Debian 11.2にサーバSSL証明書と鍵を作成する方法

2022年5月26日2022年9月3日

環境
OSバージョンを確認します
# cat /etc/debian_version
11.2

apache2バージョンを確認します

# apache2 -v
Server version: Apache/2.4.53 (Debian)
Server built: 2022-03-14T16:28:35

操作方法
1.秘密鍵のファイル名（server.key）を作成します

#  cd /etc/ssl/private
#  openssl genrsa -aes128 -out server.key 2048
Generating RSA private key, 2048 bit long modulus (2 primes)
............+++++
...........+++++
e is 65537 (0x010001)
Enter pass phrase for server.key:　# パスフレーズ設定
Verifying - Enter pass phrase for server.key:# 確認再入力

2.秘密鍵からパスフレーズを削除します

# openssl rsa -in server.key -out server.key
Enter pass phrase for server.key:　# パスフレーズ
writing RSA key

3.作成するサーバ証明書のファイル名(server.csr)を作成します

#  openssl req -new -days 3650 -key server.key -out server.csr
Ignoring -days; not generating a certificate
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:JP　　 # 国コード
State or Province Name (full name) [Some-State]:Tokyo　# 	市町村名
Locality Name (eg, city) []:Shinagawa　　 # 都市
Organization Name (eg, company) [Internet Widgits Pty Ltd]:ARKGAME　 # 	団体名または会社名
Organizational Unit Name (eg, section) []:develop　　# 部署名
Common Name (e.g. server FQDN or YOUR name) []:dlp.arkgame.com  # サーバーのFQDN
Email Address []:contact@arkgame.com  # 管理者の電子メールアドレス

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:arkgame
An optional company name []:ark

4.SSL用サーバ証明書を生成します

# openssl x509 -in server.csr -out server.crt -req -signkey server.key -days 3650
Signature ok
subject=C = JP, ST = Tokyo, L = Shinagawa, O = ARKGAME, OU = arkgame, CN = dlp.arkgame.com, emailAddress = contact@arkgame.com
Getting Private key

SSL証明書の確認

# ls
server.crt  server.csr  server.key  ssl-cert-snakeoil.key