[B! SSL] papiroã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

papiro id:papiro

SSLã«é–¢ã™ã‚‹papiroã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (9)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ã€ŽOpenSSLã‚¯ãƒƒã‚¯ãƒ–ãƒƒã‚¯ã€æä¾›é–‹å§‹ã®ãŠçŸ¥ã‚‰ã›
ã”æ¥åº—ã‚ã‚ŠãŒã¨ã†ã”ã–ã„ã¾ã™ã€‚ æœ¬æ—¥ã‚ˆã‚Šã€ã€Žãƒ—ãƒãƒ•ã‚§ãƒƒã‚·ãƒ§ãƒŠãƒ«SSL/TLSã€ï¼ˆ2017å¹´3æœˆç™ºè¡Œï¼‰ã‹ã‚‰ã‚¹ãƒ”ãƒ³ã‚ªãƒ•ã—ãŸãƒŸãƒ‹ãƒ–ãƒƒã‚¯ã€ŽOpenSSLã‚¯ãƒƒã‚¯ãƒ–ãƒƒã‚¯ã€ã®æä¾›ã‚’é–‹å§‹ã—ã¾ã—ãŸã€‚è³¼å…¥ãƒšãƒ¼ã‚¸ã‹ã‚‰ã‚«ãƒ¼ãƒˆã«è¿½åŠ ã—ã¦ã„ãŸã ãã“ã¨ã§ã€ã©ãªãŸã§ã‚‚ç„¡å„Ÿã§ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ãŒå¯èƒ½ã§ã™ï¼ˆã‚¯ãƒ¬ã‚¸ãƒƒãƒˆã‚«ãƒ¼ãƒ‰æƒ…å ±ã¯ä¸è¦ã§ã™ãŒã€ç›´è²©ã‚µã‚¤ãƒˆã®è³¼å…¥ãƒ•ãƒãƒ¼ã‚’çµŒç”±ã™ã‚‹é–¢ä¿‚ã§ã€ãŠåå‰ã®æ¬„ã¨ä½æ‰€ã®æ¬„ã¸ã®å…¥åŠ›ã¯ãŠé¡˜ã„ã„ãŸã—ã¾ã™ï¼‰ã€‚ åŒæ›¸ã¯ã€Žãƒ—ãƒãƒ•ã‚§ãƒƒã‚·ãƒ§ãƒŠãƒ«SSL/TLSã€ã®åŽŸæ›¸ã§ã‚ã‚‹â€ŸBulletproof SSL and TLSâ€ã‹ã‚‰OpenSSLã«é–¢ã™ã‚‹ç« ã‚’æŠœãå‡ºã—ã¦å†ç·¨ã•ã‚ŒãŸâ€ŸOpenSSL Cookbookâ€ã®ç¿»è¨³ã«ç›¸å½“ã—ã€ã€Žãƒ—ãƒãƒ•ã‚§ãƒƒã‚·ãƒ§ãƒŠãƒ«SSL/TLSã€ã®ã€Œç¬¬11ç« OpenSSLã€ã¨ã€Œç¬¬12ç« OpenSSLã«ã‚ˆã‚‹ãƒ†ã‚¹ãƒˆã€åŠ ãˆã€SSL Labsã§å…¬é–‹ã•ã‚Œã¦ã„ã‚‹ â€ŸSSL/TLS Deployment Best Pra
papiro 2018/02/07
OpenSSLã®æƒ…å ±ãŒã¾ã¨ã¾ã£ã¦ã‚‹ã®ã‹ãªï¼Ÿ

TLS

SSL

OpenSSL
ãƒªãƒ³ã‚¯
ã‚ªãƒ¬ã‚ªãƒ¬è¨¼æ˜Žæ›¸ã‚’opensslã§ä½œã‚‹ï¼ˆè©³ç´°ç‰ˆï¼‰ - ã‚ã°é›»åãŒè©°ã¾ã¤ã¦ã‚ã‚‹
å‰å›žã®opensslã§RSAæš—å·ã¨éŠã¶ã§RSAæš—å·ã‚„ç§˜å¯†éµã«ã¤ã„ã¦ä¸èº«ã‚’è‰²ã€…ã¨ã„ã˜ã£ã¦ã¿ãŸã€‚ç¶šã„ã¦ä»Šå›žã¯ã€Apacheã§ä½¿ã†ã‚ªãƒ¬ã‚ªãƒ¬è¨¼æ˜Žæ›¸ã‚’ä½œã£ã¦ã¿ã‚‹ã€‚ ç´°ã‹ã„ã“ã¨ã¯ã„ã„ã‹ã‚‰ã€ã‚ªãƒ¬ã‚ªãƒ¬è¨¼æ˜Žæ›¸ã‚’ä½œã‚‹ã‚³ãƒžãƒ³ãƒ‰ã ã‘çŸ¥ã‚ŠãŸã„ ãŠæ€¥ãŽã®æ–¹ã¯ã€ä»¥ä¸‹3ã¤ã ã‘ã‚„ã‚Œã°è‰¯ã„ã€‚ã“ã‚Œã§10å¹´é–“(3650æ—¥)æœ‰åŠ¹ãªã‚ªãƒ¬ã‚ªãƒ¬è¨¼æ˜Žæ›¸ãŒã§ãã‚ãŒã‚‹ã€‚ $ openssl genrsa 2048 > server.key $ openssl req -new -key server.key > server.csr $ openssl x509 -days 3650 -req -signkey server.key < server.csr > server.crtã§ãã‚ãŒã£ãŸserver.crtã¨server.keyã‚’ã€ä¾‹ãˆã°/etc/httpd/conf/ é…ä¸‹ã®ssl.crt/ ã¨ ssl.key/ ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªã«è¨ç½®
papiro 2017/09/23
SSL

server

ã‚µãƒ¼ãƒ

è¨¼æ˜Žæ›¸
ãƒªãƒ³ã‚¯
openssl ã‚³ãƒžãƒ³ãƒ‰ã§ãŠæ‰‹è»½ã«SSLè¨¼æ˜Žæ›¸ã‚’ãƒã‚§ãƒƒã‚¯ã™ã‚‹
å‹¤ã‚å…ˆã®ä¸Šå¸ã‹ã‚‰ã‚¹ãƒ†ã‚ãªã‚³ãƒžãƒ³ãƒ‰ã‚’æ•™ãˆã¦ã„ãŸã ã„ãŸã®ã§ãƒ¡ãƒ¢ SSLè¨¼æ˜Žæ›¸ã®ç¢ºèªã®ãŸã‚ã« Webã‚µãƒ¼ãƒãƒ¼ã‚’ç«‹ã¦ãªãã¦ã‚‚ã€openssl ã® s_server ã‚’ä½¿ã†ã¨ç°¡å˜ã«ã§ãã¾ã™ã€‚ $ openssl s_server -accept 10443 -cert example.com.crt -key example.com.key -CAfile example.com.ica -WWW å„ã‚ªãƒ—ã‚·ãƒ§ãƒ³ã®æ„å‘³ã¯æ¬¡ã®ã¨ãŠã‚Š -accept å¾…ã¡å—ã‘ãƒãƒ¼ãƒˆï¼ˆãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã¯ 4433ï¼‰ -cert filename ã‚µãƒ¼ãƒè¨¼æ˜Žæ›¸ã®ãƒ•ã‚¡ã‚¤ãƒ«åï¼ˆãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã¯ server.pemï¼‰ -key filename ç§˜å¯†éµã®ãƒ•ã‚¡ã‚¤ãƒ«åï¼ˆæŒ‡å®šã—ãªã„å ´åˆã¯ã‚µãƒ¼ãƒè¨¼æ˜Žæ›¸ãŒç”¨ã„ã‚‰ã‚Œã‚‹ï¼‰ -CAfile filename ä¸é–“è¨¼æ˜Žæ›¸ã®ãƒ•ã‚¡ã‚¤ãƒ«å -WWW å˜ç´”ãª Web ã‚µãƒ¼ãƒã‚’ã‚¨ãƒŸãƒ¥ãƒ¬ãƒ¼ãƒˆã™ã‚‹ã€‚ URL ã®ãƒ‘ã‚¹éƒ¨åˆ†ã‚’
papiro 2017/06/28
server

OpenSSL

ã‚µãƒ¼ãƒ

SSL
ãƒªãƒ³ã‚¯
ã€ŽLet's Encrypt ã‚’æ”¯ãˆã‚‹ ACME ãƒ—ãƒãƒˆã‚³ãƒ« - Block Rockinâ€™ Codesã€ã¸ã®ã‚³ãƒ¡ãƒ³ãƒˆ
ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ã—ã¾ã—ãŸ ã“ã“ã«ãƒ„ã‚¤ãƒ¼ãƒˆå†…å®¹ãŒè¨˜è¼‰ã•ã‚Œã¾ã™ https://b.hatena.ne.jp/URLã¯spanã§å›²ã‚“ã§ãã ã•ã„ Twitterã§å…±æœ‰
papiro 2015/12/03
ã‚µãƒ¼ãƒè¨¼æ˜Žæ›¸ã®ç„¡æ–™åŒ–ã¨è‡ªå‹•æ›´æ–°ã®æµã‚Œã€‚

SSL

TLS

PKI
ãƒªãƒ³ã‚¯
ã‚³ãƒ³ãƒ”ãƒ¥ãƒ¼ã‚¿ã«è©³ã—ããªã„äººã¸ã€‚ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆå²ä¸Šæœ€æ‚ªã®OpenSSLã®è„†å¼±æ€§ã®ãƒ‹ãƒ¥ãƒ¼ã‚¹ã‚’ã‚ã‹ã‚Šã‚„ã™ãæ›¸ã„ã¦ã¿ã¾ã—ãŸã€‚ã»ã¨ã‚“ã©ã™ã¹ã¦ã®äººã«å½±éŸ¿ã—ã¾ã™ã€‚ - éžå¤©ãƒžã‚¶ãƒ¼ by B-CHAN
ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã§ä½¿ã‚ã‚Œã‚‹éµï¼ˆã‚«ã‚®ï¼‰ ã¿ãªã•ã‚“ã€ã“ã‚“ã«ã¡ã¯ï¼ ã“ã‚“ãªãƒ‹ãƒ¥ãƒ¼ã‚¹ãŒç™ºè¡¨ã•ã‚Œã€ä¸–ç•Œã«è¡æ’ƒã‚’ä¸Žãˆã¦ã„ã¾ã™ã€‚ â†“ Gmailã€YouTubeã«ã‚‚å½±éŸ¿ã€‚å£Šæ»…çš„ãªOpenSSLã®è„†å¼±æ€§ã€ã€ŒHeartbleedã€å•é¡Œã¨ã¯ Â« WIRED.jp ã‚³ãƒ³ãƒ”ãƒ¥ãƒ¼ã‚¿é–¢ä¿‚è€…ã¯å¤§é¨’ãŽã§ã™ãŒã€ãƒœã‚¯ãŸã¡ä¸€èˆ¬äººã¯ã©ã†ã™ã‚Œã°ã„ã„ã®ã§ã—ã‚‡ã†ã‹ï¼Ÿ ã‚³ãƒ³ãƒ”ãƒ¥ãƒ¼ã‚¿ã«è©³ã—ããªã„äººã«ã€ãªã‚‹ã¹ãã‚ã‹ã‚Šã‚„ã™ãæ›¸ã„ã¦ã¿ã¾ã™ã€‚ ã¾ãšã€ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã®ã„ã‚ã‚“ãªã‚µãƒ¼ãƒ“ã‚¹ã‚’åˆ©ç”¨ã™ã‚‹ã«ã¯IDã¨ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãŒå¿…è¦ã§ã™ã‚ˆãã€‚ ä¾‹ãˆã°ã€Amazonã‚„æ¥½å¤©å¸‚å ´ã§è²·ç‰©ã‚’ã™ã‚‹ã«ã¯ã€Amazonã‚„æ¥½å¤©å¸‚å ´ã®IDã¨ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’å…¥åŠ›ã™ã‚‹å¿…è¦ãŒã‚ã‚Šã¾ã™ã€‚ ã©ã¡ã‚‰ã‹ãŒæ¬ ã‘ã¦ã‚‚è²·ã„ç‰©ã¯ã§ãã¾ã›ã‚“ã€‚ ã‚ãªãŸä»¥å¤–ã®ç¬¬ä¸‰è€…ãŒã‚ãªãŸã®IDã‚’çŸ¥ã£ãŸã¨ã—ã¦ã‚‚ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãŒã‚ã‹ã‚‰ãªã‘ã‚Œã°ã€ã‚ãªãŸã®åå‰ã§å‹æ‰‹ã«è²·ã„ç‰©ã‚’ã™ã‚‹ã“ã¨ã¯ã§ããªã„ã‚ã‘ã§ã™ã€‚ ã“ã‚Œã«ã‚ˆã£ã¦å®‰å…¨ãŒå®ˆã‚‰ã‚Œã¦ã„ã‚‹ã‚ã‘ã§
papiro 2014/10/26
OpenSSL

è„†å¼±æ€§

ssl

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

security
ãƒªãƒ³ã‚¯
è‡ªå •è½ãªæŠ€è¡“è€…ã®æ—¥è¨˜ : POODLEæ”»æ’ƒã«ã¤ã„ã¦æœ¬å½“ã«TLSv1.0ãªã‚‰å®‰å…¨ãªã®ã‹ï¼Ÿ - livedoor Blogï¼ˆãƒ–ãƒã‚°ï¼‰
åŸºæœ¬ã¯å–°ã£ã¦ã‚‹ã‹é£²ã‚“ã§ã‚‹ã‹ã§ã™ãŒã€ã‚ˆãè¶£å‘³ã§ã‚«ãƒ©ã‚ªã‚±ãƒ»PKIãƒ»ç½²åãƒ»èªè¨¼ãƒ»ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°ãƒ»æƒ…å ±ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚’ã‚„ã£ã¦ã„ã¾ã™ã€‚æ—…å¥½ãã€‚ãƒ†ãƒ¬ãƒ“å¥½ãã§èŠ¸èƒ½é€š POODLEæ”»æ’ƒã¯ã€é‹ç”¨æ³£ã‹ã›ã¨ã„ã†ã‹ã€SSLv3ã®ã‚µãƒãƒ¼ãƒˆã‚’æœ¬å½“ã«åˆ‡ã£ã¡ã‚ƒã£ã¦ã„ã„ã®ã‹ã€ãƒ¬ã‚¬ã‚·ãƒ¼ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã«ã¤ã„ã¦å¯¾å¿œã™ã‚‹ã®ãŒã„ã„ã®ã‹ã€æ‚©ã‚€æ‰€ã§ã™ã‚ˆãã€‚ShellShocké¨’ãŽã•ãˆã¾ã ã†ã¡ã§ã¯åŽæŸã—ã¦ã„ãªã„ã®ã«ãƒ»ãƒ»ãƒ» POODLEæ”»æ’ƒã¯ã€ã€ŒSSLv3ã®å•é¡Œã§ã‚ã£ã¦TLSv1.0ä»¥ä¸Šã§ã¯(ãƒ‘ãƒ‡ã‚£ãƒ³ã‚°ã®æ–¹æ³•ãŒé•ã†ã®ã§)å½±éŸ¿ãŒç„¡ã„ã€ã¨ã•ã‚Œã¦ã„ã¾ã™ãŒã€nahiã•ã‚“ã‹ã‚‰ã‚³ãƒ¡ãƒ³ãƒˆã‚‚ã‚‰ã£ã¦ã€Œå®Ÿè£…ä¾å˜ã ã‘ã©TLSv1.0ã§ã‚‚å±é™ºãªå®Ÿè£…ãŒã‚ã‚‹ã‚“ã˜ã‚ƒãªã„ã®ï¼Ÿã€ã¨ã„ã†ã“ã¨ã§ã€ãã®äº‹ã‚’æ›¸ã„ã¦ã¿ãŸã„ã¨æ€ã„ã¾ã™ã€‚ ä»Šå›žã®POODLEæ”»æ’ƒã«ã¤ã„ã¦ã¯ã€ä½•ãŒå•é¡Œã§ã©ã®ã‚ˆã†ã«ã™ã‚Œã°æ”»æ’ƒã§ãã‚‹ã®ã‹ã¨ã„ã†ã€è©³ã—ã„å›³å…¥ã‚Šã®ç´ æ™´ã‚‰ã—ãåˆ¤ã‚Šã‚„ã™ã„è§£èª¬ã‚’ãƒ¢ãƒã‚²ãƒ¼ã•ã‚“ãŒ ã€ŒSSL v3.
papiro 2014/10/26
POODLE

ssl
ãƒªãƒ³ã‚¯
è‡ªå •è½ãªæŠ€è¡“è€…ã®æ—¥è¨˜ : æ§˜ã€…ãªã‚µãƒ¼ãƒãƒ¼ã®POODLE SSLv3è„†å¼±æ€§(CVE-2014-3566)å¯¾ç–ã®ã¾ã¨ã‚(æ›´æ–°3) - livedoor Blogï¼ˆãƒ–ãƒã‚°ï¼‰
åŸºæœ¬ã¯å–°ã£ã¦ã‚‹ã‹é£²ã‚“ã§ã‚‹ã‹ã§ã™ãŒã€ã‚ˆãè¶£å‘³ã§ã‚«ãƒ©ã‚ªã‚±ãƒ»PKIãƒ»ç½²åãƒ»èªè¨¼ãƒ»ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°ãƒ»æƒ…å ±ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚’ã‚„ã£ã¦ã„ã¾ã™ã€‚æ—…å¥½ãã€‚ãƒ†ãƒ¬ãƒ“å¥½ãã§èŠ¸èƒ½é€š ã‚‚ãã˜ 1. ã¯ã˜ã‚ã« 2. SSLv3ã‚’ç„¡åŠ¹åŒ–ã§ãã‚‹å ´åˆã®ã‚µãƒ¼ãƒãƒ¼å¯¾ç– 2.1. Apache HTTPD Server + mod_ssl 2.2. Apache HTTPD Server + mod_nss 2.3. nginx 2.4. lighttpd 2.5. Microsoft IIS 2.6. (è¨‚æ£)Apache Tomcat (Java JSSE) 2.7. Node.js 2.8. IBM HTTP Server 2.9. Amazon Web Services 2.10. ãã®ä»–ã®ã‚µãƒ¼ãƒãƒ¼ 2.11. SSLv3 ã‚’ç„¡åŠ¹åŒ–ã™ã‚‹ãƒªã‚¹ã‚¯ 2.12. OpenLDAP 3. è«¸èˆ¬ã®äº‹æƒ…ã§ SSLv3 ã‚’æœ‰åŠ¹ã«ã›ã–ã‚‹ã‚’å¾—ãªã„å ´
papiro 2014/10/18
ã‚‚ã†ã‚„ã‚ã¦ãƒ»ãƒ»ãƒ»

SSL

è„†å¼±æ€§

Apache

security

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

POODLE

TLS
ãƒªãƒ³ã‚¯
SSLå…¬é–‹éµã¨ç§˜å¯†éµãƒšã‚¢ã®ç¢ºèªæ–¹æ³• | ãƒ¡ãƒ¢ï¼ ã‚¹ãƒŠã‚¬ãƒ©ãƒœ
SSLã®ç§˜å¯†éµãƒ»å…¬é–‹éµãƒšã‚¢ç¢ºèªã®æ–¹æ³• $ openssl x509 -in public.crt -noout -modulus $ openssl rsa -in private.key -noout -modulus ãŒä¸€è‡´ã™ã‚Œã°OKã€‚
papiro 2014/08/13
modulusã®æ¯”è¼ƒãŒä¸€ç•ªç°¡å˜ã‹

OpenSSL

SSL

PKI
ãƒªãƒ³ã‚¯
æ ¼å®‰SSLã‚µãƒ¼ãƒãƒ¼è¨¼æ˜Žæ›¸ã¯joeâ€™ï½“SSLå¸‚å ´/å…¬å¼
ä¼æ¥ã®å®Ÿåœ¨æ€§ãƒ»ä¿¡é ¼æ€§ ãƒ•ã‚£ãƒƒã‚·ãƒ³ã‚°è©æ¬ºå¯¾ç– é«˜ã„ä¿¡é ¼æ€§ EVã‚¿ã‚¤ãƒ—èªè¨¼ å›½å†…å¤–ã®æœ‰åãƒ–ãƒ©ãƒ³ãƒ‰ã‚’å–ã‚Šæƒãˆã¦ã„ã¾ã™ã®ã§ã€çŸ¥ååº¦ã‚„ãƒ¦ãƒ¼ã‚¶ãƒ¼èªçŸ¥çŽ‡ã‹ã‚‰ãŠé¸ã³ã„ãŸã ã‘ã¾ã™ã€‚
papiro 2009/09/23
ã‚µãƒ¼ãƒè¨¼æ˜Žæ›¸è³¼å…¥

SSL
ãƒªãƒ³ã‚¯
1