RHEL7 証明書整理

#参考URL
https://access.redhat.com/documentation/ja-JP/Red_Hat_Enterprise_Virtualization/3.3/html/Developer_Guide/appe-Certificates.html#Creating_SSLTLS_Certificates

#作成方法
今更CNだけはナンセンスなので、SANsでの設定整理

##設定値整理
| # | 設定項目 | 設定値(CA) | 設定値 (サーバ) | 意味 |
|-----|--------------------------|------------------------------|------------------------------|----------------------|
| --- | --- | --- | --- | --- |
| 1 | Password | hogehoge | [設定なし] | 秘密鍵のパスワード |
| 2 | Country Name | JP | JP | 国コード |
| 3 | State or Province Name | Tokyo | Tokyo | 都道府県 |
| 4 | Locality Name | Komagome | Komagome | 市町村区 |
| 5 | Organization Name | Microlab CO.,LTD | Microlab CO.,LTD | 会社名もしくは組織名 |
| 6 | Organizational Unit Name | Engineering Content Services | Engineering Content Services | 部署名等 |
| 7 | Common Name | rhel75-CA | rhel75 | ホスト名 |
| 8 | Email Address | rhel75-CA@hogehoge.com | rhel75@hogehoge.com | Email |

##認証局の作成
```
# yum install openssl

# openssl req -new -x509 -keyout ca.key -out ca.crt -days 3650
Generating a 2048 bit RSA private key
...................................+++
.........+++
writing new private key to 'ca.key'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:JP
State or Province Name (full name) []:Tokyo
Locality Name (eg, city) [Default City]:Komagome
Organization Name (eg, company) [Default Company Ltd]:Microlab CO.,LTD
Organizational Unit Name (eg, section) []:Engineering Content Services
Common Name (eg, your name or your server's hostname) []:rhel75-CA
Email Address []:rhel75-CA@hogehoge.com
```

##サーバ証明書作成(SANs)
### 事前準備
ファイルを新規作成

``` v3.cnf
[ v3_req ]
subjectAltName          = @alt_names

[alt_names]
DNS.1 = server
DNS.2 = server.local
DNS.3 = *.local
DNS.4 = *.aaa.jp
DNS.5 = *.bbb.jp
DNS.6 = *.aaa.bbb.ccc
```

### 証明書の作成
```
# openssl genrsa -out ssl.key
Generating RSA private key, 2048 bit long modulus
......................................................................................................................................................+++
..................................................................................................................................................+++
e is 65537 (0x10001)

# openssl req -extensions v3_req -new -key ssl.key -out ssl.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:JP
State or Province Name (full name) []:Tokyo
Locality Name (eg, city) [Default City]:Komagome
Organization Name (eg, company) [Default Company Ltd]:Microlab CO.,LTD
Organizational Unit Name (eg, section) []:Engineering Content Services
Common Name (eg, your name or your server's hostname) []:rhel75
Email Address []:rhel75@hogehoge.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

# ll /etc/pki/CA/index.txt || touch /etc/pki/CA/index.txt
# ll /etc/pki/CA/serial || echo '1000' > /etc/pki/CA/serial

# openssl ca -extensions v3_req -extfile v3.cnf -cert ca.crt -keyfile ca.key -out ssl.crt -infiles ssl.csr
Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for ca.key:
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 4096 (0x1000)
        Validity
            Not Before: Sep 28 02:59:57 2019 GMT
            Not After : Sep 27 02:59:57 2020 GMT
        Subject:
            countryName               = JP
            stateOrProvinceName       = Tokyo
            organizationName          = Microlab CO.,LTD
            organizationalUnitName    = Engineering Content Services
            commonName                = rhel75
            emailAddress              = rhel75@hogehoge.com
        X509v3 extensions:
            X509v3 Subject Alternative Name:
                DNS:server, DNS:server.local, DNS:*.local, DNS:*.aaa.jp, DNS:*.bbb.jp, DNS:*.aaa.bbb.ccc
Certificate is to be certified until Sep 27 02:59:57 2020 GMT (365 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
```

#ワイルドカード証明書での考察
１．別階層には使えない
*.co.jpでは
hogehoge.co.jp 認証可能
hogehoge.jp    認証不可

２．1階層しかないドメインは使用不可
これが何故か分からない。

*.local で作成
hogehoge.local 認証不可
*.co.local で作成
hogehoge.co.local 認証可能

メモ

```
#!/usr/bin/perl

print "Content-type: text/html;\n\n";
print "<html><body><h1>sleep 30</h1></body></html>\n";
sleep 30
```