OpenSSL 로 ROOT CA 생성및 SSL 인증서발급 개요 Self Signed Certificate(SSC) 란? CSR(Certificate Signing Request) 은? ROOT CA 인증서생성 SSL 인증서생성 apache httpd 에 SSL 적용같이보기 개요 웹서비스에 https 를적용할경우 SSL 인증서를 VeriSign 이나 Thawte, GeoTrust 등에서인증서를발급받아야하지만비용이발생하므로실제운영서버가아니면발급받는데부담이될수있다. 이럴때 OpenSSL 을이용하여인증기관을만들고 Self signed certificate 를생성하고 SSL 인증서를발급하는법을정리해본다. 발급된 SSL 인증서는 apache httpd 등의 Web Server 에설치하여손쉽게 https 서비스를제공할수있다. Self Signed Certificate(SSC) 란? 인증서 (digital certificate) 는개인키소유자의공개키 (public key) 에인증기관의개인키로전자서명한데이타다. 모든인증서는발급기관 (CA) 이있어야하나최상위에있는인증기관 (root ca) 은서명해줄상위인증기관이없으므로 root ca 의개인키로스스로의인증서에서명하여최상위인증기관인증서를만든다. 이렇게스스로서명한 ROOT CA 인증서를 Self Signed Certificate 라고부른다. IE, FireFox, Chrome 등의 Web Browser 제작사는 VeriSign 이나 comodo 같은유명 ROOT CA 들의인증서를신뢰하는 CA 로미리등록해놓으므로저런기관에서발급된 SSL 인증서를사용해야 browser 에서는해당 SSL 인증서를신뢰할수있는데 OpenSSL 로만든 ROOT CA 와 SSL 인증서는 Browser 가모르는기관이발급한인증서이므로보안경고를발생시킬것이나테스트사용에는지장이없다. ROOT CA 인증서를 Browser에추가하여보안경고를발생시키지않으려면 Browser 에 SSL 인증서발급기관추가하기를참고하자. CSR(Certificate Signing Request) 은? 공개키기반 (PKI) 은 private key( 개인키 ) 와 public key( 공개키 ) 로이루어져있다. 인증서라고하는것은내공개키가맞다고인증기관 (CA) 이전자서명하여주는것이며나와보안통신을하려는당사자는내인증서를구해서그안에있는공개키를이용하여보안통신을할수있다. CSR 은인증기관에인증서발급요청을하는특별한 ASN.1 형식의파일이며 ( PKCS10 - RFC2986) 그안에는내공개키정보와사용하는알고리즘정보등이들어있다. 개인키는외부에유출되면안되므로저런특별한형식의파일을만들어서인증기관에전달하여인증서를발급받는다. SSL 인증서발급시 CSR 생성은 Web Server 에서이루어지는데 Web Server 마다방식이상이하여사용자들이 CSR 생성등을어려워하니인증서발급대행기관에서개인키까지생성해서보내주고는한다. ROOT CA 인증서생성 openssl 로 root ca 의개인키와인증서를만들어보자 1. CA 가사용할 RSA key pair(public, private key) 생성 2048bit 개인키생성 openssl genrsa -aes256 -out /etc/pki/tls/private/lesstif-rootca.key 2048 개인키분실에대비해 AES 256bit 로암호화한다. AES 이므로암호 (pass phrase) 를분실하면개인키를얻을수없으니꼭기억해야한다.
2. 개인키권한설정 보안경고개인키의유출방지를위해 group 과 other 의 permission 을모두제거한다. chmod 600 /etc/pki/tls/private/lesstif-rootca.key 3. CSR(Certificate Signing Request) 생성을위한 rootca_openssl.conf 로저장 rootca_openssl.conf [ req ] default_bits = 2048 default_md = sha1 default_keyfile = lesstif-rootca.key distinguished_name = req_distinguished_name extensions = v3_ca req_extensions = v3_ca [ v3_ca ] basicconstraints = critical, CA:TRUE, pathlen:0 subjectkeyidentifier = hash authoritykeyidentifier = keyid:always, issuer:always keyusage = keycertsign, crlsign nscerttype = sslca, emailca, objca [req_distinguished_name ] countryname = Country Name (2 letter code) countryname_default = KR countryname_min = 2 countryname_max = 2 organizationname organizationname_default = Organization Name (eg, company) = lesstif Inc. organizationalunitname = Organizational Unit Name (eg, section) organizationalunitname_default = Condor Project SSL domain commonname = Common Name (eg, your name or your server's hostname) commonname_default = lesstif's Self Signed CA commonname_max = 64
인증서요청생성 root@lesstif:~:> openssl req -new -key /etc/pki/tls/private/lesstif-rootca.key -out /etc/pki/tls/certs/lesstif-rootca.csr -config rootca_openssl.conf You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [KR]: Organization Name (eg, company) [lesstif Inc]:lesstif Inc. Common Name (eg, your name or your servers hostname) [lesstif's Self Signed CA]:lesstif's Self Signed CA 4. 10년짜리 self-signed 인증서생성 -extensions v3_ca. openssl x509 -req \ -days 3650 \ -extensions v3_ca \ -set_serial 1 \ -in /etc/pki/tls/certs/lesstif-rootca.csr \ -signkey /etc/pki/tls/private/lesstif-rootca.key \ -out /etc/pki/tls/certs/lesstif-rootca.crt \ -extfile rootca_openssl.conf 서명에사용할해시알고리즘을변경하려면 -sha256, -sha384, -sha512 처럼해시를지정하는옵션을전달해준다. 기본값은 -sha256 이며 openssl 1.0.2 이상이필요 5. 제대로생성되었는지확인을위해인증서의정보를출력해본다. openssl x509 -text -in /etc/pki/tls/certs/lesstif-rootca.crt SSL 인증서생성 위에서생성한 root ca 서명키로 SSL 인증서를발급해보자 1. SSL 호스트에서사용할 RSA key pair(public, private key) 생성
2048bit 개인키생성 openssl genrsa -aes256 -out /etc/pki/tls/private/lesstif.com.key 2048 2. Remove Passphrase from key 개인키를보호하기위해 Key-Derived Function 으로개인키자체가암호화되어있다. 인터넷뱅킹등에사용되는개인용인증서는당연히저렇게보호되어야하지만 SSL 에사용하려는키가암호가걸려있으면 httpd 구동때마다 pass phrase 를입력해야하므로암호를제거한다. 개인키 pass phrase 제거 cp /etc/pki/tls/private/lesstif.com.key /etc/pki/tls/private/lesstif.com.key.enc openssl rsa -in /etc/pki/tls/private/lesstif.com.key.enc -out /etc/pki/tls/private/lesstif.com.key 보안경고개인키의유출방지를위해 group 과 other 의 permission 을모두제거한다. chmod 600 /etc/pki/tls/private/lesstif.com.key* 3. CSR(Certificate Signing Request) 생성을위한 host_openssl.conf 로저장
host_openssl.conf [ req ] default_bits = 2048 default_md = sha1 default_keyfile = lesstif-rootca.key distinguished_name = req_distinguished_name extensions = v3_user extension authoritykeyidentifier. req_extensions = v3_user [ v3_user ] Extensions to add to a certificate request basicconstraints = CA:FALSE authoritykeyidentifier = keyid,issuer subjectkeyidentifier = hash keyusage = nonrepudiation, digitalsignature, keyencipherment SSL extendedkeyusage = serverauth,clientauth subjectaltname = @alt_names [ alt_names] Subject AltName DNSName field SSL Host. *.lesstif.com. DNS.1 = www.lesstif.com DNS.2 = lesstif.com DNS.3 = *.lesstif.com [req_distinguished_name ] countryname = Country Name (2 letter code) countryname_default = KR countryname_min = 2 countryname_max = 2 organizationname organizationname_default = Organization Name (eg, company) = lesstif Inc. organizationalunitname = Organizational Unit Name (eg, section) organizationalunitname_default = lesstif SSL Project SSL domain commonname = Common Name (eg, your name or your server's hostname) commonname_default = lesstif.com commonname_max = 64
SSL 인증서요청 root@lesstif:~:> openssl req -new -key /etc/pki/tls/private/lesstif.com.key -out /etc/pki/tls/certs/lesstif.com.csr -config host_openssl.conf You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [KR]: Organization Name (eg, company) [lesstif Inc]:lesstif's Self Signed CA Common Name (eg, your name or your servers hostname) [lesstif.com]:*.lesstif.com 4. 5년짜리 lesstif.com 용 SSL 인증서발급 ( 서명시 ROOT CA 개인키로서명 ) openssl x509 -req -days 1825 -extensions v3_user -in /etc/pki/tls/certs/lesstif.com.csr \ -CA /etc/pki/tls/certs/lesstif-rootca.crt -CAcreateserial \ -CAkey /etc/pki/tls/private/lesstif-rootca.key \ -out /etc/pki/tls/certs/lesstif.com.crt -extfile host_openssl.conf 5. 제대로생성되었는지확인을위해인증서의정보를출력해본다. openssl x509 -text -in /etc/pki/tls/certs/lesstif.com.crt apache httpd 에 SSL 적용 apache httpd 에 SSL/HTTPS 적용및 VirtualHost 에 SNI(Server Name Indication) 문제해결참고 같이보기 OpenSSL 자주쓰는명령어 (command) 및사용법, tip 정리