Web over HTTPS DevFest Tokyo 2016 #devfest16 2016/10/0
Webãµã¤ãã®æå·åï¼SSLåãHTTPS対å¿ï¼ã¯ããã¾ã§Eã³ãã¼ã¹ããã©ã¤ãã·ãå®ãç®çã§é¨åçã«å°å ¥ããã¦ããããSHA1ããSHA2ã¸ã®åãæ¿ããã¢ãã¤ã«ç«¯æ«ã®æ®åãHTTP/2ã®ç»å ´ã«ãã£ã¦ããµã¤ãå ¨ä½ã常ã«HTTPSéä¿¡ã«ãã常æSSLåã®åããæ´»çºã«ãªã£ã¦ãããããã«SSLãµã¼ãã¼è¨¼ææ¸ãç¡åã§å ¥æå¯è½ãªLetâs Encryptã®ãµã¼ãã¹éå§ã主è¦ãªWebãµã¼ãã¼ã½ããã¦ã§ã¢ã®å®å®çã§HTTP/2ãå©ç¨ã§ããããã«ãªã£ããã¨ã§ãã®åãã¯å éãã¦ãããæ¬ç¨¿ã§ã¯SSLåãåãå·»ãæè¿ã®ç¶æ³ãæ´çããNginxã¨Letâs Encryptã«ããHTTP/2ï¼SSLåã®å®è£ ä¾ãç´¹ä»ãã¦ããã ããã¾ã§è¨¼ææ¸ã®ç¡åå ¥æã¯éå®ç HTTPSã®Webãµã¤ããéç¨ããã«ã¯é常ãåç¨ã®èªè¨¼å±ã«SSLãµã¼ãã¼è¨¼ææ¸ã®çºè¡ãç³ãè¾¼ã¿ãå¿ ãè²»ç¨ãçºçãããã®ã ã£ããä¸é¨éå®ããç®çã§ã¯ç¡åã§å©ç¨ã§ã
StartCom CA is closed since Jan. 1st, 2018, it doesn't issue any new certificate from StartCom name roots. If you want to buy trusted SSL certificate and code signing certificate, please visit https://store.wotrus.com. If you want to apply free email certificate, please visit https://www.mesign.com to download MeSign APP to get free email certificate automatically and send encrypted email automati
ç¡æã§SSLï¼Secure Sockets Layerï¼/TLSï¼Transport Layer Securityï¼ãµã¼ãã¼è¨¼ææ¸ãçºè¡ãããLet's Encryptãã2015å¹´12æ4æ¥ï¼æ¥æ¬æéï¼ã«ãããªãã¯ãã¼ã¿ã«ãªã£ãããã¾ã¾ã§ã¯æå¾ å¶ã®éå®ãã¼ã¿ããã°ã©ã ã ã£ããããããªãã¯ãã¼ã¿ã¨ãªãã誰ã§ã試ããã¨ãã§ããããã«ãªã£ãã Let's Encryptã¯SSL/TLSãµã¼ãã¼è¨¼ææ¸ã®åå¾ã»ç®¡çãç°¡åã«ã§ããããã«ãããã¨ã§ãHTTPSãWebã®æ¨æºã«ãããã¨ãçã£ã¦ãããå°ç¨ã®ã¯ã©ã¤ã¢ã³ãã½ããã¦ã¨ã¢ãå©ç¨ããã¨ã証ææ¸ã®åå¾ã»æ´æ°ä½æ¥ãèªååã§ããç¹ãç¹å¾´ãã¯ã©ã¤ã¢ã³ãã½ããã¦ã¨ã¢èªä½ãèªåã¢ãããã¼ãæ©è½ãåããã Let's Encryptãçºè¡ããã®ã¯ãã¡ã¤ã³èªè¨¼SSL/TLS証ææ¸ã®ã¿ãç±³å½å¤§æèªè¨¼å±ï¼CAï¼ã§ãã IdenTrustã®è¨¼ææ¸ã«ãã£ã¦ãä¸é証ææ¸ãL
é£è¼ç®æ¬¡ .NETã§ã¯ãWebClientã¯ã©ã¹ï¼System.Netåå空éï¼ãWebRequestã¯ã©ã¹ï¼System.Netåå空éï¼ã§Webä¸ã®ãªã½ã¼ã¹ã«ã¢ã¯ã»ã¹ã§ãï¼åèãTIPSï¼WebClientã¯ã©ã¹ã§Webãã¼ã¸ãåå¾ããã«ã¯ï¼ããTIPSï¼WebRequestï¼WebResponseã¯ã©ã¹ã§Webãã¼ã¸ãåå¾ããã«ã¯ï¼ãï¼ããããã®ã¯ã©ã¹ã¯SSLï¼Secure Sockets Layerï¼ã§ã»ãã¥ãªãã£ä¿è·ããããµã¤ãã¸ã®ã¢ã¯ã»ã¹ããµãã¼ããã¦ããã ãããããã®SSLã§ä½¿ç¨ããã¦ãããã¸ã¿ã«è¨¼ææ¸ï¼ä»¥éãSSL証ææ¸ï¼ããä¿¡é ¼ãããªããã®ãä¾ãã°ï¼VeriSignãªã©ã®ç¬¬ä¸è æ©é¢ãçºè¡ãããã¸ã¿ã«è¨¼ææ¸ã§ã¯ãªãï¼makecert.exeãªã©ã«ããä½æããèªå·±è¨¼ææ¸ãªã©ã§ããå ´åã«ã¯ããµã¤ãã®ã¢ã¯ã»ã¹æã«æ¬¡ã®ãããªã¨ã©ã¼ï¼ä¾å¤ï¼ãçºçããã SSL証ææ¸ãåé¡ã§ã¨ã©ã¼ã
CA.shãopenssl.cnfã«è§¦ããã«CA証ææ¸ãä½ã£ã¦ç½²åããæ¹æ³ã®ã¡ã¢ã ãªãããã¡ãã¨ããéç¨ãå¿ è¦ãªå ´é¢ã§ã¯åèã«ãã¹ãã§ãªãã 話ãåç´ã«ããããã以ä¸ã§ç¨ããå ¬ééµã¢ã«ã´ãªãºã ã¯ãã¹ã¦RSA 2048 bitã¨ããã CA証ææ¸ã®ä½æ èªå·±ç½²å証ææ¸ãä½ãã¨èªåçã«Basic Constraintsã«CA:TRUEãä»ãããããã®ã¾ã¾CA証ææ¸ï¼ããæ£ç¢ºã«ã¯ã«ã¼ã証ææ¸ï¼ã¨ãªãã $ openssl genrsa -out ca.key 2048 $ openssl req -new -x509 -days 3650 -key ca.key -out ca.crt -subj "/CN=my private CA" ããã§ã¯ãca.keyãCAã®ç§å¯éµãca.crtãCA証ææ¸ã¨ãªãã ã¾ãã-daysãªãã·ã§ã³ã使ã£ã¦æå¹æéãç´10å¹´å¾ã«æå®ãã¦ããã æå®ããªãå ´å
4. 注æ â ãã®ã¹ã©ã¤ãä¸ã«ééããåå¨ããããã ãã¾ããã o èªåã®ã»ãã¥ãªãã£ã¯èªåã§ç¢ºä¿ããããããã¾ã ãã o ã¯ãªãã£ã«ã«ãªãã¨ã¯èªåã§ç¢ºèªãã¦ä¸ããã â 常ã«æªæã®ããæ»æè ãæ³å®ããã®ã¯ã³ã¹ ããé«ãã¤ãã¾ãã o æ±ã£ã¦ããæ å ±ã®ãããã¤ãã«ãã£ã¦é©åãªå¤æã
èæ¯ èªåã®ãµã¼ãã¹ã§httpséä¿¡ããµãã¼ãããã«ã¯ãSSL証ææ¸ãå¿ è¦ã«ãªãã¾ãã èªåã§ä½¿ç¨ããã ããªããSSL証ææ¸ãèªåã§ä½æãããããããªã¬ãªã¬è¨¼ææ¸ãç¨ãã¦ãè¯ãã®ã§ãããå¤é¨ã«å ¬éãããµã¼ãã¹ã®å ´åããã¨ãè¡ãã¾ããã SSL証ææ¸ã¨ããã¨å¤æ®µãé«ãå°è±¡ãããã¾ããããStartSSLã¨ãããµã¼ãã¹ã§ç¡æã§SSL証ææ¸ã®çºè¡ãåããããã¨è¨ããã¨ã§è©¦ãã¦ã¿ã¾ããã StartSSLã«ã¦ã¼ã¶ã¼ç»é²ãã 証ææ¸ã®çºè¡ãè¡ãåã«ãStartSSLã«ã¦ã¼ã¶ã¼ç»é²ããå¿ è¦ãããã¾ãã StartSSLããã"StartSSL Free (Class1)"ãé¸æãã¾ãã Certificate Control Panelãé¸æã Sign-upã«é²ã¿ã¾ãã ååãä½æãã¡ã¼ã«ã¢ãã¬ã¹ãªã© å人æ å ±ã®ç»é²ãè¡ãã¾ãã ç»é²ããã¡ã¼ã«ã¢ãã¬ã¹ã«æ¬äººç¢ºèªã®ã¡ã¼ã«ãå±ãã®ã§ãåä¿¡ããã¡ã¼ã«ã®a
ããã«ã¡ã¯ããµã¤ãã¼ãã©ã¹ãã®åæ¬ã§ããååã«ç¶ããå ¥éç·¨ã¨ãã¦ãSSL ãµã¼ãã¼è¨¼ææ¸ã«ã¤ãã¦èª¬æè´ãã¾ãã SSLãµã¼ãã¼è¨¼ææ¸ã®éã ååã®è¨äºã§ã¯ãSSL ãµã¼ãã¼è¨¼ææ¸ã«é¢ããååã¯ãä»å¹´ãæ¥å¹´ãç®ãé¢ããªãã¨ãã£ãç¶æ³ããµã¾ããæ¹ãã¦SSL ãç解ãã¦ãããã¨ããç®çã®ããã証ææ¸ã®å½¹å²ã§ããæå·åã¨èªè¨¼ã«ã¤ãã¦èª¬æãã¾ãããã¾ãããã®è¨äºã®ãªãã§ãèªè¨¼ã®ã¬ãã«ã«ã¯éãããããã¨ãè¨åãã¾ããã SSL ãµã¼ãã¼è¨¼ææ¸ã®ç¨®é¡ã¯ 3 ã¤ã«åããããã®ã§ãããããã¯ãæå·ã®å¼·ãï¼ã©ãã ãç ´ããã«ãããï¼ã§åé¡ãããã®ã§ãªããã©ãã¾ã§è©³ãã証ææ¸ã®å義ã®äººï¼çµç¹ï¼ã調ã¹ããã¨ããèªè¨¼ã®ã¬ãã«ã«ãã£ã¦åããããã®ã§ãã ä»åã¯ããã®èªè¨¼ã®éãã«ã¤ãã¦èª¬æããã¦ãã ããã DVãOVãEV èªè¨¼ã¬ãã«ã®éãã«ããã証ææ¸ã®å¼ã³æ¹ãç°ãªãã¾ããæ¥çã§ã¯ãDomain Validation
ï½ç±³å½CERT/CC (*1)ãèå¼±æ§ã®ãã617ã®Androidã¢ããªãææ (*2)ãä»å¾ããã«ææãããè¦è¾¼ã¿ï½ IPAï¼ç¬ç«è¡æ¿æ³äººæ å ±å¦çæ¨é²æ©æ§ãçäºé·ï¼è¤æ± ä¸æ£ï¼ã»ãã¥ãªãã£ã»ã³ã¿ã¼ã¯ãç±³å½ã®CERT/CCã2014å¹´9æ3æ¥ãè¤æ°ã®Androidã¢ããªã«ãSSL証ææ¸ãé©åã«æ¤è¨¼ããªãèå¼±æ§ãã確èªããã¨ã®çºè¡¨ãåããAndroidã¢ããªéçºè ã«å¯¾ãã¦æ³¨æåèµ·ãçºãããã¨ã¨ãã¾ããã HTTPSï¼HTTP over SSL/TLSï¼ã§ãµã¼ãã¼ã¨éä¿¡ããAndroidã¢ããªã¯ãHTTPSéä¿¡ã®éå§æã«éä¿¡å ããéä¿¡ãããSSLãµã¼ãã¼è¨¼ææ¸ãé©åãæ¤è¨¼ããå¿ è¦ãããã¾ããæ¬æ¥ãHTTPSéä¿¡ã§ã¯ãå©ç¨è ã¨ã¦ã§ããµã¤ãã®éä¿¡çµè·¯ä¸ã«æ»æè ãå²ãè¾¼ã¿ãéä¿¡å 容ãçè´ãããæ¹ãããããã¨ããæ»æï¼ä¸éè æ»æï¼ãé²ããã¨ãã§ãã¾ããããããéçºè ãæä¾ããAndroidã¢ããªããS
int dtls1_process_heartbeat(SSL *s) { unsigned char *p = &s->s3->rrec.data[0], *pl; unsigned short hbtype; unsigned int payload; unsigned int padding = 16; /* Use minimum padding */ heartbeatã¨ããæ©è½ã®è©³ãããã¨ã¯èª¿ã¹ããã¦ããªãããã©ã©ãããã¯ã©ã¤ã¢ã³ãã¼ãµã¼ãåã®æ©è½ãæä¾ãããã®ãããã ã¤ã¾ãä½ããã®ãªã¯ã¨ã¹ããåãåã£ã¦ã¬ã¹ãã³ã¹ãè¿ããããªãµã¼ãã¹ãæä¾ãããã®ããããdtls1_process_heartbeatã§å¤§äºãªã®ã¯ ãã¤ã³ã¿pã ãããã¯ãªã¯ã¨ã¹ããã¼ã¿ãåãåã£ã¦æ ¼ç´ãã¦ããããã®ãªã¯ã¨ã¹ããã¼ã¿ã¯æ§é ä½ã«ãªã£ã¦ãã¦ã以ä¸ã®ããã«è¨è¿°ããã¦ããã typedef struct
ãä½ç³»çã«å¦ã¶ å®å ¨ãªWebã¢ããªã±ã¼ã·ã§ã³ã®ä½ãæ¹ããèªãã§ããããã¨ã£ã¦ãæ°ã«ãªãè¨è¿°ãã ãµã¼ãã¼è¨¼ææ¸ã®ãã¡ãã¡ã¤ã³èªè¨¼è¨¼ææ¸ã¯æ¯è¼çä¾¡æ ¼ãå®ããè³¼å ¥ã®ãã¼ãã«ãä½ããã®ã§ããããã¡ã¤ã³èªè¨¼è¨¼ææ¸ã«ã¯ç¡æã®ãã®ãããã¾ããã¤ã¹ã©ã¨ã«ã®StartComã¨ããä¼æ¥ã¯ãç¡æã®ãµã¼ãã¼è¨¼ææ¸ãçºè¡ãã¦ãã¾ããIEãFirefoxãGoogle ChromeãSafariãOperaã®ææ°çã§è¨¼ææ¸ã¨ã©ã¼ãªã使ç¨ã§ãã¾ããIE6ã§ãã¢ãããã¼ããå½ãã£ã¦ããã°ä½¿ç¨ã§ãã¾ãã æ¥æ¬ã®æºå¸¯é»è©±ã«ã¯å¯¾å¿ãã¦ããªãããã§ããããããä»ã¾ã§ã©ããã SSL ãå¹´é2,100åã§æå¼·ã ã¨æã£ã¦ãããã©ç¡æã®ãã®ãããã¨ã¯ãæ°ã«ãªã£ãã®ã§ãã¡ãã£ã¨èª¿ã¹ã¦ã¿ã¾ããã 以ä¸ã®ç»é¢ã StartCom ã®ãµã¤ãã§ããç»é¢ã®èµ¤æ ã®ãªã³ã¯ãã¯ãªãã¯ããã¨æ¬¡ã®ç»é¢ã表示ããã¾ãã ããããã¨ãSSL 証ææ¸ã®è£½åç´¹ä»
ã©ã³ãã³ã°
ã©ã³ãã³ã°
ã©ã³ãã³ã°
ãªãªã¼ã¹ãé害æ å ±ãªã©ã®ãµã¼ãã¹ã®ãç¥ãã
ææ°ã®äººæ°ã¨ã³ããªã¼ã®é ä¿¡
å¦çãå®è¡ä¸ã§ã
j次ã®ããã¯ãã¼ã¯
kåã®ããã¯ãã¼ã¯
lãã¨ã§èªã
eã³ã¡ã³ãä¸è¦§ãéã
oãã¼ã¸ãéã
{{#tags}}- {{label}}
{{/tags}}