Transcription

1

2

3

4 - 1 -

5 1.. SSL SSL PC (S/W) PC. SSL., SSL. 웹상에서송 수신되는개인정보의대표적예시 1 웹사이트로그인시 ID/ 패스워드 2 웹사이트회원가입시이름 / 주민등록번호 / 전화번호 3 인터넷뱅킹이용시계좌번호 / 계좌비밀번호등 2. 1) (sniffing) (, PC, ) PC, (sniffing tool).. 2) (Phishing) (phishing)

6 1. SSL - 2 -

7 2. 웹서버의종류확인 IIS / Apache / WebtoB / iplanet / Tomcat 등 개인키및 CSR 생성 CSR(Certificate Signing Request) 은인증서요청파일을의미함 보안서버구축용 SSL 인증서발급 생성된 CSR 파일 ( 예 : csr.pem) 을사용하여행정전자서명홈페이지 ( ) 에서 발급 체인인증서內 RootCA 와 CA 인증서추출 발급받은인증서파일 (*.p7b) 을, 웹서버에서요구하는형식에따라체인인증서형태로변환또는추출한다. 웹서버에설치및 SSL 설정 웹서버종류및버전에따른설치방식참조 웹방화벽및개인정보필터링시스템개인키적용 웹방화벽및개인정보필터링시스템을운영시 SSL 인증서의개인키를추출하여해당시스템에적용한다

8 2.1 IIS. IIS 6.0 1) CSR - 4 -

9 - 5 -

10 - 6 -

11 GPKI GPKI - 7 -

12 - 8 -

13 2) <p7b filename> - 9 -

14 - 10 -

15 - 11 -

16 - 12 -

17 - 13 -

18 - 14 -

19 - 15 -

20 - 16 -

21 - 17 -

22 3) SSL

23 - 19 -

24 - 20 -

25 - 21 -

26 - 22 -

27 - 23 -

28 - 24 -

29 . IIS 7.0 1) CSR

30 - 26 -

31 - 27 -

32 2)

33 - 29 -

34 - 30 -

35 - 31 -

36 - 32 -

37 - 33 -

38 - 34 -

39 - 35 -

40 - 36 -

41 - 37 -

42 - 38 -

43 3) SSL

44 - 40 -

45 - 41 -

46 - 42 -

47 - 43 -

48 openssl pkcs12 -in testgpki.pfx -nocerts -nodes -out testgpki.key

49 2.2 Apache. Apache OpenSSL Mod_ssl

50 $ gzip -cd openssl tar.gz tar xvf - $ gzip -cd apache_ tar.gz tar xvf $ gzip -cd mod_ssl tar.gz tar xvf $ cd mod_ssl $./configure \ --with-apache=../apache_ \ --with-ssl=../openssl \ --prefix=/usr/local/apache

51 $ cd../apache_1.3.x $ SSL_BASE=../openssl \./configure \ --prefix=/usr/local/apache \ --enable-module=ssl \ $ make $ make certificate $ make install

52 . Apache 1) CSR [ req_distinguished_name ] countryname = Country Name (2 letter code) countryname_default = KR countryname_min = 2 countryname_max = 2 #stateorprovincename #stateorprovincename_default = State or Province Name (full name) = Some-State #localityname = Locality Name (eg, city) 0.organizationName 0.organizationName_default = Organization Name (eg, company) = Government of Korea # we can do this but it is not needed normally :-) #1.organizationName = Second Organization Name (eg, company) #1.organizationName_default = World Wide Web Pty Ltd 0.organizationalUnitName = Organizational Unit Name (eg, section) 0.organizationalUnitName_default = Group of Server commonname = Common Name (eg, YOUR name) commonname_max = 64 # address # address_max = 64 = Address # SET-ex3 = SET extension number

53 $ openssl genrsa -des3 -out <key filename> 1024 Generating RSA private key, 1024 bit long modulus e is (0x10001) Enter PEM pass phrase: <password> Verifying password - Enter PEM pass phrase: <password> $ openssl req -new -key <key filename> -out <csr filename> You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank ls Country Name (2 letter code) [KR]: Organization Name (eg, company) [Government of Korea]: Organizational Unit Name (eg, section) [Group of Server]: Common Name (eg, YOUR name) []:<cn name : domain> Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []:

54 -----BEGIN CERTIFICATE REQUEST----- MIIBETCBvAIBADBXMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEh MB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMRAwDgYJKoZIhvcNAQkB... AaAAMA0GCSqGSIb3DQEBBAUAA0EAXcMsa8eXgbG2ZhVyFkRVrI4vT8haN39/QJc9 BrRh2nOTKgfMcT9h+1Xx0wNRQ9/SIGV1y3+3abNiJmJBWnJ8Bg== -----END CERTIFICATE REQUEST

55 2) -----BEGIN PKCS MIILiQYJKoZIhvcNAQcCoIILejCCC3YCAQExADALBgkqhkiG9w0BBwGgggteMIID HTCCAgWgAwIBAgIQSAcIRgAuPO7tcwjaHEc8+jANBgkqhkiG9w0BAQUFADBQMQsw... 8wQdPqvThnU/td3t6IrVG983r3rrP69GN/qspiJpBIryB019rK0cUeYFK95jaL3E 0lqDgGfm9I5cuWcJ8eaPfU/AlZYkXCss4jJrMQA= -----END PKCS $ openssl pkcs7 -in <p7b filename> -out <pem filename> -print_certs -text

56 Certificate: Data: Version: 3 (0x2) Serial Number: 42:df:40:23:01:a9:ac:1f:7d:41:18:33:d7:57:65:c5 Signature Algorithm: sha1withrsaencryption Issuer: C=KR, O=Government of Korea, OU=GPKI, CN=Root CA Validity Not Before: Jul 21 06:26: GMT Not After : Jul 21 06:26: GMT Subject: C=KR, O=Government of Korea, OU=GPKI, CN=CA Subject Public Key Info: Public Key Algorithm: rsaencryption RSA Public Key: (2047 bit) Modulus (2047 bit): 72:49:57:af:9c:e6:e9:c9:21:ec:d7:5c:07:38:0f:... 85:c9:24:c2:35:8b:f9:88:65:be:35:d0:44:6e:8f: 4b Exponent: (0x10001) X509v3 extensions: X509v3 Authority Key Identifier: keyid:02:13:ee:ae:1c:20:38:2c:a9:f0:6f:ea:5f:9f:07:3a:93:ef:47:74... Signature Algorithm: sha1withrsaencryption 34:68:03:59:50:75:ac:5b:1a:ef:a3:97:a9:1e:b8:52:62:3f:... e6:f4:8e:5c:b9:67:09:f1:e6:8f:7d:4f:c0:95:96:24:5c:2b: 2c:e2:32:6b -----BEGIN CERTIFICATE----- MIIEnDCCA4SgAwIBAgIQQt9AIwGprB99QRgz11dlxTANBgkqhkiG9w0BAQUFADBM... /ZCZXE7zBB0+q9OGdT+13e3oitUb3zeveus/r0Y3+qymImkEivIHTX2srRxR5gUr 3mNovcTSWoOAZ+b0jly5Zwnx5o99T8CVliRcKyziMms= -----END CERTIFICATE

57 Certificate: Data: Version: 3 (0x2) Serial Number: 3c:c2:81:4b:00:e7:52:4d:9b:aa:47:b7:e1:61:f5:0e Signature Algorithm: sha1withrsaencryption Issuer: C=KR, O=Government of Korea, OU=GPKI, CN=Root CA Validity Not Before: Apr 21 09:07: GMT Not After : Apr 21 09:07: GMT Subject: C=KR, O=Government of Korea, OU=GPKI, CN=Root CA Subject Public Key Info: Public Key Algorithm: rsaencryption RSA Public Key: (2047 bit) Modulus (2047 bit): 40:d6:a1:42:17:2c:55:40:df:9a:7a:c3:91:f4:e3:... f6:cc:5b:73:9d:d5:2d:f1:ce:17:db:de:08:7f:dc: 8d Exponent: (0x10001) X509v3 extensions: X509v3 Authority Key Identifier: keyid:02:13:ee:ae:1c:20:38:2c:a9:f0:6f:ea:5f:9f:07:3a:93:ef:47:74... Signature Algorithm: sha1withrsaencryption 01:a8:a9:c8:26:7c:ac:3e:b4:f7:b6:92:c1:7e:f3:a8:90:6d:... bb:09:d2:ab:d6:11:ae:f6:a7:b9:2b:90:67:8a:2a:04:da:36: 93:1b:7c:3e -----BEGIN CERTIFICATE----- MIIDmTCCAoGgAwIBAgIQPMKBSwDnUk2bqke34WH1DjANBgkqhkiG9w0BAQUFADBM... MCjoTY3acMqAmxxoFXxDs4r1L2kEhhcPMKKP0TbXjRlKams4F2QruwnSq9YRrvan usuqz4oqbno2kxt8pg== -----END CERTIFICATE----- Certificate: Data: Version: 3 (0x2) Serial Number: 42:df:40:23:01:a9:ac:1f:7d:41:18:33:d7:57:65:c5 Signature Algorithm: sha1withrsaencryption Issuer: C=KR, O=Government of Korea, OU=GPKI, CN=Root CA Validity Not Before: Jul 21 06:26: GMT Not After : Jul 21 06:26: GMT

58 Subject: C=KR, O=Government of Korea, OU=GPKI, CN=CA Subject Public Key Info: Public Key Algorithm: rsaencryption RSA Public Key: (2047 bit) Modulus (2047 bit): 72:49:57:af:9c:e6:e9:c9:21:ec:d7:5c:07:38:0f:... 85:c9:24:c2:35:8b:f9:88:65:be:35:d0:44:6e:8f: 4b Exponent: (0x10001) X509v3 extensions: X509v3 Authority Key Identifier: keyid:02:13:ee:ae:1c:20:38:2c:a9:f0:6f:ea:5f:9f:07:3a:93:ef:47:74... Signature Algorithm: sha1withrsaencryption 34:68:03:59:50:75:ac:5b:1a:ef:a3:97:a9:1e:b8:52:62:3f:... e6:f4:8e:5c:b9:67:09:f1:e6:8f:7d:4f:c0:95:96:24:5c:2b: 2c:e2:32:6b -----BEGIN CERTIFICATE----- MIIEnDCCA4SgAwIBAgIQQt9AIwGprB99QRgz11dlxTANBgkqhkiG9w0BAQUFADBM... /ZCZXE7zBB0+q9OGdT+13e3oitUb3zeveus/r0Y3+qymImkEivIHTX2srRxR5gUr 3mNovcTSWoOAZ+b0jly5Zwnx5o99T8CVliRcKyziMms= -----END CERTIFICATE----- LoadModule ssl_module modules/mod_ssl.so <VirtualHost SSLCertificateFile "<pem filename>" SSLCertificateKeyFile "<key filename>" SSLCertificateChainFile "<cachain.pem>" SSLCACertificateFile "<ca.pem>"

59 $./apachectl stop./apachectl stop: httpd stopped $./apachectl startssl Apache/ mod_ssl/2.8.1 (Pass Phrase Dialog) Some of your private key files are encrypted for security reasons. In order to read them you have to provide us with the pass phrases. Server testssl.klid.or.kr:443 (RSA) Enter pass phrase: <password> Ok: Pass Phrase Dialog successful../apachectl startssl: httpd started

60 3) SSL

61 2.3 WebtoB. CSR $ cd $WEBTOBDIR/ssl $ vi wbssl.cnf [ req_distinguished_name ] countryname = Country Name (2 letter code) countryname_default = KR countryname_min = 2 countryname_max = 2 stateorprovincename #stateorprovincename_default localityname organizationname organizationname_default = State or Province Name (full name) = Some-State = Locality Name (eg, city) = Organization Name (eg, company) = Government of Korea organizationalunitname = Organizational Unit Name (eg, section) organizationalunitname_default = Group of Server

62 $ CA -newreq Using configuration from path/to/ssl/wbssl.cnf Generating a 1024 bit RSA Private key Enter PEM pass phase : <password> verifying password - Enter PEM pass phase : <password> Country Name <2 letter code> [KR] : KR

63 States or province Name <full name> [] : Locality Name <eg. city> [] : Organization Name <eg. company> [Government of Korea] : Government of Korea Organization Unit Name <eg. section> [Group of Server] : Systems Group of Server

64 Common Name <eg. Your name or your server's hostname> [] : <cn name : domain> Address [] : Request <and Private key> is in newreq.pem

65 -----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: DES-EDE3-CBC,5B92FCA937EF89C3 4Xi4iNulShWlb41/Y5/y5nesCltEnf1kBxOhsp7JTJFxwu+Tk0ly18gLNf7PEswT... 1c/mn/PObxrNmvH0Rb6HObQyZE/X3A7dzRLUm0owfegREyLdYL5S4g== -----END RSA PRIVATE KEY BEGIN CERTIFICATE----- MIIC6TCCAlKgAwIBAgIBADANBgkqhkiG9w0BAQQFADBdMQswCQYDVQQGEwJLUjEc... duqakh14c6kgl5eblxzegzsr5j/2yfpl9gkrmk4= -----END CERTIFICATE BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: DES-EDE3-CBC,5B92FCA937EF89C3 4Xi4iNulShWlb41/Y5/y5nesCltEnf1kBxOhsp7JTJFxwu+Tk0ly18gLNf7PEswT... 1c/mn/PObxrNmvH0Rb6HObQyZE/X3A7dzRLUm0owfegREyLdYL5S4g== -----END RSA PRIVATE KEY

66 -----BEGIN CERTIFICATE REQUEST----- MIIByzCCATQCAQAwgYoxCzAJBgNVBAYTAktSMQ4wDAYDVQQIEwVTZW91bDEOMAwG A1UEBxMFU2VvdWwxDTALBgNVBAoTBEtJQ0ExDDAKBgNVBAsTA0IDQzEbMBkGA1UE AxMSamNsZWUuc2lnbmdGUuY29tMSEwHwYJKoZlhvcNAQkBFhJqY2xlZUBzaWdu... JSHC5uBNGVCOoUOEtSEkUfTi7a5Nt+2/4R/dy+z/SQ== -----END CERTIFICATE REQUEST

67 BEGIN PKCS MIILiQYJKoZIhvcNAQcCoIILejCCC3YCAQExADALBgkqhkiG9w0BBwGgggteMIID HTCCAgWgAwIBAgIQSAcIRgAuPO7tcwjaHEc8+jANBgkqhkiG9w0BAQUFADBQMQsw... 8wQdPqvThnU/td3t6IrVG983r3rrP69GN/qspiJpBIryB019rK0cUeYFK95jaL3E 0lqDgGfm9I5cuWcJ8eaPfU/AlZYkXCss4jJrMQA= -----END PKCS $ openssl pkcs7 -in <p7b filename> -out <pem filename> -print_certs -text Certificate: Data: Version: 3 (0x2) Serial Number: 3c:c2:81:4b:00:e7:52:4d:9b:aa:47:b7:e1:61:f5:0e Signature Algorithm: sha1withrsaencryption Issuer: C=KR, O=Government of Korea, OU=GPKI, CN=Root CA Validity Not Before: Apr 21 09:07: GMT Not After : Apr 21 09:07: GMT Subject: C=KR, O=Government of Korea, OU=GPKI, CN=Root CA

68 Subject Public Key Info: Public Key Algorithm: rsaencryption RSA Public Key: (2047 bit) Modulus (2047 bit): 40:d6:a1:42:17:2c:55:40:df:9a:7a:c3:91:f4:e3:... f6:cc:5b:73:9d:d5:2d:f1:ce:17:db:de:08:7f:dc: 8d Exponent: (0x10001) X509v3 extensions: X509v3 Authority Key Identifier: keyid:02:13:ee:ae:1c:20:38:2c:a9:f0:6f:ea:5f:9f:07:3a:93:ef:47:74... Signature Algorithm: sha1withrsaencryption 01:a8:a9:c8:26:7c:ac:3e:b4:f7:b6:92:c1:7e:f3:a8:90:6d:... bb:09:d2:ab:d6:11:ae:f6:a7:b9:2b:90:67:8a:2a:04:da:36: 93:1b:7c:3e -----BEGIN CERTIFICATE----- MIIDmTCCAoGgAwIBAgIQPMKBSwDnUk2bqke34WH1DjANBgkqhkiG9w0BAQUFADBM... usuqz4oqbno2kxt8pg== -----END CERTIFICATE----- Certificate: Data: Version: 3 (0x2) Serial Number: 42:df:40:23:01:a9:ac:1f:7d:41:18:33:d7:57:65:c5 Signature Algorithm: sha1withrsaencryption Issuer: C=KR, O=Government of Korea, OU=GPKI, CN=Root CA Validity Not Before: Jul 21 06:26: GMT Not After : Jul 21 06:26: GMT Subject: C=KR, O=Government of Korea, OU=GPKI, CN=CA Subject Public Key Info: Public Key Algorithm: rsaencryption RSA Public Key: (2047 bit) Modulus (2047 bit): 72:49:57:af:9c:e6:e9:c9:21:ec:d7:5c:07:38:0f:... 85:c9:24:c2:35:8b:f9:88:65:be:35:d0:44:6e:8f: 4b Exponent: (0x10001) X509v3 extensions: X509v3 Authority Key Identifier: keyid:02:13:ee:ae:1c:20:38:2c:a9:f0:6f:ea:5f:9f:07:3a:93:ef:47:74... Signature Algorithm: sha1withrsaencryption

69 34:68:03:59:50:75:ac:5b:1a:ef:a3:97:a9:1e:b8:52:62:3f:... 2c:e2:32:6b -----BEGIN CERTIFICATE----- MIIEnDCCA4SgAwIBAgIQQt9AIwGprB99QRgz11dlxTANBgkqhkiG9w0BAQUFADBM... 3mNovcTSWoOAZ+b0jly5Zwnx5o99T8CVliRcKyziMms= -----END CERTIFICATE

70 *DOMAIN webtob1 *NODE gpki WEBTOBDIR="/app/tmax/webtob", SHMKEY = 54000, DOCROOT="/app/tmax/webapps", PORT = "80,443", HTH = 1, LOGGING = "log1", ERRORLOG = "log2", JsvPort = 9900 *VHOST vgpki DOCROOT="/app/tmax/webtob", PORT = "443", NODENAME = "gpki", HOSTNAME = " LOGGING = "log3", ERRORLOG = "log4", SSLFLAG = Y, SSLNAME = "ssl1" *SVRGROUP htmlg jsvg NODENAME = "gpki", SVRTYPE = HTML NODENAME = "gpki", SVRTYPE = JSV... *LOGGING log1 log2 log3 log4 Format = "DEFAULT", FileName = "/app/tmax/webtob/log/access.log" Format = "ERROR", FileName = "/app/tmax/webtob/log/error.log" Format = "DEFAULT", FileName = "/app/tmax/webtob/log/access_ssl.log" Format = "ERROR", FileName = "/app/tmax/webtob/log/error_ssl.log" *SSL ssl1 CertificateFile = "<pem filename>", CertificateKeyFile = "<key filename>", ( 구버전 )CACertificateFile 또는, ( 신규버전 )CertificateChainFile="<caChain filename>"

71 - 67 -

72 . SSL

73 2.4 iplanet. CSR

74 - dn : cn=<cn name, domain>,ou=group of Server,o=Government of Korea,c=KR - Common Name : <cn name, domain> - Organization : Group of Server - Organization Unit : Government of Korea - Country : KR

75 BEGIN PKCS MIILiQYJKoZIhvcNAQcCoIILejCCC3YCAQExADALBgkqhkiG9w0BBwGgggteMIID HTCCAgWgAwIBAgIQSAcIRgAuPO7tcwjaHEc8+jANBgkqhkiG9w0BAQUFADBQMQsw... 8wQdPqvThnU/td3t6IrVG983r3rrP69GN/qspiJpBIryB019rK0cUeYFK95jaL3E 0lqDgGfm9I5cuWcJ8eaPfU/AlZYkXCss4jJrMQA= -----END PKCS <p7b filename>

76 - 72 -

77 - 73 -

78 - 74 -

79 - ID : 이전 80포트에대한 ID를참고하여 SSL 포트를위한 ID를부여 - IP : / any 로설정 - Port : 443, SSL 포트는 443 이디폴트포트이며, 서버관리자와상의하여다른포트를사용하도록설정변경도가능 - Servername : 웹서버명 - Security : On 선택 - Default VS : 디폴트로사용할 Virtual Server url을입력

80 - 76 -

81 . SSL

82 pk12util -o certpk12.p12 -n Server-Cert -d c:\job\webserver6.1\alias -P https-mhlee-mhlee

83 openssl pkcs12 -in certpk12.p12 -nocerts -nodes -out certpk12.key

84 2.5 Tomcat. CSR $ keytool -genkey -alias <alias name> -keyalg RSA -dname "CN=<CN name : domain>,ou=group of Server,O=Government of Korea,C=KR" -keystore <keystore name> keystore 암호를입력하십시오 : <password1> <alias name> 에대한키암호를입력하십시오. (keystore 암호와같은경우 Enter을누르십시오 ): <password2> $ keytool -certreq -alias <alias name> -keystore <keystore name> keystore 암호를입력하십시오 : <password> -----BEGIN NEW CERTIFICATE REQUEST----- MIIBnjCCAQcCAQAwXjELMAkGA1UEBhMCS1IxHDAaBgNVBAoTE0dvdmVybm1lbnQgb2YgS29 yzwex gvzlZMQHfViFjf0fe1tb4bZA== -----END NEW CERTIFICATE REQUEST

85 - 81 -

86 BEGIN PKCS MIILiQYJKoZIhvcNAQcCoIILejCCC3YCAQExADALBgkqhkiG9w0BBwGgggteMIID... 0lqDgGfm9I5cuWcJ8eaPfU/AlZYkXCss4jJrMQA= -----END PKCS <p7b filename>

87 - 83 -

88 $ keytool -import -alias <Root alias name> -trustcacerts -file <rootca fillename> -keystore <keystore name> keystore 암호를입력하십시오 : <password1> 소유자 : CN=Root CA, OU=GPKI, O=Government of Korea, C=KR 발급자 : CN=Root CA, OU=GPKI, O=Government of Korea, C=KR 일련번호 : 3cc2814b00e7524d9baa47b7e161f50e 개시일 : Sun Apr 21 09:07:23 GMT 2002 만료일 : Sat Apr 21 09:07:23 GMT 2012 인증서지문 : MD5: C7:BD:11:D6:91:8A:35:82:C5:36:66:01:7C:6F:47:79 SHA1: 63:4C:3B:02:30:CF:1B:78:B4:56:9F:EC:F2:C0:4A:86:52:EF:EF:0E 이인증서를신뢰하십니까?[ 아니오 ]: y 인증이 keystore에추가되었습니다. $ keytool -import -alias <CA alias name> -trustcacerts -file <ca fillename> -keystore <keystore name> keystore 암호를입력하십시오 : <password1> 인증이 keystore에추가되었습니다

89 <p7b filename> $ keytool -import -alias <alias name> -trustcacerts -file <p7b filename> -keystore <keystore name> keystore 암호를입력하십시오 : <password1> 인증서회신이 keystore에설치되었습니다. <Connector port="443" protocol="http/1.1" SSLEnabled="true" maxthreads="150" minsparethreads="25" maxsparethreads="75" enablelookups="false" disableuploadtimeout="true" acceptcount="100" debug="0" scheme="https" secure="true" keystorepass="<password1>" keystorefile="<keystore name>" clientauth="false" sslprotocol="tls" />

90 - 86 -

91 . SSL javac ExportPriv.java <keystore> - keystorename, <alias> - key생성alias명, <password> - keystore password > 뒤의부분은키파일명을기재해주세요. java ExportPriv <keystore> <alias> <password> > exported-pkcs8.key

92 < 예제 > 첫구동되는페이지에아래의스크립트를설정해준다. <script language="javascript" type="text/javascript"> var currentaddress = location.href; if (currentaddress.indexof(" == 0) { currentaddress = currentaddress.replace(" location.href = currentaddress; } </script>

93 - 1 -

94 - 2 -

95 - 3 -

96 SSL - 4 -

97 - 1 -

98 - 2 -

99 - 3 -

100 - 4 -

101 - 5 -

102 SSLCertificateFile "<pem filename>" SSLCertificateKeyFile "<key filename>" SSLCertificateChainFile "<cachain.pem>" SSLCACertificateFile "<ca.pem>" - 6 -

103 - 7 -

104 - 8 -

105 <Connector port="443" protocol="http/1.1" SSLEnabled="true" maxthreads="150" minsparethreads="25" maxsparethreads="75" enablelookups="false" disableuploadtimeout="true" acceptcount="100" debug="0" scheme="https" secure="true" keystorepass="<password1>" keystorefile="<keystore name>" clientauth="false" sslprotocol="tls" /> - 9 -

106 - 1 -

107 - 2 -

108 - 3 -

109 - 4 -

110 - 5 -

111 - 6 -

112 - 7 -

113 - 8 -

114 - 9 -

115