自宅サーバの設定ー自己証明書サーバ

自宅サーバのCentOS 8Stream で自己証明書サーバを起動させる
自宅にあるので、DNSはなし。
/etc/hostsでサーバ名解決。

利用しているWindowsからは、C:\Windows\System32\drivers\etc\hostsに
192.168.1.33	yyuu.local
の1行を記載

・秘密鍵作成
```ruby:
# openssl genrsa 2048 > localserver.key
Generating RSA private key, 2048 bit long modulus (2 primes)
..............................................................
..............................................................
...............................................+++++
....+++++
e is 65537 (0x010001)
```
・CSRの作成
```ruby:
# openssl req -new -key localserver.key > localserver.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:JP
State or Province Name (full name) []:****
Locality Name (eg, city) [Default City]:***
Organization Name (eg, company) [Default Company Ltd]:yyuu
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:yyuu.local
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
```

・サーバ証明書作成
```ruby:
# openssl x509 -req -days 3650 -signkey localserver.key < localserver.csr >localserver.crt
Signature ok
subject=C = JP, ST = ****, L = ***, O = yyuu, CN = yyuu.local
Getting Private key
```


証明書の有効期限は10年(3650日)

```ruby:
# ls
localserver.crt  localserver.csr  localserver.key
```

```ruby:
# mv ssl.conf ssl.conforg
# cp vhost.conf vhost-ssl.conf
```
vhost-ssl.confを編集

```ruby:
# apachectl configtest
Syntax OK
```

ブラウザ越しでエラーになる

```ruby:
# telnet 192.168.1.33 443
Trying 192.168.1.33...
telnet: connect to address 192.168.1.33: Connection refused
```

443ポートで起動していないので、ログ確認
```ruby:
[Fri Jan 20 12:14:53.684895 2023] [ssl:warn] [pid 147249:tid 140078683593024] AH01873: Init: Session Cache is not configured [hint: SSLSessionCache]
```
443がないってことで、ssl.confにあった
Listen 443 https
がないのに気づき、ファイルを戻すして再起動。起動確認。

```ruby:
# mv ssl.conforg ssl.conf
# apachectl restart
# telnet 192.168.1.33 443
Trying 192.168.1.33...
Connected to 192.168.1.33.
Escape character is '^]'.
^CConnection closed by foreign host.
```

ブラウザ越しで確認
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/209422/4aec2387-6e2e-eb28-1e69-7299c311e7a5.png)

詳細設定からyyuu.localにアクセスする
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/209422/07dac487-9e5e-96bb-4c05-5b7ce8397d69.png)

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/209422/5459a727-6ad8-2eac-d19e-82d5c9712384.png)

localhost.localdomainなので、なんか違う？
ssl.confのほうにカギをいれてみる

```ruby:
# vi ssl.conf
SLCertificateFile /etc/ssl/localhost/localserver.crt
SSLCertificateKeyFile /etc/ssl/localhost/localserver.key

# apachectl restart

```
とりあえず、成功
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/209422/7cbf845d-9732-3a8e-97e9-ed2842ad1675.png)

ローカルで使うのにアラートがでるので、それを消すため証明書をエクスポート
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/209422/8838f885-ed7e-8c1d-3d66-ad184a3da4d4.png)

エクスポートしたファイルをダブルクリックして「詳細」タブから「ファイルにコピー」
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/209422/a64a4f17-cfc0-0f42-8135-23f60ce44565.png)
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/209422/640b6785-8219-d5a3-213e-3975a84ecb63.png)
cerでエクスポート
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/209422/2255a98b-2049-1cbc-d5bf-35dabf04da66.png)

エクスポート完了のダイアログがでれば完了。

Chromeの設定-詳細設定を開いて「プライバシーとセキュリティ」を」クリック。
「セキュリティ」をクリック
「デバイス証明書の管理」をクリック
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/209422/c8055316-56e7-6259-c52e-cd71ab58e965.png)

インポートをクリック。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/209422/966f0940-2d3b-29a4-cc40-3f573b111e63.png)

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/209422/ee6e659b-6c87-dce4-8bab-609c811af457.png)

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/209422/301ab6a5-62cc-2c2d-2d4d-5abfab248ec1.png)


]# openssl pkcs12 -export -inkey localserver.key -in localserver.crt -out localserver.pfx
Enter Export Password:
Verifying - Enter Export Password:
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/209422/2e9a41ee-5314-d0e5-b9c3-3c615b44f96f.png)
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/209422/540111b4-7917-a449-b9f9-21697ed1394a.png)
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/209422/0c4fd2c8-629a-0865-1351-edcb9598bb92.png)
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/209422/6bf83ae0-670d-c216-3ada-f0970abc534b.png)
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/209422/2e469ac3-9dac-5c86-7787-b9da9b48913d.png)

いろいろ証明書をインポートしてみたがwindows11ではうまくいかなかったので、一旦終了。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/209422/be8200ce-896e-26c4-3b4e-f6cc7e9e756d.png)
でたままでしばらく使うことにした。