SSL/TLSについて④ 証明書の発行方法、ルート証明書のインポート方法

1.CSRの発行方法(Linux OpenSSL)
2.自己認証局の設定・証明書の発行方法(Linux OpenSSL)
3.証明書の発行方法(Windows ADCA)
4.クライアントにおけるルート証明書のインポート方法（Windows端末)
5.おまけ

1.CSRの発行方法(Linux OpenSSL)

①サーバ用の秘密鍵生成

# openssl genrsa -out /etc/pki/tls/private/server.key 2048

Generating RSA private key, 2048 bit long modulus
...................................................+++
................+++
e is 65537 (0x10001)

②SAN用の情報作成

# vi /etc/pki/tls/openssl.cnf

[alt_names]
DNS.1 = test.com
DNS.2 = *.test.com

③サーバ用のCSR生成（サーバ側、認証局どちらでも可）

# openssl req -new -key /etc/pki/tls/private/server.key -out /etc/pki/tls/certs/server.csr

Enter pass phrase for /etc/pki/tls/private/privkey.pem: #①で入力したパスワードを入力

You are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank.-----

Country Name (2 letter code) [JP]: #国名、日本だとJP

State or Province Name (full name) [Tokyo]: #都道府県

Locality Name (eg, city) [Default City]: #市区町村

Organization Name (eg, company) [test inc]: #会社名

IT test (eg, section) : #部署名

Common Name (eg, your name or your server's hostname) : #アクセス先サーバのFQDN

④証明書の内容確認(テスト用に作成したCSRです）

# openssl req -text -noout -in /etc/pki/tls/certs/server.csr

Certificate Request:
Data:
Version: 0 (0x0)
Subject: C=JP, ST=Tokyo, L=Default City, O=test inc, OU=IT test, CN=test.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:d3:cf:af:cf:32:7f:3c:29:c4:cf:45:be:c8:1e:
16:e4:66:98:6c:02:9f:75:c9:07:d4:01:95:61:af:
6c:c9:d1:2d:ea:94:b4:5e:e3:0c:6a:3c:a9:27:25:
5d:7e:90:e6:dd:69:3c:fe:d3:21:55:b4:b9:bd:34:
3f:25:9f:d5:b9:5c:b6:d9:6e:94:90:a2:9e:46:01:
64:86:59:0d:9c:90:ab:02:e9:b1:cb:26:58:4b:19:
db:ef:6c:52:5d:a6:f4:dc:2d:b9:39:7e:97:53:f6:
97:71:b6:26:b8:9f:d4:f9:94:13:ab:6d:ac:42:2e:
9c:03:d5:94:70:0a:ae:2d:a4:44:56:75:80:ea:c3:
5a:df:42:d6:b9:2e:a5:45:e2:cf:3f:2b:c8:f3:2d:
e3:ed:9c:58:fe:74:dc:a5:0b:7a:b3:40:8b:8b:65:
f9:39:3f:6f:6b:b3:4b:41:d0:a7:ce:89:8c:56:52:
f0:b9:67:0d:39:b3:76:65:ba:f4:9a:35:e3:6d:23:
dd:78:52:22:17:f6:86:00:b6:58:a8:da:1c:b4:84:
f6:02:b8:de:ac:01:11:8a:f1:86:23:7b:50:1a:95:
da:15:53:ce:98:4c:fd:41:0d:dd:e4:e8:79:ed:30:
11:7f:bd:0b:1b:b9:c5:83:70:56:8a:9a:01:df:73:
89:59
Exponent: 65537 (0x10001)
Attributes:
Requested Extensions:
X509v3 Basic Constraints:
CA:FALSE
X509v3 Key Usage:
Digital Signature, Non Repudiation, Key Encipherment
X509v3 Subject Alternative Name:
DNS:test.com, DNS:*.test.com
Signature Algorithm: sha256WithRSAEncryption
10:cf:11:1b:a7:d2:f6:a9:e8:76:2c:73:4e:13:4c:1b:a1:e1:
b9:d7:16:19:2a:93:c6:fa:fa:ad:d9:6f:1d:8e:e8:50:64:13:
5d:c9:c7:17:0f:fc:5d:16:4f:90:27:bc:9f:d7:13:e6:5f:d3:
c5:48:1b:ca:c0:b2:d0:e4:ea:e4:23:aa:84:36:50:b6:2a:24:
7e:c9:4d:58:9c:e8:2b:98:72:de:e5:3a:7b:67:e7:8b:85:fc:
9e:8d:74:e4:36:79:ee:c8:56:37:ad:9c:1f:0f:aa:7a:88:26:
d0:8c:67:ea:27:19:fa:e7:dc:42:f9:12:e0:24:ef:bf:27:60:
54:0e:b3:37:68:c5:54:c4:45:9d:30:63:3b:d0:14:05:a4:4f:
da:e2:20:8f:8a:94:97:6d:4e:c3:07:c4:03:0d:28:96:d2:69:
39:a5:18:6d:12:dc:5f:2d:b0:fd:a0:17:81:71:f3:94:8b:46:
db:6d:68:20:94:e0:14:99:92:01:3f:ab:1d:98:8c:b2:a5:fa:
a1:21:4e:be:28:a2:68:62:eb:fe:37:49:ad:d9:c9:c5:b0:22:
05:88:fb:3f:6e:b5:c0:57:3c:39:15:61:42:ec:52:a7:18:81:
84:29:2f:46:19:52:f3:42:0c:ce:19:de:55:fb:a5:b5:79:0f:
41:f1:c7:2f

⑥CSRを中間認証局に送付、もしくは自己認証局にアップロードして完了となります。

2.自己認証局の設定・証明書の発行方法(Linux OpenSSL)

本手順はLinuxサーバを認証局とし、証明書を発行する方法です。本手順ではRHEL7.1を使用しております。SANに関する内容は後述いたします。

①OpenSSLのインストール

# yum -y install openssl

②認証局として使用するための設定変更

# vi /etc/pki/tls/openssl.cnf

##### [ CA_default ]ハッシュ方式の変更(デフォルト？） #####
default_md = sha256

##### [ req ]ハッシュ方式の変更 #####

default_md = sha256

req_extensions = v3_req

##### [ req_distinguished_name ]CSRで入力する内容を事前に決めておきたい方向け #####

countryName_default = JP #日本
stateOrProvinceName_default = Tokyo #都道府県
localityName_default = Shinjuku #市区町村
0.organizationName_default = test inc. #組織名

organizationalUnitName_default = IT test #部署名

##### [ v3_req ]SAN対応 #####

basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment

subjectAltName = @alt_names

③認証局用の秘密鍵生成

# openssl genrsa -aes256 -out /etc/pki/CA/private/cakey.pem 2048

Generating RSA private key, 2048 bit long modulus
..................................+++
.....................+++
e is 65537 (0x10001)
Enter pass phrase for /etc/pki/CA/private/cakey.pem:
Verifying - Enter pass phrase for /etc/pki/CA/private/cakey.pem:

④認証局用のCSR生成

# openssl req -new -key /etc/pki/CA/private/cakey.pem -out /etc/pki/CA/cacert.csr

Enter pass phrase for /etc/pki/CA/private/cakey.pem:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [JP]:
State or Province Name (full name) [Tokyo]:
Locality Name (eg, city) [Default City]:
Organization Name (eg, company) [test inc]:
IT test (eg, section) :
Common Name (eg, your name or your server's hostname) :
Email Address :

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password :
An optional company name []:

⑤認証局用の証明書生成（本証明書がルート証明書となる）

# openssl x509 -days 3650 -in /etc/pki/CA/cacert.csr -req -signkey /etc/pki/CA/private/cakey.pem -out /etc/pki/CA/cacert.pem

Signature ok
subject=/C=JP/ST=Tokyo/L=Default City/O=test inc
Getting Private key
Enter pass phrase for /etc/pki/CA/private/cakey.pem:

⑥証明書失効のための準備

# touch /etc/pki/CA/index.txt
# echo 00 > /etc/pki/CA/serial

⑦SAN用の情報作成

※証明書を複数発行する場合はopenssl.cnfに書くよりも外部に出したほうが管理が楽となると感じております。

# vi /etc/pki/tls/san1.ext

subjectAltName=DNS:test.com,DNS:*.test.com

⑧サーバ用の証明書発行（認証局にて実施）

# openssl ca -in /etc/pki/tls/certs/server.csr -out /etc/pki/tls/certs/server.crt -days 3650 -extfile /etc/pki/tls/san1.ext

Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for /etc/pki/CA/private/cakey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 2 (0x2)
Validity
Not Before: Feb 6 15:03:05 2019 GMT
Not After : Feb 3 15:03:05 2029 GMT
Subject:
countryName = JP
stateOrProvinceName = Tokyo
organizationName = test inc
organizationalUnitName = IT test
commonName = test.com
X509v3 extensions:
X509v3 Subject Alternative Name:
DNS:test.com, DNS:*.test.com
Certificate is to be certified until Feb 3 15:03:05 2029 GMT (3650 days)
Sign the certificate? [y/n]:y