[B! ssl] miya-janã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

miya-jan id:miya-jan

sslã«é–¢ã™ã‚‹miya-janã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (11)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

Let's Encryptã®ãƒ«ãƒ¼ãƒˆCAæœŸé™åˆ‡ã‚Œã§ OpenSSL 1.0.2ãŒæ€ã‚ã¬äº‹æ•…ã‚’èµ·ã“ã™ä»¶
ã“ã‚Œã¯ã€Let's Encryptã‚’æ”¯ãˆã‚‹ã“ã®äºŒäººã®ãƒ«ãƒ¼ãƒˆCAã¨ OpenSSLã®ç‰©èªžã§ã‚ã‚‹ã€‚ DST Root CA X3 (2000-2021) ISRG Root X1 (2015-2035) ã€œ2021å¹´1æœˆã€œ ISRG Root X1ã€Œã„ã¾ã¾ã§ä¸€ç·’ã«ã‚„ã£ã¦ããŸDST Root CA X3ã•ã‚“ã®å¯¿å‘½ãŒé–“è¿‘ãƒ»ãƒ»ãƒ»ã“ã®ã¾ã¾ã ã¨åƒ•ã‚’ä¿¡é ¼ã—ã¦ãã‚Œã¦ã„ãªã„ãƒ™ãƒ†ãƒ©ãƒ³ã®ï¼ˆå…·ä½“çš„ã«ã„ã†ã¨2016å¹´ãã‚‰ã„ã¾ã§ã®ï¼‰å¤ã„ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆãŸã¡ã¯ Let's Encryptã•ã‚“ã‚’ä¿¡ç”¨ã—ã¦ãã‚Œãªããªã£ã¡ã‚ƒã†ãƒ»ãƒ»ãƒ»ã©ã†ã—ã‚ˆã†ã€ DST Root CA X3ã€Œã©ã‚Œã€ã‚ã—ãŒæ»ã¬å‰ã«(æœ‰åŠ¹æœŸé™ãŒåˆ‡ã‚Œã‚‹å‰ã«)ãŠå‰ãŒä¿¡é ¼ã«å€¤ã™ã‚‹æ—¨ã‚’ä¸€ç†æ›¸ã„ã¦æ®‹ã›ã°ã„ã„ã˜ã‚ƒã‚ã†ã€‚ã‚µãƒ©ã‚µãƒ©ã€ Issuer: O = Digital Signature Trust Co., CN = DST Root CA X3 Validity Not Bef
miya-jan 2021/10/01
certificate

ssl
ãƒªãƒ³ã‚¯
ã¯ã¦ãªãƒ–ãƒã‚°ã¸ã®æŽ¥ç¶šã‚’ã™ã¹ã¦HTTPSã«ã§ãã‚‹æ©Ÿèƒ½ã®å®Ÿè£…äºˆå®šã¨ã€åˆ©ç”¨ã‚’æ¤œè¨Žã™ã‚‹ãƒ¦ãƒ¼ã‚¶ãƒ¼æ§˜ã«æº–å‚™ã„ãŸã ããŸã„ã“ã¨ - ã¯ã¦ãªãƒ–ãƒã‚°é–‹ç™ºãƒ–ãƒã‚°
ã¯ã¦ãªãƒ–ãƒã‚°ã§ã¯ã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ã®çš†æ§˜ã«ã‚ˆã‚Šå®‰å…¨ã«ã”åˆ©ç”¨ã„ãŸã ããŸã‚ã€ãã‚Œãžã‚Œã®ãƒ–ãƒã‚°ã‚’HTTPSã§é…ä¿¡ã§ãã‚‹æ©Ÿèƒ½ã®ãƒªãƒªãƒ¼ã‚¹ã‚’äºˆå®šã—ã¦ã„ã¾ã™ã€‚ãŠå•åˆã‚ã›ã‚‚å¤šæ•°ã„ãŸã ã„ã¦ãŠã‚Šã¾ã™ãŒã€å®Ÿæ–½ã®ã‚ã©ãŒç«‹ã£ãŸã“ã¨ã‹ã‚‰ã€å¯¾å¿œå†…å®¹ã¨ã‚¹ã‚±ã‚¸ãƒ¥ãƒ¼ãƒ«ã‚’ãŠçŸ¥ã‚‰ã›ã„ãŸã—ã¾ã™ã€‚ å¯¾å¿œå†…å®¹ã¨ã‚¹ã‚±ã‚¸ãƒ¥ãƒ¼ãƒ« ç¬¬ä¸€æ®µéšŽï¼šã¯ã¦ãªãƒ–ãƒã‚°ã®ãƒ€ãƒƒã‚·ãƒ¥ãƒœãƒ¼ãƒ‰ãƒ»ç®¡ç†ç”»é¢ã‚’HTTPSåŒ–ã—ã¾ã™ ç¬¬äºŒæ®µéšŽï¼šã¯ã¦ãªãŒæä¾›ã™ã‚‹ãƒ‰ãƒ¡ã‚¤ãƒ³ã®ãƒ–ãƒã‚°ã‚’HTTPSã§é…ä¿¡ã§ãã‚‹ã‚ˆã†ã«ã—ã¾ã™ ç¬¬ä¸‰æ®µéšŽï¼šç‹¬è‡ªãƒ‰ãƒ¡ã‚¤ãƒ³ã®HTTPSåŒ–ã«å¯¾å¿œã—ã¾ã™ æ··åœ¨ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ï¼ˆMixed Contentï¼‰ã«ã¤ã„ã¦ ç·¨é›†ã‚µã‚¤ãƒ‰ãƒãƒ¼ãªã©ã¯ã¦ãªãƒ–ãƒã‚°ã®æ©Ÿèƒ½ã«ãŠã‘ã‚‹å¯¾å¿œã«ã¤ã„ã¦ ãƒ–ãƒã‚°å…¨ä½“ã®HTTPSåŒ–ã«ã¤ã„ã¦ ã‚ˆã‚Šå®‰å…¨ã«ã€Œã¯ã¦ãªãƒ–ãƒã‚°ã€ã‚’ã”åˆ©ç”¨ã„ãŸã ããŸã‚ æ–°ãŸãªWebæŠ€è¡“ã«å¯¾å¿œã™ã‚‹ãŸã‚ ä»˜è¨˜ãƒ»Webãƒ–ãƒ©ã‚¦ã‚¶ã«ã‚ˆã‚‹è¦å‘Šã«ã¤ã„ã¦ è¿½è¨˜ãƒ»å¯¾å¿œçŠ¶æ³ã«ã¤ã„ã¦ [2017/11/7] ã¯ã¦ãªãƒ–ãƒã‚°6
miya-jan 2017/09/25
hatena

blog

ssl

https
ãƒªãƒ³ã‚¯
How to properly import a selfsigned certificate into Java keystore that is available to all Java applications by default?
miya-jan 2017/08/18
ã‚ªãƒ¬ã‚ªãƒ¬è¨¼æ˜Žæ›¸ã‚’Javaã®ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã®keystoreã«ã‚¤ãƒ³ãƒãƒ¼ãƒˆã™ã‚‹æ–¹æ³•

java

ssl
ãƒªãƒ³ã‚¯
SSL Security Test | ImmuniWeb
Web Server SSL Test SSL Certificate Test Em ail Server SSL Test PCI DSS, HIPAA & NIST Test
miya-jan 2017/02/01
test

ssl

security
ãƒªãƒ³ã‚¯
Let's Encryptã®DNS-01ã‚’ä½¿ç”¨ã—ã¦ç„¡æ–™ã®SSLè¨¼æ˜Žæ›¸ã‚’Webã‚µãƒ¼ãƒãªã—ã§å–å¾—ã™ã‚‹ -- ãºã‘ã¿ã•ãŠ
ã‚µãƒžãƒªDNSã«ã‚ˆã‚‹èªè¨¼(DNS-01)ã§ãƒ‰ãƒ¡ã‚¤ãƒ³ã‚’èªè¨¼ã—ã€Letâ€™s Encryptã‹ã‚‰SSLè¨¼æ˜Žæ›¸ã‚’å–å¾—ã™ã‚‹ã“ã¨ãŒã§ããŸã®ã§ã€ãƒ¡ãƒ¢ã¨ã—ã¦ã¾ã¨ã‚ã¾ã™ã€‚ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã¯ã‚µãƒ¼ãƒ‰ãƒ‘ãƒ¼ãƒ†ã‚£è£½ã®letsencrypt.shã‚’ä½¿ç”¨ã—ã¾ã™ã€‚DNSã§èªè¨¼ã™ã‚‹ã«ã¯ã€ãƒ‰ãƒ¡ã‚¤ãƒ³ã«èªè¨¼å°‚ç”¨ã®ã‚µãƒ–ãƒ‰ãƒ¡ã‚¤ãƒ³ã‚’è¿½åŠ ã—ã€ã‚µãƒ–ãƒ‰ãƒ¡ã‚¤ãƒ³ã«å¯¾ã—ã¦TXTãƒ¬ã‚³ãƒ¼ãƒ‰ã‚’è¨å®šã§ãã‚‹å¿…è¦ãŒã‚ã‚Šã¾ã™ã€‚HTTPã«ã‚ˆã‚‹èªè¨¼ã§ã¯ãªã„ãŸã‚ã€Webã‚µãƒ¼ãƒã¯å¿…è¦ã‚ã‚Šã¾ã›ã‚“ã€‚ã“ã®ãŸã‚HTTPã«ã‚ˆã‚‹èªè¨¼ã¨æ¯”è¼ƒã—ã¦ã¨ã¦ã‚‚ç°¡å˜ã«è¨¼æ˜Žæ›¸ã‚’å–å¾—ã§ãã¾ã™ã€‚HTTPã«ã‚ˆã‚‹èªè¨¼ã¨æ‰‹é–“ãªã¨ã“ã‚ç„¡æ–™ã§DVã®SSLè¨¼æ˜Žæ›¸ã‚’å–å¾—ã§ãã‚‹Letâ€™s EncryptãŒè©±é¡Œã§ã™ã€‚ Letâ€™s Encryptã§è¨¼æ˜Žæ›¸ã®å–å¾—ã‚’è¡Œã†å ´åˆã€HTTPã‚’ä½¿ç”¨ã—ã¦ãƒ‰ãƒ¡ã‚¤ãƒ³ã‚’èªè¨¼ã‚’æ–¹æ³•(HTTP-01)ãŒç´¹ä»‹ã•ã‚Œã‚‹ã“ã¨ãŒå¤šã„ã‚ˆã†ã§ã™ã€‚ ã“ã®æ–¹æ³•ã§ãƒ‰ãƒ¡ã‚¤ãƒ³ã‚’èªè¨¼ã™ã‚‹ä»•çµ„ã¿ã¯ã€ã–ã£ãã‚Šèª¬æ˜Žã™ã‚‹ã¨ä»¥ä¸‹ã®ã¨ãŠã‚Š
miya-jan 2016/06/10
DNSã«ã‚ˆã‚‹èªè¨¼ã§Let's Encryptã®SSLè¨¼æ˜Žæ›¸ãŒå–å¾—ã§ãã‚‹

Let's Encrypt

letsencrypt

SSL

è¨¼æ˜Žæ›¸

èªè¨¼

dns
ãƒªãƒ³ã‚¯
Connecting Jenkins to self signed certificated servers
Connecting Jenkins to self signed certificated servers Published - 2011-09-09 | 1min Iâ€™ve recently needed to connect our Jenkins CI server to several internal servers such as Jira and IRC (Fun post coming soon on Jenkins@IRC..). The probl em with these servers are that their SSL certificates are selfsigned. This causes Jenkins to fail when connecting to the servers with the following error (Which y
miya-jan 2016/02/21
jenkinsã§SSLè¨¼æ˜Žæ›¸ãŒã¯ã˜ã‹ã‚ŒãŸã¨ãã«ä¾‹å¤–è¨å®šã™ã‚‹æ–¹æ³•ã€‚

ssl

java

jenkins
ãƒªãƒ³ã‚¯
GoDaddy SSL Cert Not Working With Java
miya-jan 2016/02/21
GoDaddyã®è¨¼æ˜Žæ›¸ãŒJavaã®keystoreã«å…¥ã£ã¦ãªã„å•é¡Œã€‚jenkinsã®ãƒã‚§ãƒƒã‚¯ã‚¢ã‚¦ãƒˆã¨ã‹ã§å¤±æ•—ã™ã‚‹ã€‚æœ€æ–°ã®Java7/8ã§ã¯è¿½åŠ ã•ã‚ŒãŸã£ã¦æ›¸ã„ã¦ã‚ã‚‹ã‘ã©ã€æ‰‹å…ƒã®openjdk(7u95)ã§ã¯å†ç¾ã—ãŸã€‚

java

GoDaddy

ssl
ãƒªãƒ³ã‚¯
Nginxã§HTTPS : ã‚¼ãƒã‹ã‚‰å§‹ã‚ã¦SSLã®è©•ä¾¡ã‚’A+ã«ã™ã‚‹ã¾ã§ Part 1 | POSTD
æ•°å¹´å‰ã€Webã¯å…¨ä½“çš„ã«æš—å·åŒ–ã•ã‚Œã¦ã„ã¾ã›ã‚“ã§ã—ãŸã€‚HTTPSã¯Webãƒšãƒ¼ã‚¸ã®æœ€ã‚‚é‡è¦ãªéƒ¨åˆ†ã ã‘ã®ãŸã‚ã«ç¢ºä¿ã•ã‚Œã¦ã„ã¾ã—ãŸã€‚æš—å·åŒ–ãŒå¿…è¦ãªã®ã¯å¤§åˆ‡ãªãƒ¦ãƒ¼ã‚¶ãƒ‡ãƒ¼ã‚¿ã ã‘ã§ã€Webãƒšãƒ¼ã‚¸ã®å…¬é–‹ã•ã‚Œã‚‹éƒ¨åˆ†ã¯æš—å·åŒ–ã›ãšã«é€ã£ã¦ã‚‚ã„ã„ã¨ã„ã†ã“ã¨ã§æ„è¦‹ãŒä¸€è‡´ã—ã¦ã„ã¾ã—ãŸã€‚ ã—ã‹ã—ã€ ä»Šã¯ çŠ¶æ³ ãŒ é•ã„ã¾ã™ ã€‚ç¾åœ¨ã§ã¯ã€ã©ã‚“ãªWebãƒˆãƒ©ãƒ•ã‚£ãƒƒã‚¯ã§ã‚‚æš—å·åŒ–ã•ã‚Œã¦ã„ãªã„ã®ã¯è‰¯ããªã„ã¨ã„ã†ã“ã¨ãŒåˆ†ã‹ã£ã¦ã„ã‚‹ã®ã§ã€Webã‚µã‚¤ãƒˆã‚’é‹å–¶ã™ã‚‹èª°ã‚‚ãŒã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã«é–¢ä¿‚ãªãå¼·å›ºãªHTTPSã‚’è¨å®šã—ãªã‘ã‚Œã°ãªã‚Šã¾ã›ã‚“ã€‚ ãŠæ¥ãšã‹ã—ã„è©±ã§ã™ãŒã€ç§è‡ªèº«ã®Webã‚µã‚¤ãƒˆã¯2å¹´è¿‘ãã‚‚å…¨ãHTTPSã‚’ã‚µãƒãƒ¼ãƒˆã—ã¦ã„ã¾ã›ã‚“ã§ã—ãŸ ^(1) ã€‚ Eric Mill ã® ä»Šã™ãç„¡æ–™ã§HTTPSã«åˆ‡ã‚Šæ›¿ãˆã‚ˆã† ã¨ã„ã†ç´ æ™´ã‚‰ã—ã„è¨˜äº‹ãŒæœ€çµ‚çš„ã«ç§ã«å–ã‚’å…¥ã‚Œã¦ãã‚Œã¾ã—ãŸã€‚ç§ã¯ä¼‘æš‡ä¸ã€HTTPSã‚’ã‚»ãƒƒãƒˆã‚¢ãƒƒãƒ—ã—ã¦ Qualys SSL Report ã§
miya-jan 2016/02/10
HTTP

SSL

security

Nginx

SSL Labs
ãƒªãƒ³ã‚¯
nginx ã§ SSL ãƒªãƒãƒ¼ã‚¹ãƒ—ãƒã‚ã‚·ã‚’æ§‹ç¯‰ - WebOS Goodies
æœ€è¿‘ã‚ã¾ã‚Šãƒã‚¿ãŒãªã„ã®ã§ãŒã€ã“ã®ã¾ã¾ã ã¨ã¾ãŸä½•é€±é–“ã‚‚æŠ•ç¨¿ãªã—ã«ãªã‚Šãã†ãªã®ã§ã€ä»¥å‰ã‚„ã£ãŸ nginx ã«ã‚ˆã‚‹ SSL ãƒªãƒãƒ¼ã‚¹ãƒ—ãƒã‚ã‚·ã®æ§‹ç¯‰æ–¹æ³•ã‚’å‚™å¿˜éŒ²çš„ã«æ›¸ã„ã¦ã¿ã¾ã™ã€‚é–‹ç™ºç›®çš„ã§ GAE ã® dev_appserver.py ã‚’ SSL åŒ–ã™ã‚‹ãŸã‚ã«ä½¿ã£ãŸã ã‘ã§ã™ãŒã€ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã‚·ã‚¹ãƒ†ãƒ ç‰ã‚’ä½¿ã‚ãšã«ã‚½ãƒ¼ã‚¹ã‹ã‚‰ãƒ“ãƒ«ãƒ‰ã—ã€ä¸€èˆ¬ãƒ¦ãƒ¼ã‚¶ãƒ¼æ¨©é™ã§ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã™ã‚‹æ–¹æ³•ã«ã—ã¦ã„ã¾ã™ã€‚ã”ãåŸºæœ¬çš„ãªå†…å®¹ã§ã™ãŒã€å‚è€ƒã«ã—ã¦ã„ãŸã ã‘ã‚Œã°å¹¸ã„ã§ã™ã€‚ nginx ã¨ã¯ nginx ã¯ Tornado ãªã©ã¨åŒæ§˜ã®éžåŒæœŸã‚¤ãƒ™ãƒ³ãƒˆãƒ‰ãƒªãƒ–ãƒ³ãƒ¢ãƒ‡ãƒ«ã‚’æŽ¡ç”¨ã—ãŸ HTTP ã‚µãƒ¼ãƒãƒ¼ã§ã™ã€‚ BSD ã«ä¼¼ãŸãƒ©ã‚¤ã‚»ãƒ³ã‚¹ã®ã‚ªãƒ¼ãƒ—ãƒ³ã‚½ãƒ¼ã‚¹ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã¨ã—ã¦å…¬é–‹ã•ã‚Œã¦ã„ã¾ã™ã€‚ãƒ—ãƒã‚»ã‚¹ãƒ»ã‚¹ãƒ¬ãƒƒãƒ‰ãƒ¢ãƒ‡ãƒ«ã‚’æŽ¡ç”¨ã—ãŸ Apache ãªã©ã‚ˆã‚Šã‚‚å¤šæ•°ã®ã‚³ãƒã‚¯ã‚·ãƒ§ãƒ³ã‚’åŠ¹çŽ‡ã‚ˆãå‡¦ç†ã§ãã‚‹ãŸã‚ã€å¤šãã®é«˜è² è·ã‚µã‚¤ãƒˆã§æŽ¡ç”¨ã•ã‚Œã¦ã„ã¾ã™ã€‚ç¾åœ¨ Apache, I
miya-jan 2015/12/16
nginx

ssl

reverseproxy
ãƒªãƒ³ã‚¯
nginx ã§ SSLè§£ããƒªãƒãƒ¼ã‚¹ãƒ—ãƒã‚ã‚·ãªè¨å®šã®ãŠä½œæ³• - Qiita
ãƒ•ãƒãƒ³ãƒˆã§SSLè§£ã„ã¦ãƒªãƒãƒ¼ã‚¹ãƒ—ãƒã‚ã‚·ã£ã¦ã®ã¯å‰²ã¨è‰¯ãä½œã‚‹ã®ã ã‘ã©ã€ã‚ã‚Œã‚Œ...? nginx, ã¨ãã©ã httpd ã§å‡ºæ¥ã¦ãŸã“ã¨ãŒå‡ºæ¥ãªãã¦ã€Œãˆã£ï¼Ÿã€ã¦ãªã‚‹ã€‚ä»Šå¾Œã®ãŸã‚ã«ãƒ¡ãƒ¢ã€‚ server { listen 80; server_name www.example.com; rewrite ^ https://$http_host$request_uri? permanent; } server { listen 443; server_name www.example.com; ssl on; ssl_certificate ... ssl_certificate_key ... : location / { proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header
miya-jan 2015/12/16
nginx

reverseproxy

ssl
ãƒªãƒ³ã‚¯
Apache HttpComponents(æ—§httpClient)ã§sslé€šä¿¡æ™‚ã®ã‚¨ãƒ©ãƒ¼ - Flicker's Style++
ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‹ã‚‰httpsé€šä¿¡ã‚’ä½¿ã£ã¦ä»–ã®ã‚µãƒ¼ãƒã¨é€£æºã™ã‚‹ã“ã¨ã¯ã‚ˆãã‚ã‚‹ã¨æ€ã„ã¾ã™ã€‚ ä¾‹ãˆã°facebookã‚„googleã®OAuthèªè¨¼ã®OPã¨ã‚„ã‚Šã¨ã‚Šã™ã‚‹å ´åˆã¨ã‹ã€‚ ç§ã¯é–‹ç™ºæ™‚ã¯Macä¸Šã§è¡Œãªã£ã¦ã„ã‚‹ãŒãã®æ™‚ç‚¹ã§ã¯java7ã¯OpenJDKã—ã‹ãªã‹ã£ãŸã®ã§(ç¾åœ¨ã¯Macç‰ˆã®oracle jdk7ãŒå‡ºã¦ã¾ã™ãï¼‰ã€ã»ã¨ã‚“ã©ã®é–‹ç™ºã‚’OpenJDKä¸Šã§è¡Œãªã£ã¦ã„ãŸã‚“ã§ã™ãŒã€ãªãœã‹HttpComponentsã‚’ä½¿ã£ã¦httpsã®é€šä¿¡ã‚’è¡Œã†ã¨ä¸‹è¨˜ã‚¨ãƒ©ãƒ¼ãŒå‡ºã‚‹ã€‚ Exception in thread "main" java.lang.RuntimeException: javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated at Main.execute(Main.java:62) at Main.main(Main.j
miya-jan 2013/05/30
javax.net.ssl.SSLPeerUnverifiedException: peer not authenticatedå¯¾ç–ã¨ã—ã¦SSLã®èªè¨¼ã‚’ç„¡è¦–ã™ã‚‹ã‚³ãƒ¼ãƒ‰ã‚’æ›¸ã

java

http

SSL
ãƒªãƒ³ã‚¯
1