ACMのPrivate認証局を試してみる

###はじめに

ACMのプライベート認証局作成の手順メモです。

上位CAとなる認証局の作成　※EC2インスタンスなどで実施
ACMでPvivate CA作成
ACMでPrvate証明書作成

###上位CAとなる認証局を作成
Amazon Linuxで作成します。opensslの設定ファイルを編集します。
作成するサーバ証明書の期限が１年なのでdefault_daysを１年より長くする。
[ v3_ca ]のbasicConstraintsをcritical,CA:trueに設定する。

```
[root@ip-10-0-1-127 ~]# diff /etc/pki/tls/openssl.cnf /etc/pki/tls/openssl.cnf.bk
73c73
< default_days	= 3650			# how long to certify for
---
> default_days	= 365			# how long to certify for
223c223
< basicConstraints = critical,CA:true #[ v3_ca ]
---
> basicConstraints = CA:FALSE
```

criticalがないと証明書のインポート時に以下のエラーがでて失敗します。
![image.png](https://qiita-image-store.s3.amazonaws.com/0/78184/a8ce97c9-5e9c-fcf5-4189-8402ba7608e3.png)

ルートCAを作成します。

```
# /etc/pki/tls/misc/CA -newca
CA certificate filename (or enter to create)

Making CA certificate ...
Generating a 2048 bit RSA private key
.......................+++
..+++
writing new private key to '/etc/pki/CA/private/./cakey.pem'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:JP
State or Province Name (full name) []:Tokyo
Locality Name (eg, city) [Default City]:Meguro-ku
Organization Name (eg, company) [Default Company Ltd]:Company
Organizational Unit Name (eg, section) []:section
Common Name (eg, your name or your server's hostname) []:private-root-ca
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for /etc/pki/CA/private/./cakey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number:
            c2:0a:82:6f:c7:22:be:0c
        Validity
            Not Before: Jan  1 16:18:09 2019 GMT
            Not After : Dec 31 16:18:09 2021 GMT
        Subject:
            countryName               = JP
            stateOrProvinceName       = Tokyo
            organizationName          = Company
            organizationalUnitName    = section
            commonName                = private-root-ca
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                30:2A:9A:EF:6D:FC:29:40:16:75:D2:0F:AB:A3:F6:5A:90:12:B7:30
            X509v3 Authority Key Identifier: 
                keyid:30:2A:9A:EF:6D:FC:29:40:16:75:D2:0F:AB:A3:F6:5A:90:12:B7:30

            X509v3 Basic Constraints: critical
                CA:TRUE
Certificate is to be certified until Dec 31 16:18:09 2021 GMT (1095 days)

Write out database with 1 new entries
Data Base Updated
```

###プライベートCAを作成する
ACMのダッシュボードでCreate CAをクリックする。
![image.png](https://qiita-image-store.s3.amazonaws.com/0/78184/f3a04533-46ef-ad12-e752-3a28d399d9a1.png)

下位CAを選択してNext。
![image.png](https://qiita-image-store.s3.amazonaws.com/0/78184/c9c65d72-ec41-c2b5-24cb-947207ae762d.png)

ルートCAの設定値を記入する。
![image.png](https://qiita-image-store.s3.amazonaws.com/0/78184/6d2c86ed-2c22-7dfb-d381-9c3d85242ac3.png)

Next
![image.png](https://qiita-image-store.s3.amazonaws.com/0/78184/4a75834b-99fb-2461-88ac-f799588345de.png)

Next
![image.png](https://qiita-image-store.s3.amazonaws.com/0/78184/81f5b153-504e-19f6-8f75-bb82fb666f7a.png)

Confirm and create。
![image.png](https://qiita-image-store.s3.amazonaws.com/0/78184/3a9d3cb0-5cc9-4c70-ae91-f5a111665506.png)

###上位CAで下位CAの証明書を署名してインポート
![image.png](https://qiita-image-store.s3.amazonaws.com/0/78184/2aa36226-afa1-46dd-95dd-37714ba74ea6.png)

Import CA certificateをクリック。
![image.png](https://qiita-image-store.s3.amazonaws.com/0/78184/1b99d102-4e0b-7d3a-900a-8c0447226c43.png)

CSRファイルをダウンロードする。
![image.png](https://qiita-image-store.s3.amazonaws.com/0/78184/26c612dc-c296-5537-addc-84cd87395fa3.png)

###証明書を署名

CSRをリネームする。

```
mv /Downloads/CSR.pem newreq.pem 
```

証明書を署名する。

```
# /etc/pki/tls/misc/CA -signCA
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for /etc/pki/CA/private/cakey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number:
            c2:0a:82:6f:c7:22:be:0d
        Validity
            Not Before: Jan  1 16:19:03 2019 GMT
            Not After : Dec 29 16:19:03 2028 GMT
        Subject:
            countryName               = JP
            stateOrProvinceName       = Tokyo
            localityName              = Meguro-ku
            organizationName          = Company
            organizationalUnitName    = section
            commonName                = private-ca
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                36:B1:80:7C:B0:42:77:67:1A:9A:15:D7:7C:66:C0:68:86:7A:95:93
            X509v3 Authority Key Identifier: 
                keyid:30:2A:9A:EF:6D:FC:29:40:16:75:D2:0F:AB:A3:F6:5A:90:12:B7:30

            X509v3 Basic Constraints: critical
                CA:TRUE
Certificate is to be certified until Dec 29 16:19:03 2028 GMT (3650 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
Signed CA certificate is in newcert.pem
```

署名した証明書(newcert.pem)とCA証明書(cacert.pem)をコピペする。以下の箇所。

```
-----BEGIN CERTIFICATE REQUEST-----
略)
-----END CERTIFICATE REQUEST-----
```

![image.png](https://qiita-image-store.s3.amazonaws.com/0/78184/371377dc-79d1-5ed6-e482-21ae09e846ff.png)

Confirm and importをクリックする。
![image.png](https://qiita-image-store.s3.amazonaws.com/0/78184/a4144aa1-35e6-7f2b-5b16-c1d914e4297f.png)

![image.png](https://qiita-image-store.s3.amazonaws.com/0/78184/6d3b3eeb-a84d-77ce-a854-74e444b3c27c.png)

###private証明書の発行
Request a certificateをクリックする。
![image.png](https://qiita-image-store.s3.amazonaws.com/0/78184/8aca8342-1fdc-4eb7-4ca2-06e3a1e9c496.png)

プライベート証明書を選択する。
![image.png](https://qiita-image-store.s3.amazonaws.com/0/78184/02055d08-4a9a-0442-ab44-6ab8965565a7.png)

CAとして作成した下位CAを選択する。
![image.png](https://qiita-image-store.s3.amazonaws.com/0/78184/93da1151-6e65-9609-5180-ef73346baa20.png)

![image.png](https://qiita-image-store.s3.amazonaws.com/0/78184/7831279c-ab88-635f-67f6-1adf6839884a.png)

Comfirm and requestをクリックする。
![image.png](https://qiita-image-store.s3.amazonaws.com/0/78184/a382a2dc-ede7-038b-ec60-6f7c1b8768d1.png)

##お約束
投稿内容は私個人の意見であり、所属企業・部門見解を代表するものではありません。