSSHãªã©ã§å¿…è¦ã«ãªã‚Šã¾ã™ã€‚Apacheã§SSLã‚’ä½¿ã„ãŸã„å ´åˆã¯ã€OpenSSLã®ã»ã‹ã«ã€mod_sslã¾ãŸã¯Apache-SSLã‚’å°Žå…¥ã™ã‚‹å¿…è¦ãŒã‚ã‚Šã¾ã™ã€‚ Apache 1.3.20 + mod_ssl 2.8.4ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ãƒ¡ãƒ¢ Apache 1.3.6 + SSL 1.3.2 (Apache-SSL)ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ãƒ¡ãƒ¢ INSTALLã®æ‰‹é †é€šã‚Šã‚³ãƒ³ãƒ‘ã‚¤ãƒ«ã—ã¾ã™ã€‚ $ tar xvfz openssl-0.9.6b.tar.gz $ cd openssl-0.9.6b $ ./config $ make $ make test rootã«ãªã£ã¦ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã—ã¾ã™ã€‚ $ su # make install éµã®ä½œæˆã¨ã‚µã‚¤ãƒˆè¨¼æ˜Žæ›¸ã®ç™ºè¡Œ ãƒ‘ã‚¹ãƒ•ãƒ¬ãƒ¼ã‚ºã§ä¿è·ã•ã‚ŒãŸç§˜å¯†éµã‚’ç”Ÿæˆã—ã¾ã™ã€‚ $ su # cd
kuwalab 2006/02/04
Apache

OpenSSL

ssl
ãƒªãƒ³ã‚¯
1