[B! SSL] grattã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

gratt id:gratt

SSLã«é–¢ã™ã‚‹grattã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (10)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

Nginxã§SSLã®è©•ä¾¡ã‚’A+ã«ã™ã‚‹æ‰‹é †
æ˜¨æ—¥ HTTPS åŒ–ã—ãŸ ã‚·ãƒ£ãƒ³ãƒ—ãƒ¼è©•ä¾¡ã‚µã‚¤ãƒˆ ã®SSLè©•ä¾¡ã‚’A+ã«ã—ã¾ã—ãŸã€‚ å‚è€ƒã«ã—ãŸã®ã¯ä¸‹ã®è¨˜äº‹ HTTPS on Nginx: From Zero to A+ (Part 2) - Configuration, Ciphersuites, and Performance - Julian Simioni ã“ã®è¨˜äº‹ã®Nginxè¨¼æ˜Žæ›¸è¨å®šã‚’POSTDã•ã‚“ãŒç¿»è¨³ã—ã¦ã„ã‚‹ã®ã§ã€è¿‘ã„ã†ã¡ã«è©³ã—ã„è¨³ã¯æ—¥æœ¬èªžã§èªã‚ã‚‹ã‹ã‚‚ã€‚ã“ã“ã§ã¯é©å½“ã«ã‹ã„ã¤ã¾ã‚“ã æ‰‹é †ã‚’æ›¸ã„ã¦ãŠãã€‚ä¸€éƒ¨æ™‚é–“ã®ã‹ã‹ã‚‹ã‚³ãƒžãƒ³ãƒ‰ã‚‚ã‚ã‚‹ã‘ã©ã€åŸºæœ¬çš„ã«æ±ºã¾ã£ãŸè¨å®šæ›¸ãã ã‘ãªã®ã§æ™‚é–“ã¯ã‹ã‹ã‚Šã¾ã›ã‚“ã€‚ï¼ˆã‚‚ã¡ã‚ã‚“ã©ã†ã„ã†æ„å‘³ãªã®ã‹çŸ¥ã£ã¦ãŠãã«è¶Šã—ãŸã“ã¨ã¯ãªã„ï¼‰ SSLã®è©•ä¾¡è¨ˆæ¸¬ã«ã¤ã„ã¦ SSLã‚µãƒ¼ãƒãƒ¼ã®ãƒ†ã‚¹ãƒˆã¯Qualys SSL Reportã§ç¢ºèªã—ã¾ã™ã€‚ Nginxãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã®è¨å®šã§è¨ˆæ¸¬ã—ãŸã‚‰Cã ã£ãŸã€‚ SSLv3 ã‚’ç„¡åŠ¹ã«ã™ã‚‹ SSLv3
gratt 2015/03/23
nginx

https

SSL
ãƒªãƒ³ã‚¯
Nginxã§ã®SSLè¨å®šï¼ˆã‚‚ã†ã¡ã‚‡ã£ã¨è©³ã—ãï¼‰
ã¨ã€å®Ÿè¡Œã—ã¦ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã‚¢ãƒƒãƒ—ã—ã¦ãŠãã€‚ ã‚‚ã—ã€ã€Œâ€“with-openssl=ã€ã‚ªãƒ—ã‚·ãƒ§ãƒ³ä»˜ãã§nginxã‚’makeã—ã¦ã‚ã‚‹å ´åˆã¯ã€æ–°ã—ã„ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã®opensslã®ã‚½ãƒ¼ã‚¹ã‚’æº–å‚™ã—ã¦nginxã‚’ä½œæˆã—ç›´ã™ã“ã¨ã€‚ æš—å·åŒ–ã‚¹ã‚¤ãƒ¼ãƒˆã®è¨å®š å¯¾å¿œã™ã‚‹æš—å·åŒ–ã‚¹ã‚¤ãƒ¼ãƒˆã¯ã€ssl_ciphersãƒ‡ã‚£ãƒ¬ã‚¯ãƒ†ã‚£ãƒ–ã§è¨å®šã™ã‚‹ãŒã€ãƒãƒƒãƒˆä¸Šã®å¤šãã®æƒ…å ±ã¯ã“ã‚Œã‚‰ã®è¨˜è¼‰ãŒãªã„ã‚‚ã®ãŒå¤šã„ã€‚ ã¤ã¾ã‚Šã¯ã€ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã‚µã‚¤ãƒ‰ãŒæŒ‡å®šã—ãŸæš—å·åŒ–ã‚¹ã‚¤ãƒ¼ãƒˆã§æš—å·åŒ–ã—ã¦ã„ã‚‹ã“ã¨ã«ãªã‚‹ã€‚ å®‰å…¨ãªSSLæŽ¥ç¶šã‚’ç›®æŒ‡ã™ãªã‚‰ã€ã‚µãƒ¼ãƒã‚µã‚¤ãƒ‰ã§æŒ‡å®šã—ãŸæš—å·åŒ–ã‚¹ã‚¤ãƒ¼ãƒˆã§é€šä¿¡ã‚’æš—å·åŒ–ã™ã‚‹ã»ã†ãŒæœ›ã¾ã—ã„ã€‚ ã¨ã„ã†ã“ã¨ã§ã€ã¾ãšã¯ä¸–ã®ä¸ã®ãƒ‡ãƒ»ãƒ•ã‚¡ã‚¯ãƒˆãƒ»ã‚¹ã‚¿ãƒ³ãƒ€ãƒ¼ãƒ‰ã¯ã©ã†ãªã£ã¦ã„ã‚‹ã®ã‹èª¿ã¹ã¦ã¿ãŸãŒã€MozillaãŒMozilla Web siteã«ä½¿ç”¨ã™ã‚‹ã€HTTPSã®æŽ¨å¥¨è¨å®šãŒä¸€ç•ªå¤šãã®ã‚µã‚¤ãƒˆã§ã®å¼•ç”¨å…ƒã«ãªã£ã¦ã„ã‚‹ã‚ˆã†ã ã€‚ Security/Server Si
gratt 2015/03/23
SSL

nginx
ãƒªãƒ³ã‚¯
Nginxã§HTTPS : ã‚¼ãƒã‹ã‚‰å§‹ã‚ã¦SSLã®è©•ä¾¡ã‚’A+ã«ã™ã‚‹ã¾ã§ Part 1 | POSTD
æ•°å¹´å‰ã€Webã¯å…¨ä½“çš„ã«æš—å·åŒ–ã•ã‚Œã¦ã„ã¾ã›ã‚“ã§ã—ãŸã€‚HTTPSã¯Webãƒšãƒ¼ã‚¸ã®æœ€ã‚‚é‡è¦ãªéƒ¨åˆ†ã ã‘ã®ãŸã‚ã«ç¢ºä¿ã•ã‚Œã¦ã„ã¾ã—ãŸã€‚æš—å·åŒ–ãŒå¿…è¦ãªã®ã¯å¤§åˆ‡ãªãƒ¦ãƒ¼ã‚¶ãƒ‡ãƒ¼ã‚¿ã ã‘ã§ã€Webãƒšãƒ¼ã‚¸ã®å…¬é–‹ã•ã‚Œã‚‹éƒ¨åˆ†ã¯æš—å·åŒ–ã›ãšã«é€ã£ã¦ã‚‚ã„ã„ã¨ã„ã†ã“ã¨ã§æ„è¦‹ãŒä¸€è‡´ã—ã¦ã„ã¾ã—ãŸã€‚ ã—ã‹ã—ã€ ä»Šã¯ çŠ¶æ³ ãŒ é•ã„ã¾ã™ ã€‚ç¾åœ¨ã§ã¯ã€ã©ã‚“ãªWebãƒˆãƒ©ãƒ•ã‚£ãƒƒã‚¯ã§ã‚‚æš—å·åŒ–ã•ã‚Œã¦ã„ãªã„ã®ã¯è‰¯ããªã„ã¨ã„ã†ã“ã¨ãŒåˆ†ã‹ã£ã¦ã„ã‚‹ã®ã§ã€Webã‚µã‚¤ãƒˆã‚’é‹å–¶ã™ã‚‹èª°ã‚‚ãŒã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã«é–¢ä¿‚ãªãå¼·å›ºãªHTTPSã‚’è¨å®šã—ãªã‘ã‚Œã°ãªã‚Šã¾ã›ã‚“ã€‚ ãŠæ¥ãšã‹ã—ã„è©±ã§ã™ãŒã€ç§è‡ªèº«ã®Webã‚µã‚¤ãƒˆã¯2å¹´è¿‘ãã‚‚å…¨ãHTTPSã‚’ã‚µãƒãƒ¼ãƒˆã—ã¦ã„ã¾ã›ã‚“ã§ã—ãŸ ^(1) ã€‚ Eric Mill ã® ä»Šã™ãç„¡æ–™ã§HTTPSã«åˆ‡ã‚Šæ›¿ãˆã‚ˆã† ã¨ã„ã†ç´ æ™´ã‚‰ã—ã„è¨˜äº‹ãŒæœ€çµ‚çš„ã«ç§ã«å–ã‚’å…¥ã‚Œã¦ãã‚Œã¾ã—ãŸã€‚ç§ã¯ä¼‘æš‡ä¸ã€HTTPSã‚’ã‚»ãƒƒãƒˆã‚¢ãƒƒãƒ—ã—ã¦ Qualys SSL Report ã§
gratt 2015/03/22
https

Nginx

SSL
ãƒªãƒ³ã‚¯
Check your SSL/TLS certificate installation
gratt 2015/03/05
SSL
ãƒªãƒ³ã‚¯
æˆ‘ã€…ã¯ã©ã®ã‚ˆã†ã«ã—ã¦å®‰å…¨ãªHTTPSé€šä¿¡ã‚’æä¾›ã™ã‚Œã°è‰¯ã„ã‹ - Qiita
Modern Ciphersuite: ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES1
gratt 2015/03/02
ssl

apache

nginx
ãƒªãƒ³ã‚¯
nginx ã§ ssl è¨å®šã‚’ã™ã‚‹ : dogmap.jp
nginx ã§ SSL è¨å®šã‚’ã™ã‚‹ã®ã¯ã€ã‚¹ã‚´ã‚¤ç°¡å˜ã§ã™ã€‚ ã‚µãƒ¼ãƒè¨¼æ˜Žæ›¸ã¨ç§˜å¯†éµãŒã™ã§ã«ã‚ã‚‹ãªã‚‰ã€/etc/nginx/nginx.conf ã«ä»¥ä¸‹ã®è¨å®šã‚’è¿½åŠ ã™ã‚‹ã ã‘ã§ãŠã£ã‘ã€‚ server { : listen 443 default ssl; ssl on; # ã‚µãƒ¼ãƒè¨¼æ˜Žæ›¸ï¼ˆã‚µãƒ¼ãƒè¨¼æ˜Žæ›¸ã«ä¸é–“CAè¨¼æ˜Žæ›¸ã‚’é€£çµã—ãŸã‚‚ã®ï¼‰ ssl_certificate /usr/local/nginx/conf/cert.pem; # ç§˜å¯†éµ ssl_certificate_key /usr/local/nginx/conf/cert.key; : } via. HttpSslModule ã‚µãƒ¼ãƒè¨¼æ˜Žæ›¸ã‚’æŒã£ã¦ãªãã¦ã€ã¨ã‚Šã‚ãˆãšã‚ªãƒ¬ã‚ªãƒ¬è¨¼æ˜Žæ›¸ã‚’ä½œæˆã—ãŸã„å ´åˆã¯ä»¥ä¸‹ã®ã‚ˆã†ã«ã—ã¦ä½œã‚Šã¾ã—ã‚‡ã†ã€‚ $ cd /usr/local/nginx/conf $ openssl genrsa -des3 -out s
gratt 2015/02/25
nginx

SSL
ãƒªãƒ³ã‚¯
5åˆ†ã§ã‚ã‹ã‚‹æ£ã—ã„ Web ã‚µã‚¤ãƒˆå¸¸æ™‚ SSL åŒ–ã®ãŸã‚ã®åŸºç¤ŽçŸ¥è˜
Web ã‚µã‚¤ãƒˆã‚’å¸¸æ™‚ SSL åŒ–ã™ã‚‹å ´åˆã«ã€æœ€ä½Žé™çŸ¥ã£ã¦ãŠã‹ãªã‘ã‚Œã°ãªã‚‰ãªã„çŸ¥è˜ã‚„ã€æ³¨æ„ç‚¹ã€å®Ÿéš›ã®è¨å®šæ–¹æ³•ã¾ã§ã€ã²ã¨é€šã‚Šã¾ã¨ã‚ã¦ã¿ã¾ã—ãŸã€‚ãƒ¡ãƒªãƒƒãƒˆã‚„ãƒ‡ãƒ¡ãƒªãƒƒãƒˆã€è¨¼æ˜Žæ›¸ã®ç¨®åˆ¥ã‹ã‚‰ãƒªãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆè¨å®šãªã©ã«ã¤ã„ã¦ã‚‚è§£èª¬ã—ã¦ã„ã¾ã™ã€‚ HTTPS ã‚’ãƒ©ãƒ³ã‚ãƒ³ã‚°ã‚·ã‚°ãƒŠãƒ«ã«ä½¿ç”¨ã—ã¾ã™ã¨ Google ãŒå…¬å¼ã«ç™ºè¡¨ã—ãŸã‚ãŸã‚Šã‹ã‚‰ã€Web ã‚µã‚¤ãƒˆã® SSL å¯¾å¿œã€ç‰¹ã« Google ãŒæŽ¨å¥¨ã—ã¦ã„ã‚‹ Web ã‚µã‚¤ãƒˆã‚’ã™ã¹ã¦ HTTPS ã§é…ä¿¡ã™ã‚‹ã€æ‰€è¬‚ ã€Œå¸¸æ™‚ SSL åŒ–ã€ ã«ã¤ã„ã¦ã®è©±ã‚’èžã„ãŸã‚Šã€å®Ÿéš›ã«ãŠå®¢æ§˜ã‹ã‚‰ç›¸è«‡ã•ã‚ŒãŸã‚Šã™ã‚‹ã‚±ãƒ¼ã‚¹ãŒå¢—ãˆã¦ãã¾ã—ãŸã€‚ ãã“ã§ã€ã„ã„æ©Ÿä¼šã ã—ãã®è¾ºã«é–¢ã™ã‚‹æƒ…å ±ã‚’ã¾ã¨ã‚ã¦ãŠã“ã†ã‹ãªï½ž ã¨æ€ã£ã¦æ›¸ã„ã¦ã¿ãŸã€æ’ä¾‹ã® ï¼ˆï¼Ÿï¼‰ 5åˆ†ã§ã‚ã‹ã‚‹ã‚·ãƒªãƒ¼ã‚ºã€‚æ›¸ãçµ‚ã‚ã£ã¦è¦‹ãŸã¨ã“ã‚çµ¶å¯¾ã« 5åˆ†ã˜ã‚ƒç„¡ç†ã£ã¦ã„ã†æ–‡ç« é‡ã«ãªã£ã¦ã¦ã©ã†ã—ã‚ˆã†ã‹ãªãã¨ã‚‚æ€ã£ãŸã‚“ã§ã™ãŒã€æ°—ã«ã›ãšå…¬é–‹ã—ã¦ã¿ã¾ã™ã€‚ å¸¸æ™‚ SSL
gratt 2015/01/22
web

SSL
ãƒªãƒ³ã‚¯
Wiresharkã§SSLé€šä¿¡ã®ä¸èº«ã‚’è¦—ã„ã¦ã¿ã‚‹ - ã‚ã°é›»åãŒè©°ã¾ã¤ã¦ã‚ã‚‹
OpenSSLã®è„†å¼±æ€§ã€ŒHeartbleedã€ãŒä¸–é–“ã‚’è³‘ã‚ã›ã¦ã„ã¾ã™ãŒã€è‰²ã€…ã¨ä¹—ã‚Šé…ã‚Œã¦ã—ã¾ã£ãŸæ„ŸãŒã‚ã‚‹ã®ã§ã€ã‚†ã‚‹ã‚†ã‚‹ã¨è½ã¡ç©‚æ‹¾ã„ã‚’ã—ã‚ˆã†ã‹ã¨æ€ã„ã¾ã™ã€‚ Heartbleedã§ç§˜å¯†éµã‚’æ‰‹ã«å…¥ã‚ŒãŸã‚‰SSLé€šä¿¡ã®ä¸èº«å…¨éƒ¨è¦‹ãˆã¡ã‚ƒã†ã˜ã‚ƒã‚“!! ã¨ã„ã†äº‹æ…‹ã«ãªã£ã¦ã„ã¾ã™ãŒã€ãªã‚“ã¨ãªãç†è«–çš„ã«ãã†ã ã‚ã†ãªã¨åˆ†ã‹ã‚‹ã‚‚ã®ã®ã‚¤ãƒžã‚¤ãƒå…·ä½“çš„ãªæ‰‹é †ãŒåˆ†ã‹ã‚‰ãªã„ã€‚ ã¨ã„ã†ã‚ã‘ã§ä»Šå›žã®ãƒ†ãƒ¼ãƒžã¨ã—ã¦ã€æ‰‹å…ƒã«ã‚µãƒ¼ãƒã®ç§˜å¯†éµã¨ã€SSLé€šä¿¡ã‚’ãƒ‘ã‚±ãƒƒãƒˆã‚ãƒ£ãƒ—ãƒãƒ£ã—ãŸpcapãƒ•ã‚¡ã‚¤ãƒ«ãŒã‚ã‚‹ã¨ãã«ã€Wiresharkã§ã©ã‚“ãªæ„Ÿã˜ã§SSLé€šä¿¡ã‚’ã€Œã»ã©ãã€ã®ã‹â€¦â€¦ã¨ã„ã†å…·ä½“çš„ãªæ‰‹é †ã‚’ã€ãƒãƒžã‚Šæ‰€ã‚’å«ã‚ã¦ã¾ã¨ã‚ã¦ãŠã“ã†ã‹ã¨æ€ã„ã¾ã™ã€‚ ã¨ã„ã†ã‹ã€ç§è‡ªèº«ãŒãƒãƒžã£ãŸã®ã§è‡ªåˆ†ç”¨ãƒ¡ãƒ¢ã§ã™ãªã€‚ãªãŠã“ã®æ–‡æ›¸ã§ã¯"SSL"ã¨ã ã‘è¨˜è¿°ã—ã€TLSã¯ç„¡è¦–ã—ã¦ã„ã¾ã™ã€‚ å‰ææ¡ä»¶ ã¨ã‚Šã‚ãˆãšä»¥ä¸‹ã®ã‚ˆã†ãªæ„Ÿã˜ã®æ¤œè¨¼ç’°å¢ƒã§è©¦ã—ã¾ã—ãŸã€‚ IPã‚¢ãƒ‰ãƒ¬ã‚¹ èª¬æ˜Ž ãƒ›ã‚¹ãƒˆO
gratt 2014/04/14
SSL

security
ãƒªãƒ³ã‚¯
SSL Server Test (Powered by Qualys SSL Labs)
This free online service performs a deep analysis of the configuration of any SSL web server on the public Internet. Please note that the information you submit here is used only to provide you the service. We don't use the domain names or the test results, and we never will.
gratt 2014/03/20
SSL

security

service

ãƒ„ãƒ¼ãƒ«
ãƒªãƒ³ã‚¯
httpsã ã‹ã‚‰ã¨ã„ã†ã ã‘ã§å®‰å…¨ï¼Ÿèª¿ã¹ãŸã‚‰æ€–ããªã£ã¦ããŸSSLã®è©±!ï¼Ÿ - Qiita
Deleted articles cannot be recovered. Draft of this article would be also deleted. Are you sure you want to delete this article?
gratt 2014/03/20
nginx

sslè¨¼æ˜Žæ›¸

security

SSL

network

https
ãƒªãƒ³ã‚¯
1