[B! openssl] wushiã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

wushi id:wushi

opensslã«é–¢ã™ã‚‹wushiã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (11)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

Apache + OpenSSL ä¸é–“CAè¨¼æ˜Žæ›¸ã®ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«æ‰‹é †
ä¸é–“CAè¨¼æ˜Žæ›¸ã¯CertCentralã‚ˆã‚Šãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ã—ã¦ãã ã•ã„ã€‚ å‚è€ƒï¼šã‚µãƒ¼ãƒIDã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«æ‰‹é † ï¼ˆ-----BEGIN CERTIFICATE-----ï¼‰ã€€ã‹ã‚‰ã€€ï¼ˆ-----END CERTIFICATE-----ï¼‰ã€€ã¾ã§ã‚’ã‚³ãƒ”ãƒ¼ã—ã€ãã®ã¾ã¾ãƒ†ã‚ã‚¹ãƒˆã‚¨ãƒ‡ã‚£ã‚¿ã«è²¼ã‚Šä»˜ã‘ã¾ã™ã€‚ ä¸é–“CAè¨¼æ˜Žæ›¸ä¿å˜ä¾‹ è²¼ã‚Šä»˜ã‘å®Œäº†å¾Œã€ä¸é–“CAè¨¼æ˜Žæ›¸ãƒ•ã‚¡ã‚¤ãƒ«ã¨ã—ã¦ä»»æ„ã®ãƒ•ã‚¡ã‚¤ãƒ«åã§ä¿å˜ã—ã¾ã™ã€‚ ä¾‹ï¼šã€€intermediate.crt ä¿å˜ã—ãŸä¸é–“CAè¨¼æ˜Žæ›¸ãƒ•ã‚¡ã‚¤ãƒ«ã‚’è¨å®šãƒ•ã‚¡ã‚¤ãƒ«ã§æŒ‡å®šã—ã¾ã™ã€‚
wushi 2024/10/02
tls

ssl

apache

openssl
ãƒªãƒ³ã‚¯
Better Random Number Generation for OpenSSL, libc, and Linux Mainline | Amazon Web Services
AWS Open Source Blog Better Random Number Generation for OpenSSL, libc, and Linux Mainline ä¸æ–‡ç‰ˆ In 2015, AWS introduced s2n, a new open source implementation of the TLS/SSL protocols that protect the privacy and integrity of data moving over a network. s2n was designed to be secure, simple, small, and fast. The project is thriving, and we use it extensively. In February, our CISO Stephen Schmidt sh
wushi 2017/11/26
openssl

aws
ãƒªãƒ³ã‚¯
TLS1.3ã¨DCå†…ã§ã®å¾©å·ã«é–¢ã™ã‚‹ç†±ã„è°è«– - ASnoKaze blog
å„ãƒ–ãƒ©ã‚¦ã‚¶ã‚„ã€OpenSSLãƒ»BoringSSLã¨ã„ã£ãŸæš—å·ãƒ©ã‚¤ãƒ–ãƒ©ãƒªã€ãƒŸãƒ‰ãƒ«ã‚¦ã‚§ã‚¢ã®TLS1.3å¯¾å¿œãŒé€²ã‚“ã§ãŠã‚Šã€å®Ÿéš›ã«é€šä¿¡ã§ãã‚‹ã¨ã“ã‚ã¾ã§æ¥ã¦ã„ã‚‹ã€‚ æ¨™æº–åŒ–ã¨ã—ã¦ã‚‚å¤§è©°ã‚ã‚’è¿Žãˆã¦ã„ã‚‹ã€‚ å‰å›žã®IETFã‚ˆã‚Šè©±é¡Œã«ä¸ŠãŒã£ã¦ã„ã‚‹ã€TLS1.3ã«é–¢ã™ã‚‹DCå†…ã§ã®å¾©å·ã‚’ç›®çš„ã¨ã—ãŸè°è«–ã«ã¤ã„ã¦ã€æ–°ã—ãã€ŒTLS 1.3 Option for Negotiation of Visibility in the Datacenterã€ã¨ã„ã†æ‹¡å¼µä»•æ§˜ãŒå‡ºã¦ã„ã‚‹ã€‚ ã“ã‚ŒãŒå‰²ã‚Šã¨ç››ã‚Šä¸ŠãŒã£ã¦ã„ã‚‹ã®ã§ç°¡å˜ã«æ•´ç†ã™ã‚‹ TLS1.3 æ‹¡å¼µä»•æ§˜ã®è©±ã«å…¥ã‚‹å‰ã«ã€ç°¡å˜ã«TLS1.3ã®ç¾çŠ¶ã«ã¤ã„ã¦è§¦ã‚Œã‚‹ã€‚ TLS1.3ã¯ã€0-RTTãƒãƒ³ãƒ‰ã‚·ã‚§ã‚¤ã‚¯ã®ã‚µãƒãƒ¼ãƒˆã¨ã„ã£ãŸãƒ‘ãƒ•ã‚©ãƒ¼ãƒžãƒ³ã‚¹ã®æ”¹å–„ã¨ã€å¤šãã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æ”¹å–„ãŒå…¥ã£ãŸTLSã®æ¬¡æœŸãƒãƒ¼ã‚¸ãƒ§ãƒ³ã§ã‚ã‚‹ã€‚ ä»•æ§˜ã¨ã—ã¦ã‚‚é•·ã„é–“è°è«–ã•ã‚Œã¦ãŠã‚Šã€draft-21ã¾ã§å‡ºã¦ã„ã‚‹ã€‚ãƒ©ã‚¹ãƒˆã‚³ãƒ¼ãƒ«ã¾
wushi 2017/10/07
security

æš—å·åŒ–

tls

OpenSSL
ãƒªãƒ³ã‚¯
OpenSSL disables TLS 1.0 and 1.1
To: [email protected] Subject: OpenSSL disables TLS 1.0 and 1.1 From: Kurt Roeckx <[email protected]> Date: Mon, 7 Aug 2017 03:42:39 +0200 Message-id: <[ðŸ”Ž]Â 20170807014238.mf64rdvgpdkpai [email protected]> Mail-followup-to: [email protected] Hi, I've just uploaded a version of OpenSSL to unstable that disables the TLS 1.0 and 1.1 protocol. This currently leaves TLS 1.2 as t
wushi 2017/08/09
openssl

Linux

SSL

TLS
ãƒªãƒ³ã‚¯
SSLã®è„†å¼±æ€§ã§æ—¥æœ¬ã®å¤§æ‰‹ã‚µã‚¤ãƒˆã‚’å«ã‚€å…¨ä¸–ç•Œ1100ä¸‡ä»¥ä¸Šã®HTTPSã‚µã‚¤ãƒˆãŒæ”»æ’ƒã‚’å—ã‘å¾—ã‚‹ã¨åˆ¤æ˜Ž
SSL/TLSã«ã‚ˆã£ã¦é€šä¿¡ã‚’æš—å·åŒ–ã—ã¦ã„ã‚‹HTTPSã‚µã‚¤ãƒˆã«ç°¡å˜ã«æ”»æ’ƒã•ã‚Œã‚‹è„†å¼±æ€§ãŒã‚ã‚‹ã“ã¨ãŒã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ç ”ç©¶è€…ã«ã‚ˆã£ã¦ç™ºè¡¨ã•ã‚Œã¾ã—ãŸã€‚ã“ã®è„†å¼±æ€§ã‚’ã¤ã„ãŸæ”»æ’ƒã€ŒDROWNã€ã‚’å—ã‘ã‚‹å¯èƒ½æ€§ãŒã‚ã‚‹ã‚µã‚¤ãƒˆã«ã¯ã€æ¯Žæ—¥æ–°èžã€ä»»å¤©å ‚ã€ã¯ã¦ãªã€LINEãªã©ã®æ—¥æœ¬ã®å¤§æ‰‹ã‚µã‚¤ãƒˆã‚‚å«ã¾ã‚Œã¦ã„ã¾ã™ã€‚ DROWN: Breaking TLS using SSLv2.pdf (PDFãƒ•ã‚¡ã‚¤ãƒ«)https://drownattack.com/drown-attack-paper.pdf DROWN Attack https://drownattack.com/ ã€ŒDecrypting RSA with Obsolete and Weakened eNcryption(DROWN)ã€ã¯SSLv2ã«å«ã¾ã‚Œã‚‹è„†å¼±æ€§ã§ã€ã“ã®è„†å¼±æ€§ã‚’æ‚ªç”¨ã•ã‚Œã‚‹ã¨ã‚¯ãƒã‚¹ãƒ—ãƒãƒˆã‚³ãƒ«æ”»æ’ƒã«ã‚ˆã£ã¦TLSã‚»ãƒƒã‚·ãƒ§ãƒ³ã®æš—å·åŒ–ãŒè§£é™¤(å¾©å·)ã•ã‚Œã¦é€šä¿¡ãŒå‚å—
wushi 2016/03/03
security

SSL

tls

openssl
ãƒªãƒ³ã‚¯
OpenSSLã«ã¾ãŸé‡åº¦ã®æ¬ é™¥ã€ä¿®æ£ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆã¯3æœˆ19æ—¥ã«ãƒªãƒªãƒ¼ã‚¹
CodeZineç·¨é›†éƒ¨ã§ã¯ã€ç¾å ´ã§æ´»èºã™ã‚‹ãƒ‡ãƒ™ãƒãƒƒãƒ‘ãƒ¼ã‚’ã‚¹ã‚¿ãƒ¼ã«ã™ã‚‹ãŸã‚ã®ã‚«ãƒ³ãƒ•ã‚¡ãƒ¬ãƒ³ã‚¹ã€ŒDevelopers Summitã€ã‚„ã€ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã®ç”Ÿãã–ã¾ã‚’ãƒ–ãƒ¼ã‚¹ãƒˆã™ã‚‹ãŸã‚ã®ã‚¤ãƒ™ãƒ³ãƒˆã€ŒDevelopers Boostã€ãªã©ã€ã•ã¾ã–ã¾ãªã‚«ãƒ³ãƒ•ã‚¡ãƒ¬ãƒ³ã‚¹ã‚’ä¼ç”»ãƒ»é‹å–¶ã—ã¦ã„ã¾ã™ã€‚
wushi 2015/03/19
security

openssl
ãƒªãƒ³ã‚¯
æŠ€è¡“/Security/PKI,SSL,TLS/ãƒ¡ãƒ¢01_æ‹¡å¼µåã®è¿·å®®(pem,der,crt,cer,csr,...) - Glamenv-Septzen.net
ãƒ›ãƒ¼ãƒ æ¤œç´¢Â - ãƒã‚°ã‚¤ãƒ³ | |Â Â ãƒ˜ãƒ«ãƒ— æŠ€è¡“/Security/PKI,SSL,TLS/ãƒ¡ãƒ¢01_æ‹¡å¼µåã®è¿·å®®(pem,der,crt,cer,csr,...) [Â PrevÂ ] [Â NextÂ ] [Â æŠ€è¡“Â ] OpenSSLã‚„PKIå‘¨ã‚Šã‚’èª¿ã¹ã¦ã„ã‚‹ã¨ã€æ‹¡å¼µåãŒè‰²ã€…å‡ºã¦ãã¦æ··ä¹±ã—ãŸã®ã§æ•´ç†ã—ã¾ã—ãŸã€‚ ç‰¹ã«X509è¨¼æ˜Žæ›¸é–¢é€£ã«ã¤ã„ã¦ã¯ã€ä»¥ä¸‹ã®Wikiãƒšãƒ¼ã‚¸ã‚’å‚è€ƒã«ã—ã¦ã„ã¾ã™ã€‚ X.509 - Wikipedia, the free encyclopedia http://en.wikipedia.org/wiki/X.509 PKCS - Wikipedia, the free encyclopedia http://en.wikipedia.org/wiki/PKCS é »å‡ºæ‹¡å¼µåã®æ•´ç† .pem(PEM, Privacy Enhanced Mail) Base64ç¬¦å·åŒ–ã‚’ä½¿ã£ãŸãƒ‡ãƒ¼ã‚¿
wushi 2014/05/22
security

openssl

ssl
ãƒªãƒ³ã‚¯
ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆè¨¼æ˜Žæ›¸ã®ç™ºè¡Œ
ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆè¨¼æ˜Žæ›¸ã®ç™ºè¡Œ 2003/6/11ä½œæˆ 2004/9/19æ›´æ–° ç¶šã„ã¦ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆè¨¼æ˜Žæ›¸ã‚’ç™ºè¡Œã—ã¾ã—ã‚‡ã†ã€‚ ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆè¨¼æ˜Žæ›¸ã¨ã¯ã€å€‹äººã‚„æ©Ÿå™¨ã‚’ç‰¹å®šã™ã‚‹è¨¼æ˜Žæ›¸ã®ã“ã¨ã§ã™ã€‚ verisignã¨ã‹ã§ã¯å€‹äººè¨¼æ˜Žæ›¸ãªã©ã¨å‘¼ã°ã‚Œã¦ã„ã¾ã™ã€‚ é€”ä¸ã¾ã§ã¯ã‚µãƒ¼ãƒè¨¼æ˜Žæ›¸ã®ç™ºè¡Œã¨å¤‰ã‚ã‚Šã¾ã›ã‚“ã€‚ ä½™è«‡ã§ã™ãŒã€ã€Œã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆè¨¼æ˜Žæ›¸ã€ã§googleã™ã‚‹ã¨ã€å¤šãã®æœ‰åã‚µã‚¤ãƒˆã‚’æŠ¼ã—ã®ã‘ã¦ã“ã®ãƒšãƒ¼ã‚¸ãŒä¸€ç•ªã«è¡¨ç¤ºã•ã‚Œã¦ã—ã¾ã„ã¾ã—ãŸã€‚ è¤‡é›‘ã§ã™ã€‚ ï¼‘ï¼Žã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆè¨¼æ˜Žæ›¸ç™ºè¡Œã®æµã‚Œ ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆè¨¼æ˜Žæ›¸ã‚’ç™ºè¡Œã™ã‚‹ã¾ã§ã®æµã‚Œã¯ç°¡å˜ã«ã“ã‚“ãªæ„Ÿã˜ã§ã™ã€‚ ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆç§˜å¯†éµã‚’ä½œæˆ ç§˜å¯†éµã‹ã‚‰CSRã‚’ç”Ÿæˆ CAã®ç§˜å¯†éµã§CSRã«ç½²åã—ã¦è¨¼æ˜Žæ›¸ã‚’ä½œæˆ æœ€çµ‚çš„ã«ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã«ã¯ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆç§˜å¯†éµã¨ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆè¨¼æ˜Žæ›¸ã®ãƒšã‚¢ã¨ã€CAã®è¨¼æ˜Žæ›¸ãŒã‚ã‚Œã°ã„ã„ã®ã§ã™ãŒã€ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆãŒWindowsã®å ´åˆã€ç§˜å¯†éµã¨CSRã‚’ä½œæˆã™ã‚‹ã®ã¯
wushi 2013/08/23
pki

ssl

openssl
ãƒªãƒ³ã‚¯
mod_sslã®çµ„ã¿è¾¼ã¿æ–¹æ³•
wushi 2011/12/13
apache 1.3+mod_ssl

apache

openssl
ãƒªãƒ³ã‚¯
Apache2 ã‚’ SSL ã«å¯¾å¿œ
Apache2 ã‚’ SSL ã«å¯¾å¿œ Secure Sockets Layer (SSL) ãƒ–ãƒ©ã‚¦ã‚¶ãƒ¼ã¨ Web ã‚µãƒ¼ãƒãƒ¼(httpd)ã¨ã®é€šä¿¡ã¯ã€Hyper Text Transfer Protcol (HTTP) ã¨å‘¼ã°ã‚Œã‚‹ãƒ—ãƒãƒˆã‚³ãƒ«ã§ãƒ‡ãƒ¼ã‚¿ã‚’ã‚„ã‚Šå–ã‚Šã—ã¾ã™ã€‚ã—ã‹ã—ã€ç”Ÿãƒ‡ãƒ¼ã‚¿ãŒæµã‚Œã‚‹ãŸã‚ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã‚·ãƒ§ãƒƒãƒ”ãƒ³ã‚°ç‰ã‚’ã™ã‚‹éš›ã«ã€å€‹äººæƒ…å ±ãŒæ¼ã‚Œã‚‹ãªã©ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ¼ä¸Šä¸å…·åˆãŒç”Ÿã˜ã¾ã™ã€‚ãã“ã§ã€ãƒ‡ãƒ¼ã‚¿ã‚’æš—å·åŒ–ã™ã‚‹ Secure Sockets Layer (SSL)ã¨ã„ã†ä»•çµ„ã¿ãŒè€ƒãˆã‚‰ã‚Œã¾ã—ãŸã€‚ Apache 2.0 ã‚’ SSLå¯¾å¿œã«ã™ã‚‹ãŸã‚ã«å¿…è¦ãªãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ« ä¸Šè¨˜ã®ãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ã‚’ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ã—ã¦ SSLå¯¾å¿œã® Apache ã‚’ä½œã‚‹å ´åˆã€ã‚½ãƒ¼ã‚¹ãã®ã‚‚ã®ãŒæ”¹ã–ã‚“ã•ã‚Œã¦ã„ãªã„ã‹ãƒã‚§ãƒƒã‚¯ã—ã¦ãŠãã¨è‰¯ã„ã§ã—ã‚‡ã†ã€‚MD5, PGP Signatures ãŒç”¨æ„ã•ã‚Œã¦ã„ã‚‹ã®ã§ã€æ”¹ã–ã‚“ã•ã‚Œã¦ã„ãªã„ã‹ãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ã‚’
wushi 2011/12/13
Apache 2.0+mod_ssl(static)+OpenSSL

apache

openssl
ãƒªãƒ³ã‚¯
ã€6ã€‘ï¼³ï¼³ï¼¬å¯¾å¿œ Apache ã®ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«/ã‚µãƒ¼ãƒãƒ¼ç®¡ç†è€…è«–
wushi 2011/12/13
Apache 1.3ç³»mod_ssl

apache

openssl
ãƒªãƒ³ã‚¯
1