Linux で ssl 自己署名証明書を生成し、https 経由でアクセスするように nginx を構成します。

1. 以前に公開されたインターフェイス アドレスは http://192.168.2.246 でした。

ドメイン名がマッピングされているため https にアップグレードする必要がありますが、IP アドレスでアクセスするため、自己署名証明書の生成と nginx のセットアップが必要です。

2. ホーム ディレクトリの下に new_cert ディレクトリを作成し、証明書と関連ファイルを保存します。

[root@localhost home]# mkdir new_cert

3. openssl を使用して、サーバーとクライアントの公開キーと秘密キーをそれぞれ生成します。

1. サーバー秘密鍵を生成します。

(base) [root@localhost ~]# mkdir new_cert
(base) [root@localhost ~]# cd new_cert/
(base) [root@localhost new_cert]# openssl genrsa -out server.key 1024
Generating RSA private key, 1024 bit long modulus (2 primes)
.......................+++++
............+++++
e is 65537 (0x010001)
    

2. サーバー公開鍵を生成します。

(base) [root@localhost new_cert]# openssl rsa -in server.key -pubout -out server.pem
writing RSA key
(base) [root@localhost new_cert]# openssl genrsa -out client.key 1024
Generating RSA private key, 1024 bit long modulus (2 primes)
.........................+++++
..........+++++
e is 65537 (0x010001)

3. クライアント秘密鍵を生成する

(base) [root@localhost new_cert]# openssl rsa  -in client.key -pubout -out client.pem
writing RSA key

4. クライアント公開キーを生成する

(base) [root@localhost new_cert]# ll
total 16
-rw------- 1 root root 887 Apr  6 14:44 client.key
-rw-r--r-- 1 root root 272 Apr  6 14:44 client.pem
-rw------- 1 root root 887 Apr  6 14:43 server.key
-rw-r--r-- 1 root root 272 Apr  6 14:44 server.pem
(base) [root@localhost new_cert]#

4 番目に、CA 証明書を生成します。

1. CA 秘密鍵を生成する

(base) [root@localhost new_cert]# openssl genrsa -out ca.key 1024
Generating RSA private key, 1024 bit long modulus (2 primes)
..........+++++
.........................+++++
e is 65537 (0x010001)
(base) [root@localhost new_cert]#

2. CA証明書署名要求ファイルCSRの生成

(base) [root@localhost new_cert]# openssl req -new -key ca.key -out ca.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:cn
State or Province Name (full name) [Some-State]:beijing
Locality Name (eg, city) []:chaoyang
Organization Name (eg, company) [Internet Widgits Pty Ltd]:hlhk_ca
Organizational Unit Name (eg, section) []:hlhk_sms_ca
Common Name (e.g. server FQDN or YOUR name) []:192.168.2.246
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:123456
An optional company name []:192.168.2.246
(base) [root@localhost new_cert]#

3. 秘密キー KEY ファイルと CSR ファイル署名を使用して CRT 証明書を生成します

(base) [root@localhost new_cert]# openssl x509 -req -in ca.csr -signkey ca.key -out ca.crt
Signature ok
subject=C = cn, ST = beijing, L = chaoyang, O = hlhk_ca, OU = hlhk_sms_ca, CN = 192.168.2.246
Getting Private key
(base) [root@localhost new_cert]#

5. サーバー側とクライアント側の CRT 証明書を生成する

1. サーバー署名要求 CSR ファイルの生成

(base) [root@localhost new_cert]# openssl req -new -key server.key -out server.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:cn
State or Province Name (full name) [Some-State]:beijing
Locality Name (eg, city) []:chaoyang
Organization Name (eg, company) [Internet Widgits Pty Ltd]:hlhk_serve
Organizational Unit Name (eg, section) []:hlhk_sms_serve
Common Name (e.g. server FQDN or YOUR name) []:192.168.2.246
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:192.168.2.246
(base) [root@localhost new_cert]#

2. クライアント署名要求 CSR ファイルの生成

(base) [root@localhost new_cert]# openssl req -new -key client.key -out client.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:cn
State or Province Name (full name) [Some-State]:beijing
Locality Name (eg, city) []:chaoyang
Organization Name (eg, company) [Internet Widgits Pty Ltd]:hlhk_client
Organizational Unit Name (eg, section) []:hlhk_sms_client
Common Name (e.g. server FQDN or YOUR name) []:192.168.2.246
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:123456
An optional company name []:192.168.2.246
(base) [root@localhost new_cert]#

ここで、サーバーおよびクライアントの組織名 (会社など) および組織単位名は、CA のものとは異なる必要があります。

3. 生成したばかりの独自の CA 組織からの署名付き CRT 証明書 (サーバーおよびクライアント) を申請します。

(base) [root@localhost new_cert]# openssl x509 -req -CA ca.crt -CAkey ca.key -CAcreateserial -in server.csr -out server.crt
Signature ok
subject=C = cn, ST = beijing, L = chaoyang, O = hlhk_serve, OU = hlhk_sms_serve, CN = 192.168.2.246
Getting CA Private Key
(base) [root@localhost new_cert]# openssl x509 -req -CA ca.crt -CAkey ca.key -CAcreateserial -in client.csr -out client.crt
Signature ok
subject=C = cn, ST = beijing, L = chaoyang, O = hlhk_client, OU = hlhk_sms_client, CN = 192.168.2.246
Getting CA Private Key
(base) [root@localhost new_cert]#

(base) [root@localhost new_cert]# ll
total 48
-rw-r--r-- 1 root root 891 Apr  6 14:46 ca.crt
-rw-r--r-- 1 root root 737 Apr  6 14:46 ca.csr
-rw------- 1 root root 891 Apr  6 14:44 ca.key
-rw-r--r-- 1 root root  41 Apr  6 14:50 ca.srl
-rw-r--r-- 1 root root 904 Apr  6 14:50 client.crt
-rw-r--r-- 1 root root 749 Apr  6 14:49 client.csr
-rw------- 1 root root 887 Apr  6 14:44 client.key
-rw-r--r-- 1 root root 272 Apr  6 14:44 client.pem
-rw-r--r-- 1 root root 899 Apr  6 14:49 server.crt
-rw-r--r-- 1 root root 712 Apr  6 14:47 server.csr
-rw------- 1 root root 887 Apr  6 14:43 server.key
-rw-r--r-- 1 root root 272 Apr  6 14:44 server.pem
(base) [root@localhost new_cert]#

6. 最後に、必要なキーと crt ファイルを生成します。

(base) [root@localhost new_cert]# openssl rsa -in server.key -out server_nginx.key
writing RSA key
(base) [root@localhost new_cert]# openssl x509 -req -days 3650 -in server.csr -signkey server_nginx.key -out server_nginx.crt
Signature ok
subject=C = cn, ST = beijing, L = chaoyang, O = hlhk_serve, OU = hlhk_sms_serve, CN = 192.168.2.246
Getting Private key
(base) [root@localhost new_cert]#

7. キーと crt ファイルを nginx にアップロードし、nginx 構成ファイル (https://xxx.xxx.xxx.xxx:8061) を構成します。

user  nginx;
worker_processes  8;

error_log  /var/log/nginx/info.log warn;
pid        /var/run/nginx.pid;


events {
    
    
    worker_connections 1024;
    accept_mutex on;
    multi_accept on;
    use epoll;
}

http {
    
    
    include       mime.types;
    default_type  application/octet-stream;

    sendfile        on;

    keepalive_timeout  65;

    #gzip  on;

    server {
    
    
        listen       8061 ssl;
        server_name  hlhk.com;

        ssl_certificate      /root/new_cert/server_nginx.crt;
        ssl_certificate_key  /root/new_cert/server_nginx.key;

        ssl_session_cache    shared:SSL:1m;
        ssl_session_timeout  5m;

        ssl_ciphers  ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers  on;

        location / {
    
    

            proxy_pass  http://hlhk.com;
            proxy_set_header host $host;
            proxy_set_header X-real-ip $remote_addr;
            proxy_set_header X-forwarded-for $proxy_add_x_forwarded_for;

         }
   }
}