SSL�p�ؖ����̍쐬(Windows��)


Windows�‹���openssl�ɂ��e��̌���ؖ����̔��s�ɂ‚��Đ������܂����B�@Linux�n�͌��\���낢��ȃT�C�g�ŏЉ��Ă��܂����AWindows�ɂ‚��Ă͊‹����قȂ邱�Ƃ���Ȃ��Ȃ����̂܂܂ł͂��܂������܂���B���₶�����x���g���C���Ă͎��s���Ă����̂ŁA�����Ő������Ă������Ƃɂ��܂����B����́A���܂���BBS�ŃN���C�A���g�ؖ����Ɋւ���b����������Ă����̂ŁA����ɂ‚��Ă��������܂����B
���̌�A���߂ɐ����������@�ł̓N���C�A���g��InternetExplore�ł͖��Ȃ����ANetscape �ł͂��܂��C���X�g�[���ł��Ȃ����Ƃ��������܂����B�܂��A������̏ꍇ�̏ؖ����̎����������z�z����Ă���openssl�̃o�C�i���Ƀo�O������Aindex.txt������Ƃ�����肪���肤�܂��ł��Ȃ����Ƃ��������܂����B���낢��T��������̂ł����A�ŐV�̃o�C�i�����ǂ����Ă����‚���Ȃ������̂ŁA�Ƃ肠�����ŐV��snapshot�ł͑΍􂳂�Ă���Ƃ̂��ƂŁAMsys + MinGW ��Windows�p�o�C�i������蒼���A�ؖ����̍쐬���@��S�ʓI�Ɍ������܂����BApache�ł̏ؖ����̎g�������N���C�A���g�ւ̃C���X�g�[�����@�͂��ꂼ��̃R���e���c���Q�Ƃ��Ă��������B
�Ȃ��A����m�F��Windows XP SP2�ōs���Ă��܂��B

�����O����

�܂��́Aopenssl�̃C���X�g�[���ł��B
Apache+SSL for Win32�Ɠ����Ő���Win32 OpenSSL�����₶�̂Ƃ��납���_�E�����[�h���Ă��āA�C���X�g�[�����܂��B�C���X�g�[����ƑO�ɁA����Openssl���C���X�g�[������Ă���ꍇ�́A�u�A�v���P�[�V�����̒lj��ƍ폜�v�ŃA���C���X�g�[�����Ă��������B
OpenSSL 0.9.7d�Ŗ�肪���������߁A���₶�̂Ƃ���ŃR���p�C�����Ĕz�z���Ă��܂������A���̌�͖�肪�Ȃ��悤�Ȃ̂��{������_�E�����[�h���Ă��ăC���X�g�[�����Ă��������BOpenSSL 0.9.7f�ȍ~�͓��i�̗��R���Ȃ�����z�z�͒��~���܂��B�{�Ƃ̂��̂́A�C���X�g�[�����邾���ŁA���L��1����3���܂ł͏I������͂��ł��B
  1. �_�E�����[�h�����t�@�C����K���ȏꏊ�ʼn𓀂���B�𓀂���ƁA�uOpenSSL-x.x.x-win32.EXE�v�Ƃ����t�@�C�����ł���̂ŁA��������s����B�f�t�H���g�ł́AC:\�h���C�u�ɉ𓀂����C:\OpenSSL �ɃC���X�g�[������邪�A�V�X�e���h���C�u���قȂ�ꍇ�́A�K�X�ύX���ăV�X�e���h���C�u�ɃC���X�g�[������B(ex. D:\OpenSSL )

  2. Openssl�̃o�[�W������Apache+SSL for Win32�Ɠ����ł���Ζ��Ȃ��Ǝv�����Aopenssl���N������ƃG���[���ł�ꍇ�́A�������Ă���@libeay32.dll��ssleay32.dll�� C:\WINNT\system32���ɃR�s�[���Ă݂�B

  3. OpenSSL�ւ�PATH��ݒ肷��B

    1. �u�X�^�[�g�v->�u�ݒ�v->�u�R���g�g���[���p�l���v�ŃR���g���[���p�l�����J���A�u�V�X�e���v���J���B
    2. �u�ڍ׃^�u�v->�u�‹��ϐ��v�Ŋ‹��ϐ��̃p�l�����J���B
    3. ���́u�V�X�e���‹��ϐ��v�́uPath�v��I�����A�u�ҏW�v�{�^���������B
    4. �u�ϐ��l�v�̈�ԍŌ�ɁA�u;C:\OpenSSL\bin�v(���̃Z�~�R������Y�ꂸ��)�ƃR�}���h������f�B���N�g����lj����āA�uOK�v�������B
    5. ������openssl.cnf�̃p�X��lj�����B�u�V�X�e���‹��ϐ��v�́u�V�K�v�{�^���������A�u�ϐ����v�ɁuOPENSSL_CONF�v���A�u�ϐ��l�v�ɁuC:\OpenSSL\bin\openssl.cnf�v�Ɠ��͂��A�uOK�v�������B
    6. ��́A�uOK�v��2�񉟂��ăV�X�e����‚��AWindows���ċN������B

  4. �A�v���P�[�V�����̊֘A�t�����s���B

    ��������̍�ƂŁAopenssl�ɕt�����Ă���CA.pl�Ƃ����X�N���v�g���g�p���邪�A�u.pl�v��perl�Ɋ֘A�t�����Ă��Ȃ��Ɣ��ɍ�Ƃ��Â炢�̂ŁA�֘A�t�����s���B

    1. �G�N�X�v���[���ŁA�uC:\OpenSSL\bin�v�t�H���_���J���A�uCA.pl�v�t�@�C����I������B
    2. [�t�@�C��] ���j���[�� [�v���p�e�B] ���N���b�N���A�u�A�v���P�[�V�����v���uPerl Command Line Interpreter�v�ɂȂ��Ă��邩�m�F���A�����Ă���΁uOK�v�ŕ‚���B
    3. �قȂ�ꍇ�́A[�ύX] ���N���b�N���A�t�@�C�����J���v���O�����̖��O�̒�����A�uPerl Command Line Interpreter�v��I�����ăN���b�N����B�\������Ă��Ȃ��v���O������I������ꍇ�́A[���̑�] ���N���b�N���Aperl �̃C���X�g�[���p�X����Aperl.exe ��I�����Ċ֘A�t�����s���B
���̌�A�F�؂̑匳�ł���v���C�x�[�gCA�AApache��SSL�𓮂������߂̃T�[�o�ؖ����ƃu���E�U�ւ̃C���X�g�[���pder�t�@�C���쐬���܂��B
�P��SSL�ł�Web�A�N�Z�X�Ȃ炱���܂ł̑Ή��ʼn”\�ł����A�X�Ɍ�����SSL�^�p�Ƃ��āAApache�ł͂��炩����CA�ŔF�؂����N���C�A���g�ؖ������Ȃ��ƃA�N�Z�X�����‚��Ȃ����@���”\�ł��B���̉^�p�ɂ́A�X�ɃN���C�A���g�ؖ������K�v�ɂȂ�܂��̂ŁA��������[�U���Ƃɍ쐬���܂��B�܂��A���̂悤�ȉ^�p�̏ꍇ�A������ؖ��������������Ƃ��̃T�[�o���ł̏ؖ����̎����葱���ɂ‚��Ă������܂��B

���v���C�x�[�gCA�̍쐬

�܂��A�F�؂̑匳�ƂȂ�F�؋�(CA)���쐬���܂��B

�����O����

���ꂩ��̍�Ƃ̏����Ƃ��āAopenssl.cnf�̐ݒ���s���ƂƂ��ɁA��Ɨp�f�B���N�g�����쐬���܂��B

  1. �K���ȃe�L�X�g�G�f�B�^(openssl.cnf�͉��s�R�[�h��LF�̂��߁AWindows�̃������ł͈����Ȃ��B���₶�̓t���[��Terapad���g�킹�Ă�����Ă���B)�ŁA�C���X�g�[������C:\OpenSSL\bin�z���ɂ���openssl.cnf���ȉ��̂悤�ɏC������B�Ȃ��Aopenssl.cnf�́AWindows�‹��ł̓G�N�X�v���[���ł́A�g���q�̂Ȃ��Z�k�_�C�����̃t�@�C��(openssl�Ƃ��������Ȃ��B)�Ƃ��ĕ\������ĊJ�����Ƃ��ł��Ȃ��̂ŁA�G�f�B�^���J���Ă���A�t�@�C�����w�肵�ĊJ���悤�ɂ���B

    [ CA_default ]

       ( snip )

    # �N���C�A���g�ؖ������s���ɗ����Ƃ��Ĕ��s�ؖ������c�����߁A
    # �R�����g�A�E�g���O���ݒ��ύX����B

    #unique_subject = no # Set to 'no' to allow creation of
                         # several ctificates with same subject.
    unique_subject =yes

       ( snip )

    # �N���C�A���g�ؖ��������������ɃG���[���o�邽�߁A�R�����g�A�E�g���O��
    # crlnumber���쐬���Ă����B

    #crlnumber = $dir/crlnumber # the current crl number must be
                                # commented out to leave a V1 CRL
    crlnumber = $dir/crlnumber

       ( snip )


    [ usr_cert ]

       ( snip )

    # �ŏ��ɃT�[�o�ؖ������쐬���邽�߁A�unsCertType�v���userver�v
    # �Ƃ��邽�߁A�R�����g�A�E�g���O���ėL���ɂ���B

    # This is OK for an SSL server.
    # nsCertType = server
    nsCertType = server

       ( snip )


    [ v3_ca ]

       ( snip )

    # CA�ؖ����쐬���̏ؖ����̃^�C�v��SSL/E-mail�p�Ǝw�肷�邽�߁A
    #�unsCertType�v���usslCA, emailCA�v�Ƃ��邽�߁A�R�����g�A�E�g���O���ėL���ɂ���B

    # Some might want this also
    # nsCertType = sslCA, emailCA
    nsCertType = sslCA, emailCA

  2. �e�ؖ����̗L��������ύX�������ꍇ�́ACA.pl���̉��L�̃p�����[�^��ύX����B(0.9.8x�̏ꍇ)

    1. CA�ؖ���

      CA�ؖ����̗L�������́A$CADAYS�̒l��ύX����΂悢�B


         ( snip )

      $SSLEAY_CONFIG=$ENV{"SSLEAY_CONFIG"};
      $DAYS="-days 365";    # 1 year
      $CADAYS="-days 1095"; # 3 years

         ( snip )


    2. �T�[�o�ؖ�����

      �T�[�o�ؖ������̗L��������$DAYS��ύX���������ł͑ʖڂł���B�ύX���@�Ƃ��ẮA�ȉ���2�‚̕��@������B

      [���@1]
       CA.pl����135/138/143�s��system�ɉ��L�̂悤��$DAYS��NjL���A$DAYS�p�����[�^�̒l��ύX������@�B


         ( snip )

      $SSLEAY_CONFIG=$ENV{"SSLEAY_CONFIG"};
      $DAYS="-days
      1095";    # 1 year
      $CADAYS="-days 1095"; # 3 years

         ( snip )
      } elsif (/^-xsign$/) {
         system ("$CA
      $DAYS -policy policy_anything -infiles newreq.pem");
         $RET=$?;
      } elsif (/^(-sign|-signreq)$/) {
         system ("$CA $DAYS -policy policy_anything -out newcert.pem " .
            "-infiles newreq.pem");
         $RET=$?;
         print "Signed certificate is in newcert.pem\n";
      } elsif (/^(-signCA)$/) {
         system ("$CA $DAYS -policy policy_anything -out newcert.pem " .
            "-extensions v3_ca -infiles newreq.pem");
         $RET=$?;
         print "Signed CA certificate is in newcert.pem\n";

         ( snip )


      [���@2]
       CA.pl�͂��̂܂܂ɂ��āAopenssl.conf��default_days��ύX������@�BCA.pl��-sign�ł̓f�t�H���g�ł�-days�̎w�肪�����̂ŁAopenssl.conf��default_days�Ŏw�肵���l���K�p�����B


         ( snip )

      default_days =
      1095

         ( snip )


  3. �����āA�e��ؖ��������쐬����ۂ̍�Ɨp�f�B���N�g�����쐬����B�����ł́AC:\etc�z���ō�Ƃ��邱�ƂƂ���B�R�}���h�v�����v�g���N�����A�ȉ��̂悤�ɂ���C:\etc�f�B���N�g�����쐬���Ă����B

    C:\Documents and Settings\oyaji>md C:\etc

��CA�p�閧��(cakey.pem)��CA�p�ؖ���(cacert.pem)�̍쐬

���O�����ō쐬������Ɨp�f�B���N�g���Ɉړ����A�v���C�x�[�gCA�p�̔閧���Əؖ�����CA.pl���g�p���č쐬����B

C:\Documents and Settings\oyaji>cd C:\etc
C:\etc>CA.pl -newca
CA certificate filename (or enter to create)
[Enter]�݂̂����
Making CA certificate ...
Loading 'screen' into random state - done
Generating a 1024 bit RSA private key
.....++++++
..........................................................++++++
writing new private key to './demoCA/private/cakey.pem'
Enter PEM pass phrase:xxxxx[Enter]�@�@�@�@�@ �@ �� CA�p�p�X�t���[�Y����(��ʏ㉽���ω��͂Ȃ�����������Ă���)
Verifying - Enter PEM pass phrase:xxxxx[Enter]�@�� CA�p�p�X�t���[�Y�ē���
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:JP[Enter] (���R�[�h)
State or Province Name (full name) [Some-State]:Tokyo[Enter] (�s���{����)
Locality Name (eg, city) []:Edogawa[Enter] (�s������)
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Private_CA[Enter] (�g�D��)
Organizational Unit Name (eg, section) []:Admin[Enter] (�g�D�����j�b�g��)
Common Name (eg, YOUR name) []:Private_CA[Enter] (�g�D/�T�[�o��)
Email Address []:[email protected][Enter] (�Ǘ��҃��[���A�h���X)

------------------------�ȉ���0.9.8x�̏ꍇ--------------------------------

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:[Enter]�݂̂����
An optional company name []:[Enter]�݂̂����
Using configuration from C:\OpenSSL\bin\openssl.cnf
Loading 'screen' into random state - done
Enter pass phrase for ./demoCA/private/cakey.pem:xxxxx[Enter] �� CA�p�p�X�t���[�Y����
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number:
            c3:3d:7e:45:d2:26:16:34
        Validity
            Not Before: May 22 02:45:32 2006 GMT
            Not After : May 21 02:45:32 2009 GMT
        Subject:
            countryName               = JP
            stateOrProvinceName       = Tokyo
            organizationName          = Private_CA
            organizationalUnitName    = Admin
            commonName                = Private_CA
            emailAddress              = [email protected]
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                AF:D2:B0:12:70:7B:0F:F4:84:49:FC:BD:1C:72:E1:D5:B0:74:2A:F6
            X509v3 Authority Key Identifier:
                keyid:AF:D2:B0:12:70:7B:0F:F4:84:49:FC:BD:1C:72:E1:D5:B0:74:2A:F6
                DirName:/C=JP/ST=Tokyo/O=Private_CA/OU=Admin/CN=Private_CA/[email protected]
                serial:C3:3D:7E:45:D2:26:16:34

            X509v3 Basic Constraints:
                CA:TRUE
            Netscape Cert Type:
                SSL CA, S/MIME CA
Certificate is to be certified until May 21 02:45:32 2009 GMT (1095 days)

Write out database with 1 new entries
Data Base Updated


���̍�Ƃňȉ��̂悤�ȃf�B���N�g���E�t�@�C�����쐬�����̂ŁA�m�F���Ă����B


�@�@�@etc [ ���[�g�f�B���N�g���@�n
�@�@�@�@�b
�@�@�@�@�� demoCA �m �e��ؖ������̃��[�g�f�B���N�g�� ]
�@�@�@�@�b�@�b
�@�@�@�@�b�@�� certs [ �ؖ������̃f�B���N�g��(�o�b�N�A�b�v�ɗ��p) ]
�@�@�@�@�b�@�b
�@�@�@�@�b�@�� newcerts [ �N���C�A���g�ؖ���(sireal�ǔ�)�̃f�B���N�g�� ]
�@�@�@�@�b�@�b �@�b
�@�@�@�@�b�@�b �@�� xxxxx..pem [ �N���C�A���g�ؖ��� ]
�@�@�@�@�b�@�b �@�b    :
�@�@�@�@�b�@�b �@�� xxxxx..pem [ �N���C�A���g�ؖ��� ]
�@�@�@�@�b�@�b
�@�@�@�@�b�@�� private [ CA�p�̔閧���p�f�B���N�g�� ]
�@�@�@�@�b�@�b �@�b
�@�@�@�@�b�@�b �@�� cakey.pem [ CA�p�̔閧�� ]
�@�@�@�@�b�@�b
�@�@�@�@�b�@�� cacert.pem [ CA�p�̏ؖ��� ]
�@�@�@�@�b�@�� index.txt     [ �N���C�A���g�ؖ����pDB ]
�@�@�@�@�b�@�� serial [ �N���C�A���g�ؖ����p�V���A�� ]
�@�@�@�@�b
�@�@�@�@�� .rnd�@[ �����t�@�C�� ]


���T�[�o�pCA�ؖ����̍쐬(0.9.8x�̏ꍇ)

0.9.8x�̏ꍇ�A�T�[�o�Ŏg�p���邽�߂ɂ͉��L�̑����CA�ؖ���(cacert.crt)������؂�o���Ă����B0.9.7x�̏ꍇ�́Acacert.pem�̂܂܎g�p�ł���B

C:\etc>openssl x509 -in ./demoCA/cacert.pem -out ./demoCA/cacert.crt


��CA�ؖ������u���E�U�ɃC���|�[�g���邽�߂�ca.der�t�@�C���̍쐬

CA�ؖ������u���E�U�ɃC���|�[�g���邽�߂�der�t�@�C�����A�ȉ��ō쐬����B����ca.der�t�@�C����������̎菇�Ńu���E�U�ɃC���|�[�g����B

C:\etc>openssl x509 -inform pem -in ./demoCA/cacert.pem -outform der -out ./demoCA/ca.der


���T�[�o�p�ؖ����̍쐬

�����āAApache�p�̃T�[�o�ؖ������쐬���܂��B
[����]�F�@�T�[�o�ؖ������쐬����ꍇ�ACA�ؖ����ƃT�[�o�ؖ�����ON(Organization Name)�́A�قȂ閼�̂ɂ��Ȃ��Ƃ��܂����삵�Ȃ��̂Œ��ӂ��K�v�ł��B

���T�[�o�p�ؖ����쐬�p���N�G�X�g�t�@�C��(newreq.pem)�̍쐬

�����ł́ACA�ɑ���f�W�^���ؖ����̃��N�G�X�g�t�@�C�����쐬����B�Ȃ��A�T�[�o�p�閧���̂܂܁ASSL�N������ƋN�����邽�тɃp�X�t���[�Y�̓��͂��K�v�ł���A�Z�L�����e�B��͍D�܂�������܂��񂪁A��d����̎����ċN�������͋N���ł��Ȃ��Ȃ�܂��̂ŁA�閧������p�X�t���[�Y�����Ȃ��悤�A�u-nodes�v�ō쐬���܂��B�Ƃ������AWindows��Apache�ł̓p�X�t���[�Y���K�v�ȏ�Ԃł͋N���ł��܂���B
�����ō쐬�����unewkey.pem�v���T�[�o�p�̔閧���Ȃ̂ŁAApache���Ŏg�p����ꍇ�iSSLCertificateKeyFile�Ŏw�肷��t�@�C���j�͂�����g�p����΂悢�B�iApache�̐����Ŏg�p���Ă��� server.key �� �����ł��� newkey.pem �̂��ƁB���� server.key = newkey.pem�j

C:\etc>CA.pl -newreq-nodes
Loading 'screen' into random state - done
Generating a 1024 bit RSA private key
.........++++++
..............++++++
writing new private key to 'newkey.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----

Country Name (2 letter code) [AU]:
JP[Enter] (���R�[�h)
State or Province Name (full name) Some-State]:
Tokyo[Enter] (�s���{����)
Locality Name (eg, city) []:
Edogawa[Enter] (�s������)
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
aconus.com[Enter] (�g�D��)
Organizational Unit Name (eg, section) []:
Admin[Enter] (�g�D�����j�b�g��)
Common Name (eg, YOUR name) []:
www.aconus.com[Enter] (�z�X�g���F*)
Email Address []:
[email protected][Enter] (�Ǘ��҃��[���A�h���X)

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
[Enter] �@�@�@�@ �@�@�� Enter�̂ݓ���
An optional company name []:
[Enter]�@�@ �@ �@�� Enter�̂ݓ���
Request is in newreq.pem, private key is in newkey.pem

�@�@�@�@�@�@*�F�@�����̃z�X�g���́A�K��https://�E�E�E�E�ŃA�N�Z�X����z�X�g���Ƃ��邱�ƁB

���T�[�o�p�ؖ���(server.crt)�̍쐬

�F�؋ǂ̏ؖ����ƃL�[���g���āA���N�G�X�g�t�@�C������X.509�T�[�o�ؖ����̍쐬�Ə������s���B
C:\etc>CA.pl -sign
Using configuration from C:\OpenSSL\bin\openssl.cnf
Loading 'screen' into random state - done
Enter pass phrase for ./demoCA/private/cakey.pem:xxxxx[Enter]�@�@�� CA�p�p�X�t���[�Y����
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number:
            c3:3d:7e:45:d2:26:16:35
        Validity
            Not Before: May 22 02:52:23 2006 GMT
            Not After : May 22 02:52:23 2007 GMT
        Subject:
            countryName              = JP
            stateOrProvinceName      = Tokyo
            localityName              = Edogawa
            organizationName          = aconus.com
            organizationalUnitName    = Admin
            commonName                = www.aconus.com
            emailAddress              = [email protected]
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            Netscape Cert Type:
                SSL Server
            Netscape Comment:
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier:
                1F:D6:4F:D7:BA:9F:CF:7A:9B:51:6B:DC:ED:58:06:5A:64:3A:2E:E2
            X509v3 Authority Key Identifier:
                keyid:AF:D2:B0:12:70:7B:0F:F4:84:49:FC:BD:1C:72:E1:D5:B0:74:2A:F6

Certificate is to be certified until May 22 02:52:23 2007 GMT (365 days)
Sign the certificate? [y/n]:y[Enter]


1 out of 1 certificate requests certified, commit? [y/n]y[Enter]
Write out database with 1 new entries
Data Base Updated
Signed certificate is in newcert.pem

�T�[�o�Ŏg�p���邽�߂ɂ͉��L�̑���ŃT�[�o�ؖ���(server.crt)������؂�o���Ă����B

C:\etc>openssl x509 -in newcert.pem -out server.crt


���T�[�o�p�ؖ������̃o�b�N�A�b�v

�ł����������ؖ����F�؋ǂ̏ؖ����ƃL�[���g���āA���N�G�X�g�t�@�C������X.509�T�[�o�ؖ����̍쐬�Ə������s���B

C:\etc>md server
C:\etc>move *.pem server
C:\etc\newcert.pem
C:\etc\newkey.pem
C:\etc\newreq.pem

C:\etc>move *.crt server
C:\etc\server.crt


���N���C�A���g�p�ؖ����̍쐬

�����āAApache�p�̃N���C�A���g�ؖ����̍쐬���@�������܂����A�P�ɒʐM���Í����ihttps�ł̃A�N�Z�X�j���邾���Ȃ��L��Ƃ����ŏ\���ł���ȉ��̍�Ƃ͕s�v�ł��B
���̃N���C�A���g�p�ؖ����ɂ��N���C�A���g�F�؂𓱓�����ƁA�\�ߔF�؋ǂŏ������ꂽ�N���C�A���g�p�ؖ����������Ȃ��[�����A�N�Z�X���Ă��A�ڑ����̂��̂����ۂ����̂ŃZ�L�����e�B�I�ɂ��Ȃ苭�łɂȂ�܂��B���ʁA�N���C�A���g���ɏؖ����𔭍s���邱�ƂɂȂ�̂ŁA�^�p�͂��Ȃ�ʓ|�ɂȂ�܂����A�Z�L�����e�B�Ƃ̃o�[�^�Ȃ̂Ŏ~�ނ𓾂܂���B
���̂悤�ȃN���C�A���g�F�؂́A��ʓI�Ɋ�ƂȂǂœ�������Ă���A��̗�Ƃ��Ă�web���g�p���ĊO�΂̉c�ƃ}�����ЊO����Г��V�X�e���ɃA�N�Z�X�ł���V�X�e���⊔����̃V�X�e���Ȃǂɓ�������Ă��܂��B���̂悤�ȃV�X�e���̏ꍇ�A�s���葽���ɃA�N�Z�X������Apache�̔F�؂�A�v���F�؂����ł̓Z�L�����e�B���Â��Ȃ邽�߁A�A�N�Z�X���x���ŃZ�L�����e�B���������邽�߂ɃN���C�A���g�F�؂𓱓����܂��B
�N���C�A���g�ؖ����g�p����Apache�̐ݒ���@�ɂ‚��ẮASSL�p�ݒ�̃y�[�W���Q�Ƃ��������B

�����O����

openssl.cnf�̐ݒ���N���C�A���g�ؖ������s�p�ɏC�����܂��B���̍�Ƃ����Ȃ��ƁANetscape�ɂ̓C���X�g�[���ł��܂���B

[ usr_cert ]

   ( snip )

# �T�[�o�ؖ����쐬�p����N���C�A���g�ؖ����p�ɁA�unsCertType�v��
#�unsCertType�v�� �ύX����B�R�����g�A�E�g���O�����userver�v���폜���A
#�uclient, email�v�̃R�����g�A�E�g���O���ėL���ɂ���B

# This is OK for an SSL server.
# nsCertType = server�@
(���ɖ߂�)

   ( snip )

# For normal client use this is typical
# nsCertType = client, email
nsCertType = client, email

���N���C�A���g�p�ؖ����쐬�p���N�G�X�g�t�@�C��(newreq.pem)�̍쐬

�����ł́ACA�ɑ���f�W�^���ؖ����̃��N�G�X�g�t�@�C�����쐬���܂��B

C:\etc>CA.pl -newreq
Loading 'screen' into random state - done
Generating a 1024 bit RSA private key
........+++++
......................................+++++
writing new private key to 'newreq.pem'
Enter PEM pass phrase:
xxxxx[Enter]�@�@�@�@�@ �@�@ �� �N���C�A���g�p�p�X�t���[�Y����
Verifying - Enter PEM pass phrase:
xxxxx[Enter]�@�@�� �N���C�A���g�p�p�X�t���[�Y�ē���
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:
JP[Enter] (���R�[�h)
State or Province Name (full name) Some-State]:
Tokyo[Enter] (�s���{����)
Locality Name (eg, city) []:
Edogawa[Enter] (�s������)
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
acorn.com[Enter] (�g�D��)
Organizational Unit Name (eg, section) []:
user[Enter] (�g�D�����j�b�g��)
Common Name (eg, YOUR name) []:
oyaji[Enter] (���[�U��)
Email Address []:
[email protected][Enter] (�Ǘ��҃��[���A�h���X)

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:[Enter] �@�@�@�@�@�@�@�@�@
�� Enter�̂ݓ���
An optional company name []:[Enter]�@�@�@�@�@�@ �@
�� Enter�̂ݓ���

Request (and private key) is in newreq.pem


���N���C�A���g�p�ؖ���(newcert.pem)�̍쐬

�F�؋ǂ̏ؖ����ƃL�[���g���āAX.509�N���C�A���g�ؖ����̍쐬�Ə������s���B

C:\etc>CA.pl -sign
Using configuration from C:\OpenSSL\bin\openssl.cnf
Loading 'screen' into random state - done
Enter pass phrase for ./demoCA/private/cakey.pem:
xxxxx[Enter]�@�@�� CA�p�p�X�t���[�Y����
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number:
            c3:3d:7e:45:d2:26:16:36
        Validity
            Not Before: May 23 05:28:00 2006 GMT
            Not After : May 23 05:28:00 2007 GMT
        Subject:
            countryName               = JP
            stateOrProvinceName       = Tokyo
            localityName              = Edogawa
            organizationName          = aconus.com
            organizationalUnitName    = user
            commonName                = oyaji
            emailAddress              = [email protected]
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            Netscape Cert Type:
                SSL Client, S/MIME
            Netscape Comment:
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier:
                3C:85:B0:3B:8C:22:83:81:D1:E6:13:51:DB:BF:45:03:03:75:25:1E
            X509v3 Authority Key Identifier:
                keyid:AF:D2:B0:12:70:7B:0F:F4:84:49:FC:BD:1C:72:E1:D5:B0:74:2A:F6

Certificate is to be certified until May 23 05:28:00 2007 GMT (365 days)
Sign the certificate? [y/n]:y[Enter]


1 out of 1 certificate requests certified, commit? [y/n]y[Enter]
Write out database with 1 new entries
Data Base Updated
Signed certificate is in newcert.pem

�N���C�A���g�ؖ����𔭍s����ƁAindex.txt�Ɉȉ��̂悤�ȓ��e���lj������B�N���C�A���g���lj�����邽�тɁA���̓��e���lj�����Ă����Bindex.txt�͌�q����A�ؖ����̎��������Ŏg�p�����f�[�^�x�[�X�Ȃ̂ŁA�����������肵�Ȃ��悤���ӂ��K�v�ł���B�z�z�o�C�i���ł́A�o�O�ł��̃t�@�C�����j�󂳂�Ă��܂��A�����������ł����ɋ�J�����B

V 051003025313Z FB4C837477EB7B41 unknown /C=JP/ST=Tokyo/L=Edogawa/O=aconus.com/OU=user/CN=oyaji/[email protected]


��pkcs12�`���̃N���C�A���g�p�ؖ���(oyaji.p12)�̍쐬

���Əؖ��������S�ɊO���n��(�N���C�A���g�ɓn��)���߂ɁApkcs12�Ƃ������@�Ō��Əؖ������ЂƂ‚ɂ܂Ƃ߂�B���L�ł̓N���C�A���g�p�̌��Əؖ����ɉ����ACA�ؖ��������킹�ĂЂƂ‚ɂ܂Ƃ߂邱�Ƃ��ł���B�Ȃ��AExport�p�̃p�X���[�h�́A�N���C�A���g�ł̉𓀗p�ɁA�ؖ����Ɠ��l�ɃN���C�A���g�ɒʒm����(���ꃁ�[���ő���ȂǂƂ������Ƃ͂�߂悤)�K�v������B�u-pkcs12�v�̌��ɂ͏ؖ����̏ؖ����̃t�����h����(�����ł�oyaji)���w�肷��B
C:\etc>CA.pl -pkcs12 oyaji
Loading 'screen' into random state - done
Enter pass phrase for newkey.pem:xxxxx[Enter]�@�@�@
�� �N���C�A���g�p�p�X�t���[�Y����
Enter Export Password:
xxxxx[Enter]�@�@�@�@�@   �@   �� Export�p�p�X�t���[�Y����
Verifying - Enter Export Password:
xxxxx[Enter]�@ �@ �� Export�p�p�X�t���[�Y����
PKCS #12 file is in newcert.p12

 
�쐬�����N���C�A���g�ؖ���(newcert.p12)�̃N���C�A���g�ւ̃C���X�g�[�����@�́A���������Q�Ƃ��������B

���N���C�A���g�p�ؖ������̃o�b�N�A�b�v

CA.pl���g�p���āA�N���C�A���g�ؖ����𔭍s����ƃ��N�G�X�g�t�@�C��(newreq.pem)�Əؖ���(newcert.pem)�͔��s���邽�тɏ����������Ă��܂��B���ł��A���N�G�X�g�t�@�C���͌�q����N���C�A���g�ؖ����̎��������ɕK�v�Ȃ̂ŁA�o�b�N�A�b�v���Ă����Ȃ���΂Ȃ�Ȃ��B(���ۂɂ́A./demoCA/newcerts�z���Ƀo�b�N����Ă͂��邪�A�V���A���ԍ��ō쐬����邽�ߑΉ��t�����ł��Ȃ��B)
�@�ȉ��ɁA�o�b�N�A�b�v�̈������������炩�̕��@�ŃN���C�A���g��������`�Ńo�b�N�A�b�v���Ă������Ƃ��d�v�ł���B�����ł́AdemoCA�z����certs�f�B���N�g���Ƀ��[�U���̃f�B���N�g�����쐬���A�����Ƀo�b�N�A�b�v�����B�ԈႦ�āA�A�����ăN���C�A���g���쐬���Ă��܂����ꍇ�́A��ʏォ��V���A����������͂��Ȃ̂őΉ���������Ȃ��Ȃ�O�ɁA./demoCA/newcerts�z���̃t�@�C����Ή��t�����ăo�b�N�A�b�v���Ă����Ɨǂ��̂ł́H
�@�V���A���ԍ����e�L�X�g�x�[�X�ŊǗ�����̂��A�ЂƂ‚̎�ł��邵�A��A�̍�Ƃ����������Ă��܂��ق��������葁���̂ł́B

C:\etc>md demoCA\certs\oyaji
C:\etc>move *.pem demoCA\certs\oyaji
C:\etc\newcert.pem
C:\etc\newreq.pem
C:\etc>move *.p12 demoCA\certs\oyaji
C:\etc\oyaji.p12

���N���C�A���g�p�ؖ����̎�������

�N���C�A���g�ؖ����ʼn^�p����悤�ȃP�[�X�ł́A�Z�L�����e�B�Ǘ����d�v�ł���A�ؖ����𕴎�������g�p���Ȃ��Ȃ����肵����A�����Ɏ����������s���A���Y�ؖ������g�p�ł��Ȃ��悤�ɂ���K�v������B�ȉ��ɁA�����������������A�����ō쐬���ꂽcrl.pem(�ؖ����������X�g)��Apache�ɓǂ܂����(Windows�̏ꍇ��Apache�̍ċN���v)�A�Y���ؖ����𖳌����ł���B
�N���C�A���g�ؖ���������������ɂ́A���L�Ŏ��������Ǝ������X�g�쐬���s���B
�����������s���ƁAindex.text�͈ȉ��̂悤�ɍs����R�ɕς��A�������Ԃ�3�Ԗڂ̃p�����[�^�Ƃ��Ēlj������B

R 051003025313Z 041003031948Z FB4C837477EB7B41 unknown /C=JP/ST=Tokyo/L=Edogawa/O=aconus.com/OU=user/CN=oyaji/[email protected]

C:\etc>openssl ca -gencrl -revoke ./demoCA/certs/oyaji/newcert.pem -out ./demoCA/crl/crl.pem
Using configuration from C:\OpenSSL\bin\openssl.cnf
Loading 'screen' into random state - done
Enter pass phrase for ./demoCA/private/cakey.pem:xxxxx[Enter]�@�@ �� CA�p�p�X�t���[�Y����
Revoking Certificate C33D7E45D2261637.

Data Base Updated


�Ȃ��AApache�Ŏ��������̐ݒ�(crl.pem�֌W)���s����Apache�K�N���ł��Ȃ��Ȃ�(�����N���C�A���g���o��܂Őݒ�����Ȃ���Ζ��͂Ȃ�)�̂ŁA���̏ꍇ�́A���L�ŋ�̎����t�@�C�����쐬����B�A���A�����crlnumber���Ȃ��ƍ쐬�ł��Ȃ��̂ŁA�Œ�A1���[�U�͏ؖ������쐬���Ă����Ƃ��邱��

C:\etc>openssl ca -gencrl -out ./demoCA/crl/crl.pem
Using configuration from C:\OpenSSL\bin\openssl.cnf
Loading 'screen' into random state - done
Enter pass phrase for ./demoCA/private/cakey.pem:
DEBUG[load_index]: unique_subject = "yes"


�����܂�

��L�̂悤�ɁA�N���C�A���g�ؖ����̉^�p�͊e�l�̏ؖ����Ǘ������\��ςł���B�����ŁAopenssl0.9.8b��CA.pl�����������X�N���v�g(CA2.pl�Ƃł����l�[�����Ďg���Ă��������B)���쐬���ă��[�U�Ǘ����₷�����Ă݂��B�{CA2.pl�͉��L�̃N���C�A���g�ؖ����֌W�ȊO�́A�������Ă��Ȃ��̂ł��̂܂܎g�p�ł���B
�ύX�����̂́Apkcs12�Ń��[�U�ɒ񋟂���N���C�A���g�ؖ����̍쐬�Ǝ��������ł���Bpkcs12�Ń��[�U�ɒ񋟂���N���C�A���g�ؖ������쐬����ƁA�ؖ�����user��.p12�Ƃ���ƂƂ��ɁA��ƃf�B���N�g���z����./user/user���Ƃ����t�H���_���쐬���쐬�f�[�^���Z�[�u����B�쐬���ɓ��ꃆ�[�U���̃`�F�b�N���s���Ă���B

C:\etc>CA2.pl -pkcs12 oyaji
Loading 'screen' into random state - done
Enter pass phrase for newkey.pem:xxxxx[Enter]�@�@�@ �� �N���C�A���g�p�p�X�t���[�Y����

Enter Export Password:
xxxxx[Enter]�@�@�@�@�@   �@   �� Export�p�p�X�t���[�Y����
Verifying - Enter Export Password:
xxxxx[Enter]�@ �@ �� Export�p�p�X�t���[�Y����
C:\etc\newcert.pem
C:\etc\newkey.pem
C:\etc\newreq.pem
C:\etc\oyaji.p12
PKCS #12 file is in oyaji.p12
�����������ʓ|�Ȃ̂ŁArevoke�I�v�V������lj������B��Lpkcs12�ŃN���C�A���g�ؖ������쐬�������Ƃ��O��ƂȂ�Auser�����w�肷�邱�ƂŎ��������Ǝ������X�g�̍X�V���s���B
C:\etc>CA2.pl -revoke oyaji
Using configuration from C:\OpenSSL\bin\openssl.cnf
Loading 'screen' into random state - done
Enter pass phrase for ./demoCA/private/cakey.pem:xxxxx[Enter]�@�@ �� CA�p�p�X�t���[�Y����
Revoking Certificate C33D7E45D2261637.
Data Base Updated



Top Page��