Webtob( 멀티도메인 ) SSL 인증서갱신설치가이드. [ 고객센터 ] 한국기업보안. 유서트기술팀 02-512-9375
멀티및와일드인증서의경우포트번호를동일하게설정이가능하다. (https 통신으로 443 으로통일가능 ) 1. 발급받으신인증서를해당 SSL 폴더에업로드또는저장합니다. [root@localhost New]$ cp star.ucert.co.kr* /webtob/ssl [root@localhost New]$ cd /webtob/ssl [root@localhost ssl]$ ll -rw-r--r--. 1 root root 1931 Jan 1 00:00 GeoTrust_CA.ca-bundle -rw-r--r--. 1 root root 1744 Jan 1 00:00 star.ucert.co.kr.crt -rw-r--r--. 1 root root 1931 Jan 1 00:00 star.ucert.co.kr.key -rw-r--r--. 1 root root 1931 Jan 1 00:00 Equifax_Secure_Certificate_Authority.cer -rw-r--r--. 1 root root 1744 Jan 1 00:00 password.txt 2. [$Webtob_Home]/config/ http.m 파일을열어 SSL 환경설정을합니다. 설명 : [$Webtob_Home] = Webtob 디렉토리 [root@localhost webtob]$ vi config/http.m *NODE UCERT WEBTOBDIR="/usr/local/webapp/webtob ", SHMKEY = 54000, DOCROOT="/usr/local/webapp/webtob/docs/ucert/", 서버마다고유의 NODENAME 이존재합니다. // 기본홈디렉토리 PORT = "80", // 설명 : 기본 http 포트 HTH = 2 // 설명 : Jesus 연동 Count JSVPORT = 9900, // 설명 : Jesus 연동포트 IPCPERM = 0777, NODENAME = "$(NODENAME)", SERVICEORDER = "ext,uri", INDEXNAME = "index.jsp,index.html,index.htm", LOGGING = "log1", ERRORLOG = "log2" *VHOST ucert_ssl DOCROOT="/usr/local/webapp/webtob/docs/ucert/" // 홈디렉토리, NODENAME=ucert, PORT="443", SSLFLAG=Y, SSLNAME="ucertssl", HOSTNAME = "star.ucert.co.kr", HOSTALIAS = "111.222.111.222", // 대표도메인외지정하실별칭 ServiceOrder="uri,ext",
LOGGING="log1_vhmytx", ERRORLOG="log2_vhmytx" legend_ssl DOCROOT="/usr/local/webapp/webtob/docs/legend/" // *.legend.co.kr홈디렉토리, NODENAME=ucert, PORT="443", // 설명 : 포트번호를동일하게설정하여도상관없다. SSLFLAG=Y, SSLNAME="ucertssl", // 설명 : SSLNAME을동일하게설정토록한다. HOSTNAME = legend.ucert.co.kr", HOSTALIAS = "111.222.111.222", // 대표도메인외지정하실별칭 ServiceOrder="uri,ext", LOGGING="log1_vhmytx", ERRORLOG="log2_vhmytx" *SSL ucertssl CertificateFile = "/usr/local/webtob/config/ssl/star.ucert.co.kr.crt", * 설명 : 인증서경로설정및파일명 CertificateKeyFile = "/usr/local/webtob/config/ssl/star.ucert.co.kr.key", * 설명 : 개인키경로설정및파일명 CACertificateFile = "/usr/local/webtob/config/ssl/star.ucert.co.kr.root-bundle", * 설명 : Root 인증서경로설정및파일명 CertificateChainFile ="/usr/local/webtob/config/ssl/star.ucert.co.kr.ca-bundle", * 설명 : Chain 인증서경로설정및파일명 PassPhraseDialog="exec:/usr/local/webtob/config/ssl/pass.sh" * 설명 : 재시작시비밀번호입력없이재시작이가능하게한다. *SVRGROUP htmlg SVRTYPE = HTML jsvg SVRTYPE = JSV, VhostName = "ucert, ucert_ssl" // Servlet 호출을위한 Jeus 연동할가상호스트선언 *SERVER html SVGNAME = htmlg, MinProc = 50, MaxProc = 50, ASQCount = 1 MyGroup SVGNAME = jsvg, MinProc = 100, MaxProc = 200 *URI uri1 Uri = "/", Svrtype = JSV, SvrName = MyGroup, VhostName = " ucert, ucert_ssl " // Servlet 호출을위한 Jeus 연동할가상호스트선언
3. 패스워드쉘생성하기. [root@localhost ssl]$ vi pass.sh #!/bin/sh echo ucert.co.kr // 설명 : echo password 를입력하도록한다. :wq [root@localhost ssl]$ ll -rw-r--r--. 1 root root 1931 Jan 1 00:00 star.ucert.co.kr.ca-bundle -rw-r--r--. 1 root root 1744 Jan 1 00:00 star.ucert.co.kr.crt -rw-r--r--. 1 root root 1931 Jan 1 00:00 star.ucert.co.kr.key -rw-r--r--. 1 root root 1931 Jan 1 00:00 star.ucert.co.kr.root-bundle -rw-r--r--. 1 root root 1931 Jan 1 00:00 pass.sh 4. 파일명변환해주기. ( 기존인증서는반드시백업을할수있도록한다.) [root@localhost ssl]$ mv GeoTrust_CA.ca-bundle star.ucert.co.kr.ca-bundle oot@localhost ssl]$ mv Equifax_Secure_Certificate_Authority.cer star.ucert.co.kr.root-bundle oot@localhost ssl]$ ll -rw-r--r--. 1 root root 1931 Jan 1 00:00 star.ucert.co.kr.ca-bundle -rw-r--r--. 1 root root 1744 Jan 1 00:00 star.ucert.co.kr.crt -rw-r--r--. 1 root root 1931 Jan 1 00:00 star.ucert.co.kr.key -rw-r--r--. 1 root root 1931 Jan 1 00:00 star.ucert.co.kr.root-bundle -rw-r--r--. 1 root root 1931 Jan 1 00:00 pass.sh 5. Webtob 재시작 [root@localhost webtob]# wscfl i http.m // 설명 : 환경파일컴파일 urrent configuration: Number of client handler(hth) = 1 Supported maximum user per node = 4047 Supported maximum user per handler = 4047 Successfully created the configuration file (/root/webtob/config/wsconfig) for node UCERT. The host name of the running machine is UCERT.
[root@localhost webtob]# wsdown Do you really want to shut down WebtoB? (y : n): y WSDOWN for node(localhost) is starting: WSDOWN: SERVER(html:1) downed: Fri Jan 1 00:00:00 2016 WSDOWN: SERVER(html:0) downed: Fri Jan 1 00:00:00 2016 WSDOWN: SERVER(cgi:11) downed: Fri Jan 1 00:00:00 2016 WSDOWN: SERVER(ssi:21) downed: Fri Jan 1 00:00:00 2016 WSDOWN: SERVER(ssi:20) downed: Fri Jan 1 00:00:00 2016 WSDOWN: SERVER(cgi:10) downed: Fri Jan 1 00:00:00 2016 WSDOWN: HTL downed: Fri Jan 1 00:00:00 2016 WSDOWN: HTH downed: Fri Jan 1 00:00:00 2016 WSDOWN: WSM downed: Fri Jan 1 00:00:00 2016 WSDOWN: WebtoB is down [root@localhost webtob]# wsboot Booting WebtoB on node (UCERT) Welcome to WebtoB demo system. It will expire on 2016/06/27 Today is 2016/06/07 Starting WSM at Fri Jan 1 00:00:00 2016 Starting HTL at Fri Jan 1 00:00:00 2016 Starting HTH at Fri Jan 1 00:00:00 2016 Current WebtoB Configuration: Number of client handlers (HTH) = 1 Supported maximum user per node = 4047 Supported maximum user per handler = 4047 Starting SVR(htmls) at Fri Jan 1 00:00:00 2016 Starting SVR(htmls) at Fri Jan 1 00:00:00 2016 Starting SVR(cgis) at Fri Jan 1 00:00:00 2016 Starting SVR(cgis) at Fri Jan 1 00:00:00 2016 Starting SVR(ssis) at Fri Jan 1 00:00:00 2016 Starting SVR(ssis) at Fri Jan 1 00:00:00 2016 6. 포트확인 : 설정하신 SSL 포트가 Listen 상태인지확인합니다. [root@localhost ~]# netstat -nlp grep htl tcp 0 0 :::80 :::* LISTEN tcp 0 0 :::443 :::* LISTEN 웹브라우져주소창에 https:// 도메인 :SSL 포트 를입력하여접속이되는지확인합니다. SSL 기본포트인 443 포트로설정하셨다면 https:// 도메인으로접속해주셔도됩니다.
7. 서버내에서인증서갱신을확인하도록합니다. [root@localhost ~]# echo "" openssl s_client -connect localhost:443 openssl x509 -noout -dates 위의명령어를입력하여인증서갱신날짜를확인하도록합니다. notbefore=jan 1 00:24:14 2016 GMT notafter=dec 31 :38:20 2017 GMT # 인증서시작일 # 인증서만료일
8. 웹페이지에서의인증서확인방법 익스플로러확인방법 https://star.ucert.co.kr 접속예 도메인접속후에 Alt 키를누르고파일 속성 인증서클릭후인증서보기를선택하시면인증서정보를확인할수있습니다. 발급대상과유효기간이맞는지 확인합니다.