- PDF 무료 다운로드

- 1 -

1.. SSL SSL PC (S/W) PC. SSL., SSL. 웹상에서송 수신되는개인정보의대표적예시 1 웹사이트로그인시 ID/ 패스워드 2 웹사이트회원가입시이름 / 주민등록번호 / 전화번호 3 인터넷뱅킹이용시계좌번호 / 계좌비밀번호등 2. 1) (sniffing) (, PC, ) PC, (sniffing tool).. 2) (Phishing) (phishing). - 1 -

1. SSL - 2 -

2. 웹서버의종류확인 IIS / Apache / WebtoB / iplanet / Tomcat 등 개인키및 CSR 생성 CSR(Certificate Signing Request) 은인증서요청파일을의미함 보안서버구축용 SSL 인증서발급 생성된 CSR 파일 ( 예 : csr.pem) 을사용하여행정전자서명홈페이지 (www.gpki.go.kr ) 에서 발급 체인인증서內 RootCA 와 CA 인증서추출 발급받은인증서파일 (*.p7b) 을, 웹서버에서요구하는형식에따라체인인증서형태로변환또는추출한다. 웹서버에설치및 SSL 설정 웹서버종류및버전에따른설치방식참조 웹방화벽및개인정보필터링시스템개인키적용 웹방화벽및개인정보필터링시스템을운영시 SSL 인증서의개인키를추출하여해당시스템에적용한다. - 3 -

2.1 IIS. IIS 6.0 1) CSR - 4 -

- 5 -

- 6 -

GPKI GPKI - 7 -

- 8 -

2) <p7b filename> - 9 -

- 10 -

- 11 -

- 12 -

- 13 -

- 14 -

- 15 -

- 16 -

- 17 -

3) SSL - 18 -

- 19 -

- 20 -

- 21 -

- 22 -

- 23 -

- 24 -

. IIS 7.0 1) CSR - 25 -

- 26 -

- 27 -

2) - 28 -

- 29 -

- 30 -

- 31 -

- 32 -

- 33 -

- 34 -

- 35 -

- 36 -

- 37 -

- 38 -

3) SSL - 39 -

- 40 -

- 41 -

- 42 -

- 43 -

openssl pkcs12 -in testgpki.pfx -nocerts -nodes -out testgpki.key - 44 -

2.2 Apache. Apache OpenSSL Mod_ssl - 45 -

$ gzip -cd openssl-0.9.6.tar.gz tar xvf - $ gzip -cd apache_1.3.19.tar.gz tar xvf $ gzip -cd mod_ssl-2.8.1-1.3.19.tar.gz tar xvf $ cd mod_ssl-2.8.1-1.3.19 $./configure \ --with-apache=../apache_1.3.19 \ --with-ssl=../openssl-0.9.6 \ --prefix=/usr/local/apache - 46 -

$ cd../apache_1.3.x $ SSL_BASE=../openssl-0.9.6 \./configure \ --prefix=/usr/local/apache \ --enable-module=ssl \ $ make $ make certificate $ make install - 47 -

. Apache 1) CSR [ req_distinguished_name ] countryname = Country Name (2 letter code) countryname_default = KR countryname_min = 2 countryname_max = 2 #stateorprovincename #stateorprovincename_default = State or Province Name (full name) = Some-State #localityname = Locality Name (eg, city) 0.organizationName 0.organizationName_default = Organization Name (eg, company) = Government of Korea # we can do this but it is not needed normally :-) #1.organizationName = Second Organization Name (eg, company) #1.organizationName_default = World Wide Web Pty Ltd 0.organizationalUnitName = Organizational Unit Name (eg, section) 0.organizationalUnitName_default = Group of Server commonname = Common Name (eg, YOUR name) commonname_max = 64 #emailaddress #emailaddress_max = 64 = Email Address # SET-ex3 = SET extension number 3-48 -

$ openssl genrsa -des3 -out <key filename> 1024 Generating RSA private key, 1024 bit long modulus...++++++...++++++ e is 65537 (0x10001) Enter PEM pass phrase: <password> Verifying password - Enter PEM pass phrase: <password> $ openssl req -new -key <key filename> -out <csr filename> You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. -----ls Country Name (2 letter code) [KR]: Organization Name (eg, company) [Government of Korea]: Organizational Unit Name (eg, section) [Group of Server]: Common Name (eg, YOUR name) []:<cn name : domain> Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: - 49 -

2) -----BEGIN PKCS7----- MIILiQYJKoZIhvcNAQcCoIILejCCC3YCAQExADALBgkqhkiG9w0BBwGgggteMIID HTCCAgWgAwIBAgIQSAcIRgAuPO7tcwjaHEc8+jANBgkqhkiG9w0BAQUFADBQMQsw... 8wQdPqvThnU/td3t6IrVG983r3rrP69GN/qspiJpBIryB019rK0cUeYFK95jaL3E 0lqDgGfm9I5cuWcJ8eaPfU/AlZYkXCss4jJrMQA= -----END PKCS7----- $ openssl pkcs7 -in <p7b filename> -out <pem filename> -print_certs -text - 51 -

Certificate: Data: Version: 3 (0x2) Serial Number: 42:df:40:23:01:a9:ac:1f:7d:41:18:33:d7:57:65:c5 Signature Algorithm: sha1withrsaencryption Issuer: C=KR, O=Government of Korea, OU=GPKI, CN=Root CA Validity Not Before: Jul 21 06:26:43 2005 GMT Not After : Jul 21 06:26:43 2010 GMT Subject: C=KR, O=Government of Korea, OU=GPKI, CN=CA131000001 Subject Public Key Info: Public Key Algorithm: rsaencryption RSA Public Key: (2047 bit) Modulus (2047 bit): 72:49:57:af:9c:e6:e9:c9:21:ec:d7:5c:07:38:0f:... 85:c9:24:c2:35:8b:f9:88:65:be:35:d0:44:6e:8f: 4b Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Authority Key Identifier: keyid:02:13:ee:ae:1c:20:38:2c:a9:f0:6f:ea:5f:9f:07:3a:93:ef:47:74... Signature Algorithm: sha1withrsaencryption 34:68:03:59:50:75:ac:5b:1a:ef:a3:97:a9:1e:b8:52:62:3f:... e6:f4:8e:5c:b9:67:09:f1:e6:8f:7d:4f:c0:95:96:24:5c:2b: 2c:e2:32:6b -----BEGIN CERTIFICATE----- MIIEnDCCA4SgAwIBAgIQQt9AIwGprB99QRgz11dlxTANBgkqhkiG9w0BAQUFADBM... /ZCZXE7zBB0+q9OGdT+13e3oitUb3zeveus/r0Y3+qymImkEivIHTX2srRxR5gUr 3mNovcTSWoOAZ+b0jly5Zwnx5o99T8CVliRcKyziMms= -----END CERTIFICATE----- - 52 -

Certificate: Data: Version: 3 (0x2) Serial Number: 3c:c2:81:4b:00:e7:52:4d:9b:aa:47:b7:e1:61:f5:0e Signature Algorithm: sha1withrsaencryption Issuer: C=KR, O=Government of Korea, OU=GPKI, CN=Root CA Validity Not Before: Apr 21 09:07:23 2002 GMT Not After : Apr 21 09:07:23 2012 GMT Subject: C=KR, O=Government of Korea, OU=GPKI, CN=Root CA Subject Public Key Info: Public Key Algorithm: rsaencryption RSA Public Key: (2047 bit) Modulus (2047 bit): 40:d6:a1:42:17:2c:55:40:df:9a:7a:c3:91:f4:e3:... f6:cc:5b:73:9d:d5:2d:f1:ce:17:db:de:08:7f:dc: 8d Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Authority Key Identifier: keyid:02:13:ee:ae:1c:20:38:2c:a9:f0:6f:ea:5f:9f:07:3a:93:ef:47:74... Signature Algorithm: sha1withrsaencryption 01:a8:a9:c8:26:7c:ac:3e:b4:f7:b6:92:c1:7e:f3:a8:90:6d:... bb:09:d2:ab:d6:11:ae:f6:a7:b9:2b:90:67:8a:2a:04:da:36: 93:1b:7c:3e -----BEGIN CERTIFICATE----- MIIDmTCCAoGgAwIBAgIQPMKBSwDnUk2bqke34WH1DjANBgkqhkiG9w0BAQUFADBM... MCjoTY3acMqAmxxoFXxDs4r1L2kEhhcPMKKP0TbXjRlKams4F2QruwnSq9YRrvan usuqz4oqbno2kxt8pg== -----END CERTIFICATE----- Certificate: Data: Version: 3 (0x2) Serial Number: 42:df:40:23:01:a9:ac:1f:7d:41:18:33:d7:57:65:c5 Signature Algorithm: sha1withrsaencryption Issuer: C=KR, O=Government of Korea, OU=GPKI, CN=Root CA Validity Not Before: Jul 21 06:26:43 2005 GMT Not After : Jul 21 06:26:43 2010 GMT - 53 -

Subject: C=KR, O=Government of Korea, OU=GPKI, CN=CA131000001 Subject Public Key Info: Public Key Algorithm: rsaencryption RSA Public Key: (2047 bit) Modulus (2047 bit): 72:49:57:af:9c:e6:e9:c9:21:ec:d7:5c:07:38:0f:... 85:c9:24:c2:35:8b:f9:88:65:be:35:d0:44:6e:8f: 4b Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Authority Key Identifier: keyid:02:13:ee:ae:1c:20:38:2c:a9:f0:6f:ea:5f:9f:07:3a:93:ef:47:74... Signature Algorithm: sha1withrsaencryption 34:68:03:59:50:75:ac:5b:1a:ef:a3:97:a9:1e:b8:52:62:3f:... e6:f4:8e:5c:b9:67:09:f1:e6:8f:7d:4f:c0:95:96:24:5c:2b: 2c:e2:32:6b -----BEGIN CERTIFICATE----- MIIEnDCCA4SgAwIBAgIQQt9AIwGprB99QRgz11dlxTANBgkqhkiG9w0BAQUFADBM... /ZCZXE7zBB0+q9OGdT+13e3oitUb3zeveus/r0Y3+qymImkEivIHTX2srRxR5gUr 3mNovcTSWoOAZ+b0jly5Zwnx5o99T8CVliRcKyziMms= -----END CERTIFICATE----- LoadModule ssl_module modules/mod_ssl.so <VirtualHost www.gpki.go.kr:443> SSLCertificateFile "<pem filename>" SSLCertificateKeyFile "<key filename>" SSLCertificateChainFile "<cachain.pem>" SSLCACertificateFile "<ca.pem>" - 54 -

$./apachectl stop./apachectl stop: httpd stopped $./apachectl startssl Apache/1.3.19 mod_ssl/2.8.1 (Pass Phrase Dialog) Some of your private key files are encrypted for security reasons. In order to read them you have to provide us with the pass phrases. Server testssl.klid.or.kr:443 (RSA) Enter pass phrase: <password> Ok: Pass Phrase Dialog successful../apachectl startssl: httpd started - 55 -

3) SSL - 56 -

2.3 WebtoB. CSR $ cd $WEBTOBDIR/ssl $ vi wbssl.cnf [ req_distinguished_name ] countryname = Country Name (2 letter code) countryname_default = KR countryname_min = 2 countryname_max = 2 stateorprovincename #stateorprovincename_default localityname organizationname organizationname_default = State or Province Name (full name) = Some-State = Locality Name (eg, city) = Organization Name (eg, company) = Government of Korea organizationalunitname = Organizational Unit Name (eg, section) organizationalunitname_default = Group of Server - 57 -

$ CA -newreq Using configuration from path/to/ssl/wbssl.cnf Generating a 1024 bit RSA Private key Enter PEM pass phase : <password> verifying password - Enter PEM pass phase : <password> Country Name <2 letter code> [KR] : KR - 58 -

States or province Name <full name> [] : Locality Name <eg. city> [] : Organization Name <eg. company> [Government of Korea] : Government of Korea Organization Unit Name <eg. section> [Group of Server] : Systems Group of Server - 59 -

Common Name <eg. Your name or your server's hostname> [] : <cn name : domain> Email Address [] : Request <and Private key> is in newreq.pem - 60 -

-----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: DES-EDE3-CBC,5B92FCA937EF89C3 4Xi4iNulShWlb41/Y5/y5nesCltEnf1kBxOhsp7JTJFxwu+Tk0ly18gLNf7PEswT... 1c/mn/PObxrNmvH0Rb6HObQyZE/X3A7dzRLUm0owfegREyLdYL5S4g== -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- MIIC6TCCAlKgAwIBAgIBADANBgkqhkiG9w0BAQQFADBdMQswCQYDVQQGEwJLUjEc... duqakh14c6kgl5eblxzegzsr5j/2yfpl9gkrmk4= -----END CERTIFICATE----- -----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: DES-EDE3-CBC,5B92FCA937EF89C3 4Xi4iNulShWlb41/Y5/y5nesCltEnf1kBxOhsp7JTJFxwu+Tk0ly18gLNf7PEswT... 1c/mn/PObxrNmvH0Rb6HObQyZE/X3A7dzRLUm0owfegREyLdYL5S4g== -----END RSA PRIVATE KEY----- - 61 -

. -----BEGIN PKCS7----- MIILiQYJKoZIhvcNAQcCoIILejCCC3YCAQExADALBgkqhkiG9w0BBwGgggteMIID HTCCAgWgAwIBAgIQSAcIRgAuPO7tcwjaHEc8+jANBgkqhkiG9w0BAQUFADBQMQsw... 8wQdPqvThnU/td3t6IrVG983r3rrP69GN/qspiJpBIryB019rK0cUeYFK95jaL3E 0lqDgGfm9I5cuWcJ8eaPfU/AlZYkXCss4jJrMQA= -----END PKCS7----- $ openssl pkcs7 -in <p7b filename> -out <pem filename> -print_certs -text Certificate: Data: Version: 3 (0x2) Serial Number: 3c:c2:81:4b:00:e7:52:4d:9b:aa:47:b7:e1:61:f5:0e Signature Algorithm: sha1withrsaencryption Issuer: C=KR, O=Government of Korea, OU=GPKI, CN=Root CA Validity Not Before: Apr 21 09:07:23 2002 GMT Not After : Apr 21 09:07:23 2012 GMT Subject: C=KR, O=Government of Korea, OU=GPKI, CN=Root CA - 63 -

Subject Public Key Info: Public Key Algorithm: rsaencryption RSA Public Key: (2047 bit) Modulus (2047 bit): 40:d6:a1:42:17:2c:55:40:df:9a:7a:c3:91:f4:e3:... f6:cc:5b:73:9d:d5:2d:f1:ce:17:db:de:08:7f:dc: 8d Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Authority Key Identifier: keyid:02:13:ee:ae:1c:20:38:2c:a9:f0:6f:ea:5f:9f:07:3a:93:ef:47:74... Signature Algorithm: sha1withrsaencryption 01:a8:a9:c8:26:7c:ac:3e:b4:f7:b6:92:c1:7e:f3:a8:90:6d:... bb:09:d2:ab:d6:11:ae:f6:a7:b9:2b:90:67:8a:2a:04:da:36: 93:1b:7c:3e -----BEGIN CERTIFICATE----- MIIDmTCCAoGgAwIBAgIQPMKBSwDnUk2bqke34WH1DjANBgkqhkiG9w0BAQUFADBM... usuqz4oqbno2kxt8pg== -----END CERTIFICATE----- Certificate: Data: Version: 3 (0x2) Serial Number: 42:df:40:23:01:a9:ac:1f:7d:41:18:33:d7:57:65:c5 Signature Algorithm: sha1withrsaencryption Issuer: C=KR, O=Government of Korea, OU=GPKI, CN=Root CA Validity Not Before: Jul 21 06:26:43 2005 GMT Not After : Jul 21 06:26:43 2010 GMT Subject: C=KR, O=Government of Korea, OU=GPKI, CN=CA131000001 Subject Public Key Info: Public Key Algorithm: rsaencryption RSA Public Key: (2047 bit) Modulus (2047 bit): 72:49:57:af:9c:e6:e9:c9:21:ec:d7:5c:07:38:0f:... 85:c9:24:c2:35:8b:f9:88:65:be:35:d0:44:6e:8f: 4b Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Authority Key Identifier: keyid:02:13:ee:ae:1c:20:38:2c:a9:f0:6f:ea:5f:9f:07:3a:93:ef:47:74... Signature Algorithm: sha1withrsaencryption - 64 -

34:68:03:59:50:75:ac:5b:1a:ef:a3:97:a9:1e:b8:52:62:3f:... 2c:e2:32:6b -----BEGIN CERTIFICATE----- MIIEnDCCA4SgAwIBAgIQQt9AIwGprB99QRgz11dlxTANBgkqhkiG9w0BAQUFADBM... 3mNovcTSWoOAZ+b0jly5Zwnx5o99T8CVliRcKyziMms= -----END CERTIFICATE----- - 65 -

*DOMAIN webtob1 *NODE gpki WEBTOBDIR="/app/tmax/webtob", SHMKEY = 54000, DOCROOT="/app/tmax/webapps", PORT = "80,443", HTH = 1, LOGGING = "log1", ERRORLOG = "log2", JsvPort = 9900 *VHOST vgpki DOCROOT="/app/tmax/webtob", PORT = "443", NODENAME = "gpki", HOSTNAME = "www.gpki.go.kr", LOGGING = "log3", ERRORLOG = "log4", SSLFLAG = Y, SSLNAME = "ssl1" *SVRGROUP htmlg jsvg NODENAME = "gpki", SVRTYPE = HTML NODENAME = "gpki", SVRTYPE = JSV... *LOGGING log1 log2 log3 log4 Format = "DEFAULT", FileName = "/app/tmax/webtob/log/access.log" Format = "ERROR", FileName = "/app/tmax/webtob/log/error.log" Format = "DEFAULT", FileName = "/app/tmax/webtob/log/access_ssl.log" Format = "ERROR", FileName = "/app/tmax/webtob/log/error_ssl.log" *SSL ssl1 CertificateFile = "<pem filename>", CertificateKeyFile = "<key filename>", ( 구버전 )CACertificateFile 또는, ( 신규버전 )CertificateChainFile="<caChain filename>" - 66 -

- 67 -

. SSL - 68 -

2.4 iplanet. CSR - 69 -

- dn : cn=<cn name, domain>,ou=group of Server,o=Government of Korea,c=KR - Common Name : <cn name, domain> - Organization : Group of Server - Organization Unit : Government of Korea - Country : KR - 70 -

- 72 -

- 73 -

- 74 -

- ID : 이전 80포트에대한 ID를참고하여 SSL 포트를위한 ID를부여 - IP : 0.0.0.0 / any 로설정 - Port : 443, SSL 포트는 443 이디폴트포트이며, 서버관리자와상의하여다른포트를사용하도록설정변경도가능 - Servername : 웹서버명 - Security : On 선택 - Default VS : 디폴트로사용할 Virtual Server url을입력 - 75 -

- 76 -

. SSL - 77 -

pk12util -o certpk12.p12 -n Server-Cert -d c:\job\webserver6.1\alias -P https-mhlee-mhlee- - 78 -

openssl pkcs12 -in certpk12.p12 -nocerts -nodes -out certpk12.key - 79 -

2.5 Tomcat. CSR $ keytool -genkey -alias <alias name> -keyalg RSA -dname "CN=<CN name : domain>,ou=group of Server,O=Government of Korea,C=KR" -keystore <keystore name> keystore 암호를입력하십시오 : <password1> <alias name> 에대한키암호를입력하십시오. (keystore 암호와같은경우 Enter을누르십시오 ): <password2> $ keytool -certreq -alias <alias name> -keystore <keystore name> keystore 암호를입력하십시오 : <password> -----BEGIN NEW CERTIFICATE REQUEST----- MIIBnjCCAQcCAQAwXjELMAkGA1UEBhMCS1IxHDAaBgNVBAoTE0dvdmVybm1lbnQgb2YgS29 yzwex...... +5gvzlZMQHfViFjf0fe1tb4bZA== -----END NEW CERTIFICATE REQUEST----- - 80 -

- 81 -

. -----BEGIN PKCS7----- MIILiQYJKoZIhvcNAQcCoIILejCCC3YCAQExADALBgkqhkiG9w0BBwGgggteMIID... 0lqDgGfm9I5cuWcJ8eaPfU/AlZYkXCss4jJrMQA= -----END PKCS7----- <p7b filename> - 82 -

- 83 -

$ keytool -import -alias <Root alias name> -trustcacerts -file <rootca fillename> -keystore <keystore name> keystore 암호를입력하십시오 : <password1> 소유자 : CN=Root CA, OU=GPKI, O=Government of Korea, C=KR 발급자 : CN=Root CA, OU=GPKI, O=Government of Korea, C=KR 일련번호 : 3cc2814b00e7524d9baa47b7e161f50e 개시일 : Sun Apr 21 09:07:23 GMT 2002 만료일 : Sat Apr 21 09:07:23 GMT 2012 인증서지문 : MD5: C7:BD:11:D6:91:8A:35:82:C5:36:66:01:7C:6F:47:79 SHA1: 63:4C:3B:02:30:CF:1B:78:B4:56:9F:EC:F2:C0:4A:86:52:EF:EF:0E 이인증서를신뢰하십니까?[ 아니오 ]: y 인증이 keystore에추가되었습니다. $ keytool -import -alias <CA alias name> -trustcacerts -file <ca fillename> -keystore <keystore name> keystore 암호를입력하십시오 : <password1> 인증이 keystore에추가되었습니다. - 84 -

<p7b filename> $ keytool -import -alias <alias name> -trustcacerts -file <p7b filename> -keystore <keystore name> keystore 암호를입력하십시오 : <password1> 인증서회신이 keystore에설치되었습니다. <Connector port="443" protocol="http/1.1" SSLEnabled="true" maxthreads="150" minsparethreads="25" maxsparethreads="75" enablelookups="false" disableuploadtimeout="true" acceptcount="100" debug="0" scheme="https" secure="true" keystorepass="<password1>" keystorefile="<keystore name>" clientauth="false" sslprotocol="tls" /> - 85 -

- 86 -

. SSL javac ExportPriv.java <keystore> - keystorename, <alias> - key생성alias명, <password> - keystore password > 뒤의부분은키파일명을기재해주세요. java ExportPriv <keystore> <alias> <password> > exported-pkcs8.key - 87 -

< 예제 > 첫구동되는페이지에아래의스크립트를설정해준다. <script language="javascript" type="text/javascript"> var currentaddress = location.href; if (currentaddress.indexof("http://") == 0) { currentaddress = currentaddress.replace("http://","https://"); location.href = currentaddress; } </script> - 88 -

- 1 -

- 2 -

- 3 -

SSL - 4 -

- 1 -

- 2 -

- 3 -

- 4 -

- 5 -

SSLCertificateFile "<pem filename>" SSLCertificateKeyFile "<key filename>" SSLCertificateChainFile "<cachain.pem>" SSLCACertificateFile "<ca.pem>" - 6 -

- 7 -

- 8 -

<Connector port="443" protocol="http/1.1" SSLEnabled="true" maxthreads="150" minsparethreads="25" maxsparethreads="75" enablelookups="false" disableuploadtimeout="true" acceptcount="100" debug="0" scheme="https" secure="true" keystorepass="<password1>" keystorefile="<keystore name>" clientauth="false" sslprotocol="tls" /> - 9 -

- 1 -

- 2 -

- 3 -

- 4 -

- 5 -

- 6 -

- 7 -

- 8 -

- 9 -