# openssl genrsa 2048 > /etc/pki/CA/private/niikawa-test-ca.key
Generating RSA private key, 2048 bit long modulus
......+++
....+++
e is 65537 (0x10001)
# openssl req -new -key /etc/pki/CA/private/niikawa-test-ca.key -sha256 -out /etc/pki/CA/niikawa-test-cacert.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:JP
State or Province Name (full name) []:Mie
Locality Name (eg, city) [Default City]:Kuwana
Organization Name (eg, company) [Default Company Ltd]:oji-cloud
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:niikawa-test-ca
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
# openssl x509 -days 1095 -in /etc/pki/CA/niikawa-test-cacert.csr -req -signkey /etc/pki/CA/private/niikawa-test-ca.key -out /etc/pki/CA/certs/niikawa-test-cacert.pem
Signature ok
subject=/C=JP/ST=Mie/L=Kuwana/O=oji-cloud/CN=niikawa-test-ca
Getting Private key
# openssl genrsa 2048 > /etc/pki/tls/private/niikawa-test-servercert.key
Generating RSA private key, 2048 bit long modulus
........................................................................+++
...................................................................................................................................................+++
e is 65537 (0x10001)
# openssl req -new -key /etc/pki/tls/private/niikawa-test-servercert.key -sha256 -out /etc/pki/tls/niikawa-test-servercert.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:JP
State or Province Name (full name) []:Mie
Locality Name (eg, city) [Default City]:Kuwana
Organization Name (eg, company) [Default Company Ltd]:oji-cloud
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:niikawa-test-http.oji-cloud.net
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
# openssl ca -days 1095 -in /etc/pki/tls/niikawa-test-servercert.csr -out /etc/pki/tls/certs/niikawa-test-servercert.pem -keyfile /etc/pki/CA/private/niikawa-test-ca.key -cert /etc/pki/CA/certs/niikawa-test-cacert.pem
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Sep 24 12:33:47 2020 GMT
Not After : Sep 24 12:33:47 2023 GMT
Subject:
countryName = JP
stateOrProvinceName = Mie
organizationName = oji-cloud
commonName = niikawa-test-http.oji-cloud.net
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
35:D0:A1:40:EC:F3:8D:C9:FC:16:E2:7B:69:55:C7:0E:46:1D:F1:6B
X509v3 Authority Key Identifier:
DirName:/C=JP/ST=Mie/L=Kuwana/O=oji-cloud/CN=niikawa-test-ca
serial:9F:CC:AC:49:33:C1:34:FD
Certificate is to be certified until Sep 24 12:33:47 2023 GMT (1095 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
#
# Server Certificate:
# Point SSLCertificateFile at a PEM encoded certificate. If
# the certificate is encrypted, then you will be prompted for a
# pass phrase. Note that a kill -HUP will prompt again. A new
# certificate can be generated using the genkey(1) command.
SSLCertificateFile /etc/pki/tls/certs/niikawa-test-servercert.pem ← 変更
# Server Private Key:
# If the key is not combined with the certificate, use this
# directive to point at the key file. Keep in mind that if
# you've both a RSA and a DSA private key you can configure
# both in parallel (to also allow the use of DSA ciphers, etc.)
SSLCertificateKeyFile /etc/pki/tls/private/niikawa-test-servercert.key ← 変更
# Certificate Authority (CA):
# Set the CA certificate verification path where to find CA
# certificates for client authentication or alternatively one
# huge file containing all of them (file must be PEM encoded)
SSLCACertificateFile /etc/pki/CA/certs/niikawa-test-cacert.pem ← 変更
しかし、今回は自己証明書を利用しているため、“SSL certificate problem" が出力されました。"self signed certificate in certificate chain" とあり、自己署名証明書のためエラーとなっているようです。
niikawa@niikawa1:~$ curl -vv https://niikawa-test-http.oji-cloud.net
* Rebuilt URL to: https://niikawa-test-http.oji-cloud.net/
* Trying XX.XX.XX.XX...
* TCP_NODELAY set
* Connected to niikawa-test-http.oji-cloud.net (XX.XX.XX.XX) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (OUT), TLS alert, Server hello (2):
* SSL certificate problem: self signed certificate in certificate chain
* stopped the pause stream!
* Closing connection 0
curl: (60) SSL certificate problem: self signed certificate in certificate chain
More details here: https://curl.haxx.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
自己署名証明書利用時に指定するcurl オプション
自己署名証明書利用時に出力された"SSL certificate problem" を回避するため、curl に“–insecure"オプションを追加します。次は無事にリクエストが送られ、レスポンス 200 OK も返りました。