openssl （ubuntu）

• openssl version
• openssl help
• openssl ciphers -v
• openssl speed

ssl certificates(証明書）

SSL certificates for server use

1. 自らサインするか(Certificate Authority:CAを作って）
2. Globally recognized authority signしてもらうか、できる

1. openssl toolkitで使用できるかあるいは
2. 暗号化SSL接続(HTTPサーバーなど）を可能とするライブラリーが使用できる。

generating and Signing Self-Signed Certificate

creating the certificate Authority

• ~/myCA :含CAcertificate,certificate database,generated certificates,Keys and requests
• ~/myCA/signedcerts :各署名された証明書のコピーを含む
• ~/myCA/private : private keyを含む。

# My sample caconfig.cnf file.
#
# Default configuration to use when one is not provided on the command line.
#
[ ca ]
default_ca      = local_ca
#
#
# Default location of directories and files needed to generate certificates.
#
[ local_ca ]
dir             = /home/********/myCA
certificate     = $dir/cacert.pem
database        = $dir/index.txt
new_certs_dir   = $dir/signedcerts
private_key     = $dir/private/cakey.pem
serial          = $dir/serial
#       
#
# Default expiration and encryption policies for certificates.
#
default_crl_days        = 365
default_days            = 1825
default_md              = md5
#       
policy          = local_ca_policy
x509_extensions = local_ca_extensions
#       
#
# Default policy to use when generating server certificates.  The following
# fields must be defined in the server certificate.
#
[ local_ca_policy ]
commonName              = supplied
stateOrProvinceName     = supplied
countryName             = supplied
emailAddress            = supplied
organizationName        = supplied
organizationalUnitName  = supplied
#       
#
# x509 extensions to use when generating server certificates.
#
[ local_ca_extensions ]
subjectAltName          = DNS:$$$$$$$$.myvnc.com
basicConstraints        = CA:false
nsCertType              = server
#       
#
# The default root certificate generation policy.
#
[ req ]
default_bits    = 2048
default_keyfile = /home/********/myCA/private/cakey.pem
default_md      = md5
#       
prompt                  = no
distinguished_name      = root_ca_distinguished_name
x509_extensions         = root_ca_extensions
#
#
# Root Certificate Authority distinguished name.  Change these fields to match
# your local environment!
#
[ root_ca_distinguished_name ]
commonName              = ********
stateOrProvinceName     = Fukuoka
countryName             = JA
emailAddress            = ********67@hotmail.com
organizationName        = ********Clinic
organizationalUnitName  = physician
#       
[ root_ca_extensions ]
basicConstraints        = CA:true

• ~/myCA/cacert.pem : CA public certificate
• ~/myCA/private/cakey.pem : CA private key

Creating a Self-signed Server Certificate

• server_crt.pem :Server application certificate file(証明書）
• Server_key.pem : Server application keyfile(鍵）

Optional Step for Certain Server Applications

Converting X.509 Certificate to PKCS#12 for Client Applications

Generating Certificate for Signing by Recognized CA

Using PCKS#12 Certificate in Client Applications

Importing a Certificate into Mozilla Firefox

1. Firefox から　Edit --> Preference(編集ー＞設定）
2. Advanced icon(詳細）
3. View Certificate button(証明書を表示）
4. Import button
5. Certificate fileの場所までbrowseする（.pfx file typeが典型的）
6. certificate fileをhighlightしopen button click
7. Password promptされるかもしれない。 -->enter, confirm,click OK
8. certificate Export password 入力がプロンプトされたらそれを入力するか泣ければOK
9. message" Successfully restored your security certificate(s) and private key(s)"
10. click OK
11. これでサーバーのclient PCKS#12 certificate（mycert.pem)　をfirefoxにインポートした。

Importing a Certificate into Evolution

Importing a Certificate into Mozilla Thunderbird

Importing a Certificate into the System-wide Certificate Authority Datebase

1. 証明書をコピー(端末で）
• ＄ sudo cp mycert.pem /usr/share/ca-certificates/mycert.crt
2. /etc/ca-certificates.cnf (ca-certificates configuration)を編集。　 /usr/share/ca-certificates にコピーしたファイル名をfinal"#"のすぐ後のリストのトップに付加する。
1. for example
   # This file lists certificates that you wish to use or to ignore to be installed in /etc/ssl/certs
   # update-ca-certificate(8) will update /etc/ssl/certs by reading this file.
   #
   # This is autogenerated by dpg-reconfigure ca-certificates.certificates should be installed under /usr/ca-certificate.and files with extension '.crt' is recognized as available certs.
   #
   # line begins with # is comment.line begins with ! is certificates filename to be deselected.
   #
   mycert.crt
   brasil.gov.br/brasil.gov.br.crt
   cacert.org/cacert.org.crt
   mozilla/ABAecom_=sub._Am._....
   [.....many additional certificates omitted]
   
3. $ sudo update-ca-certificate
4. systemCA証明書データベースに格入した。

Apache ssl