Linux:Apache2 ssl
Un article de Djjnet.
Sommaire |
Pour activer ssl pour un site
- apache2-ssl-certificate
ceci crée un certificat mais n'est valable qu'un mois, utiliser --force pour le recréer
- a2enmod ssl
- ajouter au vhost :
SSLEngine On SSLCertificateFile /etc/apache2/ssl/apache.pem
Créer le certificat à la main
Il faut générer un certificat à signer (CSR). Le CA va la signer pour créer le certificat final (CRT).
Créer la clé du serveur
openssl genrsa -des3 -out sangoku.key 1024 openssl rsa -in sangoku.key -out sangoku.key
Créer la demande CSR
openssl req -new -key sangoku.key -out egroupware.csr
A la demande "Common Name (eg, YOUR name) []:" indiquer le nom du site : egroupware.dj-j.net
Créer le certificat du CA
openssl genrsa -des3 -out ca.key 1024
Autosigner le certificat du CA
openssl req -new -x509 -days 3000 -key ca.key -out ca.crt
Script sign.sh
#!/bin/sh ## ## sign.sh -- Sign a SSL Certificate Request (CSR) ## Copyright (c) 1998-1999 Ralf S. Engelschall, All Rights Reserved. ## # argument line handling CSR=$1 if [ $# -ne 1 ]; then echo "Usage: sign.sign <whatever>.csr"; exit 1 fi if [ ! -f $CSR ]; then echo "CSR not found: $CSR"; exit 1 fi case $CSR in *.csr ) CERT="`echo $CSR | sed -e 's/\.csr/.crt/'`" ;; * ) CERT="$CSR.crt" ;; esac # make sure environment exists if [ ! -d ca.db.certs ]; then mkdir ca.db.certs fi if [ ! -f ca.db.serial ]; then echo '01' >ca.db.serial fi if [ ! -f ca.db.index ]; then cp /dev/null ca.db.index fi # create an own SSLeay config cat >ca.config <<EOT [ ca ] default_ca = CA_own [ CA_own ] dir = . certs = . new_certs_dir = ./ca.db.certs database = ./ca.db.index serial = ./ca.db.serial RANDFILE = ./ca.db.rand certificate = ./ca.crt private_key = ./ca.key default_days = 3000 default_crl_days = 30 default_md = md5 preserve = no policy = policy_anything [ policy_anything ] countryName = optional stateOrProvinceName = optional localityName = optional organizationName = optional organizationalUnitName = optional commonName = supplied emailAddress = optional EOT # sign the certificate echo "CA signing: $CSR -> $CERT:" openssl ca -config ca.config -out $CERT -infiles $CSR echo "CA verifying: $CERT <-> CA cert" openssl verify -CAfile ca.crt $CERT # cleanup after SSLeay rm -f ca.config rm -f ca.db.serial.old rm -f ca.db.index.old # die gracefully exit 0
Créer le certificat
sh sign.sh egroupware.csr
Vhost d'apache
SSLEngine On SSLCertificateFile /etc/apache2/ssl/egroupware.crt SSLCertificateKeyFile /etc/apache2/ssl/sangoku.key SSLCACertificateFile /etc/apache2/ssl/ca.crt
