ssl憑證安裝與申請 - safelab.ntu.edu.twsafelab.ntu.edu.tw/tpnet2018/2018meeting1_4.pdf · yum...
TRANSCRIPT
![Page 1: SSL憑證安裝與申請 - safelab.ntu.edu.twsafelab.ntu.edu.tw/tpnet2018/2018meeting1_4.pdf · yum install mod_ssl ... Apache SSL 設定檔內容 19 . 重啟 Apache CentOS 6 service](https://reader036.vdocuments.net/reader036/viewer/2022070112/6051a12390cf7573a450065e/html5/thumbnails/1.jpg)
SSL憑證安裝與申請
1
臺灣大學計資中心
網路組
游子興
![Page 2: SSL憑證安裝與申請 - safelab.ntu.edu.twsafelab.ntu.edu.tw/tpnet2018/2018meeting1_4.pdf · yum install mod_ssl ... Apache SSL 設定檔內容 19 . 重啟 Apache CentOS 6 service](https://reader036.vdocuments.net/reader036/viewer/2022070112/6051a12390cf7573a450065e/html5/thumbnails/2.jpg)
申請免費憑證
90 DAYS
2
![Page 3: SSL憑證安裝與申請 - safelab.ntu.edu.twsafelab.ntu.edu.tw/tpnet2018/2018meeting1_4.pdf · yum install mod_ssl ... Apache SSL 設定檔內容 19 . 重啟 Apache CentOS 6 service](https://reader036.vdocuments.net/reader036/viewer/2022070112/6051a12390cf7573a450065e/html5/thumbnails/3.jpg)
免費憑證申請(90 days)
https://www.sslforfree.com/
Let's Encrypt
a free, automated, and open Certificate Authority.
3
![Page 4: SSL憑證安裝與申請 - safelab.ntu.edu.twsafelab.ntu.edu.tw/tpnet2018/2018meeting1_4.pdf · yum install mod_ssl ... Apache SSL 設定檔內容 19 . 重啟 Apache CentOS 6 service](https://reader036.vdocuments.net/reader036/viewer/2022070112/6051a12390cf7573a450065e/html5/thumbnails/4.jpg)
輸入 Domain Name
https://www.sslforfree.com/create?domains=www.
tp1rc.edu.tw
4
![Page 5: SSL憑證安裝與申請 - safelab.ntu.edu.twsafelab.ntu.edu.tw/tpnet2018/2018meeting1_4.pdf · yum install mod_ssl ... Apache SSL 設定檔內容 19 . 重啟 Apache CentOS 6 service](https://reader036.vdocuments.net/reader036/viewer/2022070112/6051a12390cf7573a450065e/html5/thumbnails/5.jpg)
Manually Verification
5
![Page 6: SSL憑證安裝與申請 - safelab.ntu.edu.twsafelab.ntu.edu.tw/tpnet2018/2018meeting1_4.pdf · yum install mod_ssl ... Apache SSL 設定檔內容 19 . 重啟 Apache CentOS 6 service](https://reader036.vdocuments.net/reader036/viewer/2022070112/6051a12390cf7573a450065e/html5/thumbnails/6.jpg)
驗證 verification file
Download verification file and Upload to web
server
Verify http://www.tp1rc.edu.tw/.well-known/acme-
challenge/Jl8EIddYcZ1qeq8XShlIijEDPcEJnYhyn_bn8DmgkhA
6
![Page 7: SSL憑證安裝與申請 - safelab.ntu.edu.twsafelab.ntu.edu.tw/tpnet2018/2018meeting1_4.pdf · yum install mod_ssl ... Apache SSL 設定檔內容 19 . 重啟 Apache CentOS 6 service](https://reader036.vdocuments.net/reader036/viewer/2022070112/6051a12390cf7573a450065e/html5/thumbnails/7.jpg)
產生憑證檔案-方法1
7
![Page 8: SSL憑證安裝與申請 - safelab.ntu.edu.twsafelab.ntu.edu.tw/tpnet2018/2018meeting1_4.pdf · yum install mod_ssl ... Apache SSL 設定檔內容 19 . 重啟 Apache CentOS 6 service](https://reader036.vdocuments.net/reader036/viewer/2022070112/6051a12390cf7573a450065e/html5/thumbnails/8.jpg)
產生憑證檔案
(私鑰由 sslforfree 提供)
輸入 email 憑證到期提醒
8
![Page 9: SSL憑證安裝與申請 - safelab.ntu.edu.twsafelab.ntu.edu.tw/tpnet2018/2018meeting1_4.pdf · yum install mod_ssl ... Apache SSL 設定檔內容 19 . 重啟 Apache CentOS 6 service](https://reader036.vdocuments.net/reader036/viewer/2022070112/6051a12390cf7573a450065e/html5/thumbnails/9.jpg)
下載憑證檔案
包含公、私鑰
9
![Page 10: SSL憑證安裝與申請 - safelab.ntu.edu.twsafelab.ntu.edu.tw/tpnet2018/2018meeting1_4.pdf · yum install mod_ssl ... Apache SSL 設定檔內容 19 . 重啟 Apache CentOS 6 service](https://reader036.vdocuments.net/reader036/viewer/2022070112/6051a12390cf7573a450065e/html5/thumbnails/10.jpg)
產生憑證檔案-方法2
10
![Page 11: SSL憑證安裝與申請 - safelab.ntu.edu.twsafelab.ntu.edu.tw/tpnet2018/2018meeting1_4.pdf · yum install mod_ssl ... Apache SSL 設定檔內容 19 . 重啟 Apache CentOS 6 service](https://reader036.vdocuments.net/reader036/viewer/2022070112/6051a12390cf7573a450065e/html5/thumbnails/11.jpg)
自行產生私鑰
產生 RSA 2048bit, 3-DES 加密,PEM 格式
Server Private Key
~# openssl genrsa -des3 -out private.key 2048
Enter PEM pass phrase: -- 需記此密碼,每次啟動
httpd 均會用到
Verify password -- Enter PEM pass phrase:
11
![Page 12: SSL憑證安裝與申請 - safelab.ntu.edu.twsafelab.ntu.edu.tw/tpnet2018/2018meeting1_4.pdf · yum install mod_ssl ... Apache SSL 設定檔內容 19 . 重啟 Apache CentOS 6 service](https://reader036.vdocuments.net/reader036/viewer/2022070112/6051a12390cf7573a450065e/html5/thumbnails/12.jpg)
使用私鑰產生憑證申請檔
~$ openssl req -new -key private.key -out server.csr
Enter PEM pass phrase: -- 輸入 Private Key 密碼
輸入基本資料
Country Name (2 letter code) [GB]:TW
State or Province Name (full name) [Berkshire]:Taiwan
Locality Name (eg, city) [Newbury]:Taipei
Organization Name (eg, company) [My Company Ltd]:National Taiwan University
Organizational Unit Name (eg, section) []:CCNET
Common Name (eg, your name or your server's hostname) []:www.tp1rc.edu.tw
Email Address []:[email protected]
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []: 直接 Enter
An optional company name []: 直接 Enter
12
![Page 13: SSL憑證安裝與申請 - safelab.ntu.edu.twsafelab.ntu.edu.tw/tpnet2018/2018meeting1_4.pdf · yum install mod_ssl ... Apache SSL 設定檔內容 19 . 重啟 Apache CentOS 6 service](https://reader036.vdocuments.net/reader036/viewer/2022070112/6051a12390cf7573a450065e/html5/thumbnails/13.jpg)
產生憑證檔案
(使用憑證申請檔)
13
![Page 14: SSL憑證安裝與申請 - safelab.ntu.edu.twsafelab.ntu.edu.tw/tpnet2018/2018meeting1_4.pdf · yum install mod_ssl ... Apache SSL 設定檔內容 19 . 重啟 Apache CentOS 6 service](https://reader036.vdocuments.net/reader036/viewer/2022070112/6051a12390cf7573a450065e/html5/thumbnails/14.jpg)
下載憑證檔案
私鑰自行保管
14
![Page 15: SSL憑證安裝與申請 - safelab.ntu.edu.twsafelab.ntu.edu.tw/tpnet2018/2018meeting1_4.pdf · yum install mod_ssl ... Apache SSL 設定檔內容 19 . 重啟 Apache CentOS 6 service](https://reader036.vdocuments.net/reader036/viewer/2022070112/6051a12390cf7573a450065e/html5/thumbnails/15.jpg)
憑證檔案安裝
APACHE
15
![Page 16: SSL憑證安裝與申請 - safelab.ntu.edu.twsafelab.ntu.edu.tw/tpnet2018/2018meeting1_4.pdf · yum install mod_ssl ... Apache SSL 設定檔內容 19 . 重啟 Apache CentOS 6 service](https://reader036.vdocuments.net/reader036/viewer/2022070112/6051a12390cf7573a450065e/html5/thumbnails/16.jpg)
Apache 尚未安裝 https
netstat -lnp
16
![Page 17: SSL憑證安裝與申請 - safelab.ntu.edu.twsafelab.ntu.edu.tw/tpnet2018/2018meeting1_4.pdf · yum install mod_ssl ... Apache SSL 設定檔內容 19 . 重啟 Apache CentOS 6 service](https://reader036.vdocuments.net/reader036/viewer/2022070112/6051a12390cf7573a450065e/html5/thumbnails/17.jpg)
Apache 安裝 https
安裝 Apache mod_ssl
yum install mod_ssl
systemctl restart httpd
17
![Page 18: SSL憑證安裝與申請 - safelab.ntu.edu.twsafelab.ntu.edu.tw/tpnet2018/2018meeting1_4.pdf · yum install mod_ssl ... Apache SSL 設定檔內容 19 . 重啟 Apache CentOS 6 service](https://reader036.vdocuments.net/reader036/viewer/2022070112/6051a12390cf7573a450065e/html5/thumbnails/18.jpg)
Apache SSL 設定檔
CentOS
/etc/httpd/conf.d/ssl.conf
Ubuntu:
/etc/apache2/sites-enabled/default-ssl.conf
18
![Page 19: SSL憑證安裝與申請 - safelab.ntu.edu.twsafelab.ntu.edu.tw/tpnet2018/2018meeting1_4.pdf · yum install mod_ssl ... Apache SSL 設定檔內容 19 . 重啟 Apache CentOS 6 service](https://reader036.vdocuments.net/reader036/viewer/2022070112/6051a12390cf7573a450065e/html5/thumbnails/19.jpg)
Apache SSL 設定檔內容
19
![Page 20: SSL憑證安裝與申請 - safelab.ntu.edu.twsafelab.ntu.edu.tw/tpnet2018/2018meeting1_4.pdf · yum install mod_ssl ... Apache SSL 設定檔內容 19 . 重啟 Apache CentOS 6 service](https://reader036.vdocuments.net/reader036/viewer/2022070112/6051a12390cf7573a450065e/html5/thumbnails/20.jpg)
重啟 Apache
CentOS 6
service httpd restart
CentOS 7
systemctl restart httpd
Ubuntu
service apache2 restart
20
![Page 21: SSL憑證安裝與申請 - safelab.ntu.edu.twsafelab.ntu.edu.tw/tpnet2018/2018meeting1_4.pdf · yum install mod_ssl ... Apache SSL 設定檔內容 19 . 重啟 Apache CentOS 6 service](https://reader036.vdocuments.net/reader036/viewer/2022070112/6051a12390cf7573a450065e/html5/thumbnails/21.jpg)
若私鑰有設定密碼
重啟 apache 需輸入私鑰密碼
reboot 後 apache 未輸入密碼無法啟動
21
![Page 22: SSL憑證安裝與申請 - safelab.ntu.edu.twsafelab.ntu.edu.tw/tpnet2018/2018meeting1_4.pdf · yum install mod_ssl ... Apache SSL 設定檔內容 19 . 重啟 Apache CentOS 6 service](https://reader036.vdocuments.net/reader036/viewer/2022070112/6051a12390cf7573a450065e/html5/thumbnails/22.jpg)
重啟自動私鑰密碼
私鑰密碼輸入方式
SSLPassPhraseDialog
builtin -- CentOS 6
exec:/usr/libexec/httpd-ssl-pass-dialog -- CentOS 7
exec:/root/apache_pass.sh – 設定自動輸入密碼
/root/apache_pass.sh 內容
#!/bin/sh
echo “123456"
22
![Page 23: SSL憑證安裝與申請 - safelab.ntu.edu.twsafelab.ntu.edu.tw/tpnet2018/2018meeting1_4.pdf · yum install mod_ssl ... Apache SSL 設定檔內容 19 . 重啟 Apache CentOS 6 service](https://reader036.vdocuments.net/reader036/viewer/2022070112/6051a12390cf7573a450065e/html5/thumbnails/23.jpg)
憑證內容
23
![Page 24: SSL憑證安裝與申請 - safelab.ntu.edu.twsafelab.ntu.edu.tw/tpnet2018/2018meeting1_4.pdf · yum install mod_ssl ... Apache SSL 設定檔內容 19 . 重啟 Apache CentOS 6 service](https://reader036.vdocuments.net/reader036/viewer/2022070112/6051a12390cf7573a450065e/html5/thumbnails/24.jpg)
SSL Server Test
https://www.ssllabs.com/
24
![Page 25: SSL憑證安裝與申請 - safelab.ntu.edu.twsafelab.ntu.edu.tw/tpnet2018/2018meeting1_4.pdf · yum install mod_ssl ... Apache SSL 設定檔內容 19 . 重啟 Apache CentOS 6 service](https://reader036.vdocuments.net/reader036/viewer/2022070112/6051a12390cf7573a450065e/html5/thumbnails/25.jpg)
SSL Server Test
disable SSLv3
SSLProtocol all -SSLv2 -SSLv3
25
![Page 26: SSL憑證安裝與申請 - safelab.ntu.edu.twsafelab.ntu.edu.tw/tpnet2018/2018meeting1_4.pdf · yum install mod_ssl ... Apache SSL 設定檔內容 19 . 重啟 Apache CentOS 6 service](https://reader036.vdocuments.net/reader036/viewer/2022070112/6051a12390cf7573a450065e/html5/thumbnails/26.jpg)
https in Wireshark
26
![Page 27: SSL憑證安裝與申請 - safelab.ntu.edu.twsafelab.ntu.edu.tw/tpnet2018/2018meeting1_4.pdf · yum install mod_ssl ... Apache SSL 設定檔內容 19 . 重啟 Apache CentOS 6 service](https://reader036.vdocuments.net/reader036/viewer/2022070112/6051a12390cf7573a450065e/html5/thumbnails/27.jpg)
簡報完畢
謝謝
27