サーバ証明書の作成


Webサイト等，SSLで通信するためにはサーバ証明書を用意する必要がある．
以下の手順で，RSA秘密鍵，および証明書を作成することが出来る．

## RSA秘密鍵，CSR (Certificate Signing Request: 証明書署名要求)の作成

暗号化なしのRSA秘密鍵(server.key)とCSR(server.csr)を纏めて作成する．
作成したCSRは第三者(e.g., [シマンテック・ウェブサイトセキュリティ](https://www.jp.websecurity.symantec.com))に署名して貰う必要がある．

```shell-session
walnut@example $ openssl req -out server.csr -newkey rsa:2048 -keyout server.key -nodes -sha256
Generating a 2048 bit RSA private key
.................................................................................................................................................+++
...............................................................................+++
writing new private key to 'server.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg, YOUR name) []:www.example.jp
```

## RSA秘密鍵，X.509自己署名証明書の作成

暗号化なしのRSA秘密鍵(server.key)とX.509自己署名証明書(server.crt)，いわゆるオレオレ証明書を纏めて作成する．

```shell-session
walnut@example $ openssl req -out server.crt -newkey rsa:2048 -keyout server.key -nodes -sha256 -x509 -days 365
Generating a 2048 bit RSA private key
.................................................................................................................................................+++
...............................................................................+++
writing new private key to 'server.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg, YOUR name) []:www.example.jp
```

## RSA秘密鍵，CSR，およびX.509自己署名証明書を個別に作成

### RSA秘密鍵の作成

作成したRSA秘密鍵は暗号化されており，プログラムの起動時にパスフレーズを入力する必要がある．このため以下の手順で復号化する．また、RSA秘密鍵のパスフレーズを変更する場合も同様．

```shell-session
walnut@example $ openssl genrsa -out server.key [-aes256] 2048
Generating RSA private key, 2048 bit long modulus
.+++
...............+++
e is 65537 (0x10001)
Enter pass phrase for server.key:
Verifying - Enter pass phrase for server.key:

$ openssl req -new -key server.key -out server.csr
```

### CSRの作成

````shell-session
walnut@example $ openssl req -new -key server.key -out server.csr
````

### X.509自己署名証明書の作成

予め作成されたRSA秘密鍵に対しX.509自己署名証明書を作成する．

```shell-session
walnut@example $ openssl req -out server.crt -new -key server.key -x509 -days 365
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg, YOUR name) []:www.example.jp
```

## CSRを確認

作成したCSRの内容は以下のコマンドで確認することが出来る．

```shell-session
walnut@example $ openssl req -in server.csr -text -noout
Certificate Request:
    Data:
        Version: 0 (0x0)
        Subject: CN=www.example.jp
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (2048 bit)
                Modulus (2048 bit):
                    00:ca:61:d1:b3:1c:1a:38:f5:cd:d9:2f:56:26:7f:
                    74:14:86:49:7f:05:7a:6c:63:61:0b:e7:45:2e:a4:
                    a7:f1:ae:b9:06:35:ad:5d:ff:2e:49:a5:b6:d1:d1:
                    7e:2c:72:e1:fa:59:b6:86:ee:9a:61:83:41:5a:46:
                    b2:a2:ec:61:5e:09:08:37:db:01:07:4c:09:1b:78:
                    02:f3:5c:88:5a:ba:f9:93:d5:46:45:73:56:67:4d:
                    51:cf:1d:08:32:8f:1c:94:43:62:dd:e3:0b:7a:b1:
                    26:79:ca:2e:75:a7:6e:a5:2b:7c:84:d4:fe:61:a1:
                    5c:ba:33:f0:4e:04:3c:01:26:07:df:d1:e9:99:97:
                    2a:5b:d2:88:0e:30:39:a2:15:ad:08:f0:c1:d5:ed:
                    ac:83:80:8a:72:49:9b:20:81:c0:32:52:c5:de:a1:
                    8c:e5:8d:ee:d9:21:6d:4d:84:66:0b:d6:5e:5a:04:
                    16:35:7f:1e:4b:e9:83:83:78:59:24:dd:04:8e:1c:
                    b7:eb:5e:82:ad:02:c3:2b:e6:37:c8:93:6b:64:a0:
                    d8:3e:2b:cd:e4:5b:d7:d6:35:51:41:92:95:15:05:
                    8a:af:06:2d:7a:19:b1:a6:7e:12:7e:f6:9f:e7:33:
                    52:46:3b:f5:35:42:9a:fe:50:5b:ca:08:8a:5f:7b:
                    2f:77
                Exponent: 65537 (0x10001)
        Attributes:
            a0:00
    Signature Algorithm: sha1WithRSAEncryption
        67:90:56:d3:75:83:45:8e:82:3d:38:d3:44:ae:03:5b:68:5f:
        9d:64:a5:0e:5c:38:a4:ef:32:ea:d9:08:01:2d:91:d2:79:84:
        ac:9d:60:13:d4:20:49:b0:9a:2f:c6:2b:85:87:a3:3a:d5:89:
        02:ab:01:c0:3b:00:96:5b:29:2c:aa:09:c6:ac:29:6b:ca:37:
        31:2c:6f:27:ea:60:96:26:1a:df:48:01:3b:1e:24:65:45:cc:
        2b:71:27:fa:08:7d:f4:d8:66:3d:c0:6e:a0:21:b8:64:a8:6e:
        ac:b1:43:9e:f5:20:65:50:33:6b:fb:f3:42:6d:6d:0f:5e:80:
        90:32:d0:00:d2:dc:7d:85:28:4d:45:57:72:29:98:86:32:c4:
        56:a2:ac:c7:37:ec:86:94:91:87:50:4e:f3:5f:be:16:98:a7:
        0e:d6:de:9d:92:6d:7e:11:b9:3b:17:fb:1a:c2:b2:90:9f:f8:
        14:bc:f7:bb:0a:f8:92:14:6a:ed:5d:b9:a4:11:43:aa:ee:a5:
        36:2b:32:8b:73:2f:9b:ea:22:fd:74:61:64:3c:8c:1b:0e:5f:
        dd:75:63:7a:5e:a3:0c:0f:57:0b:98:95:39:39:44:5a:8e:cd:
        94:ac:92:f1:bc:dd:7e:1c:03:31:78:bf:c4:44:64:28:f8:43:
        5e:fe:cc:2e
```

## X.509証明書を確認

作成したX.509証明書の内容は以下のコマンドで確認することが出来る．

```shell-session
walnut@example $ openssl x509 -in server.crt -text -noout
Certificate:
    Data:
        Version: 1 (0x0)
        Serial Number:
            b5:6d:8a:eb:e1:3b:2c:0c
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: CN=www.example.jp
        Validity
            Not Before: Jul 27 02:06:54 2010 GMT
            Not After : Jul 27 02:06:54 2011 GMT
        Subject: CN=www.example.jp
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (2048 bit)
                Modulus (2048 bit):
                    00:e2:1d:b7:ed:06:fb:c5:a2:3f:b4:91:18:87:e9:
                    0c:3f:69:08:b4:7f:f0:0f:61:cf:68:f9:87:ad:b9:
                    ca:11:2e:ce:d7:42:70:e3:e1:f0:d6:ea:e0:b0:13:
                    df:62:7d:07:ac:ed:e8:d4:19:62:bd:8e:83:7b:fe:
                    b6:f0:93:c2:99:cf:aa:c8:4f:ec:29:e0:b9:1d:a3:
                    42:c2:4d:ba:43:00:21:b8:c0:b6:fb:fa:50:01:19:
                    02:95:49:fc:be:ae:2f:d7:45:ff:e5:45:fd:0b:c2:
                    82:30:30:bb:34:02:1a:57:69:58:65:4d:df:a6:f3:
                    02:9f:95:65:15:91:de:5f:db:25:9a:83:c0:d3:0e:
                    2d:73:11:76:49:90:fd:07:df:05:ad:9d:a8:a6:09:
                    10:ed:c7:70:d4:d8:88:9b:4a:b0:d3:bb:ea:a8:8a:
                    76:a2:1f:14:eb:b6:46:e1:fd:f1:e5:d2:57:e0:1c:
                    d7:51:f7:35:52:15:7b:33:60:b4:d7:b0:eb:a5:f1:
                    13:1f:20:e4:b7:fd:4c:d0:d4:aa:dc:90:ea:28:76:
                    bc:00:12:ce:be:16:45:f9:3c:88:c1:33:e6:78:36:
                    8b:f3:f0:cd:f2:bd:82:4a:9a:79:76:f9:35:12:5d:
                    dc:a8:6a:e4:e3:ab:47:af:17:11:8b:b1:8c:51:f4:
                    67:b9
                Exponent: 65537 (0x10001)
    Signature Algorithm: sha1WithRSAEncryption
        2b:55:51:bb:d0:78:a1:75:12:31:fb:dd:86:7a:86:4a:1a:c0:
        28:30:2f:4e:9a:c3:1d:5e:b9:73:ca:d4:25:f3:f0:43:dc:ac:
        e1:27:30:ed:77:b1:63:58:9a:68:fa:90:27:87:d3:07:ae:87:
        7b:09:f6:f3:fd:0c:4f:95:50:b9:69:83:f5:56:da:e9:f0:f5:
        54:e7:4a:8c:37:0d:4e:2f:33:af:55:3e:5d:86:37:7b:f4:a9:
        e5:ab:74:dd:b8:97:ab:2a:f9:c3:d2:3f:54:f3:66:23:80:83:
        a6:54:28:d5:2d:74:90:65:fa:cc:d9:64:07:ad:40:f5:45:9f:
        d2:88:c8:77:b4:60:92:ef:24:58:69:33:53:ad:7f:76:ff:eb:
        bc:21:b6:49:42:44:37:d1:da:13:b9:ca:a1:e1:5c:a9:74:02:
        ae:3b:e2:41:9d:19:04:85:2a:ac:36:ca:4e:d8:31:bd:d5:62:
        94:7f:f4:4c:9d:d8:c5:f6:3f:7c:cc:a7:bf:ac:53:94:f5:df:
        38:5b:73:87:0e:14:ac:19:df:22:5d:4e:f3:04:ff:07:a1:ff:
        31:60:d8:41:fd:69:5d:94:6d:fe:a0:75:64:12:80:c3:46:62:
        59:0a:69:84:1b:1d:76:81:d6:9e:a8:48:3b:d3:db:93:65:61:
        6f:48:cc:f9
```

## サーバに設置されている証明書の有効期限を確認

Webサイト等サーバに設置されているX.509証明書の有効期限は，以下のコマンドで確認することが出来る．

```shell-session
walnut@example $ echo | openssl s_client -connect www.example.jp:443 -showcerts | openssl x509 -dates -noout
depth=1 /O=VeriSign Trust Network/OU=VeriSign, Inc./OU=VeriSign International Se
rver CA - Class 3/OU=www.verisign.com/CPS Incorp.by Ref. LIABILITY LTD.(c)97 Ver
iSign
verify error:num=20:unable to get local issuer certificate
verify return:0
notBefore=Apr 30 00:00:00 2009 GMT
notAfter=Jun  7 23:59:59 2010 GMT
```

## PKCS#12形式から、証明書を取り出す方法

```shell-session
walnut@example $ openssl pkcs12 -in server.pfx -out server.txt
Enter Import Password:
MAC verified OK
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase: 
walnut@example $ sed -n '/BEGIN ENCRYPTED PRIVATE KEY/,/END ENCRYPTED PRIVATE KEY/p' server.txt > server.key
walnut@example $ sed -n '/BEGIN CERTIFICATE/,/END CERTIFICATE/p' server.txt > server.crt
```