리눅스 사설아이피 openssl 설치

ssl_1 은 내가 하고싶은 이름이므로, 사용하고싶은 명칭을 쓰면 됨

 

[user@localhost ~]$ openssl genrsa -des3 -out ssl_1.key 2048
Generating RSA private key, 2048 bit long modulus
..........+++
...........................................................................................+++
e is 65537 (0x10001)
Enter pass phrase for ssl_1.key:
# 비밀번호입력
Verifying - Enter pass phrase for ssl_1.key:
# 비밀번호 재입력


[user@localhost ~]$ openssl req -new -key ssl_1.key -out ssl_1.csr
Enter pass phrase for ssl_1.key:
# 위에서 비밀번호입력한 비밀번호 입력
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:KR
State or Province Name (full name) []:Seoul
Locality Name (eg, city) [Default City]:GangNam
Organization Name (eg, company) [Default Company Ltd]:회사명
Organizational Unit Name (eg, section) []:제품명
Common Name (eg, your name or your server's hostname) []:사설아이피입력
Email Address []:이메일주소

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:비밀번호
An optional company name []:
[user@localhost ~]$ openssl rsa -in ssl_1.key -out ssl_1_nopass.key
Enter pass phrase for ssl_1.key:
writing RSA key
[user@localhost ~]$ openssl x509 -req -days 365 -in ssl_1.csr -signkey ssl_1_nopass.key  -out ssl_1.crt
Signature ok
subject=/C=KR/ST=Seoul/L=GangNam/O=회사명/OU=제품명/CN=사설아이피/emailAddress=이메일주소
Getting Private key
[user@localhost ssl]$ openssl pkcs12 -export -in ssl_1.crt -inkey ssl_1.key -out ssl_1.p12 -name tomcat
Enter Export Password:
Verifying - Enter Export Password:

-- ========================
[user@localhost ssl]$ ll

-rw-rw-r--. 1 user user 1326  1월 11 11:18 ssl_1.crt
-rw-rw-r--. 1 user user 1102  1월 11 11:06 ssl_1.csr
-rw-rw-r--. 1 user user 1743  1월 11 10:53 ssl_1.key
-rw-rw-r--. 1 user user 1675  1월 11 11:18 ssl_1_nopass.key
-rw-rw-r--. 1 user user 2594  1월 11 12:16 ssl_1_nopass.p12
[user@localhost ssl]$

 

위에서부터 순서대로 하면 된다.

 

근데 이건 openssl이라 톰캣 실제 운영할떄 구매해서 사용하는 ssl이랑 설정이 조금 다르다

 

우선 톰캣 server.xml 변경할 것 (설치한 ssl을 443포트로 사용할 것이라는 가정하에)

 

<Connector protocol="org.apache.coyote.http11.Http11NioProtocol"
port="443" SSLEnabled="true" maxThreads="200"
    scheme="https" secure="true"
    keystoreFile="p12 경로"
    keystorePass="p12 비밀번호"
    keystoreType="pkcs12"
    clientAuth="false"
    sslProtocol="TLS" />

 

그다음 톰캣 conf 디렉토리 하위에 web.xml에 다음 코드를 추가한다.

 

    <security-constraint>
       <web-resource-collection>
          <web-resource-name>SSL Forward</web-resource-name>
          <url-pattern>/*</url-pattern>
       </web-resource-collection>
       <user-data-constraint>
         <transport-guarantee>CONFIDENTIAL</transport-guarantee>
      </user-data-constraint>
   </security-constraint>

 

톰캣 재기동 후 설치확인한다.

openssl s_client -host 사설아이피 -port 443 -tls1_2

 

설치확인이 됬는데 https가 안떠서 확인해보니 포트사용중이긴하나 방화벽에서 허용된 포트가 아니라 안뜨는거엿음.

아래443포트추가후 완료

 

 $ 443포트 추가
 firewall-cmd --permanent --zone=public --add-port=443/tcp
 # 반드시 재시작 필요
 firewall-cmd --reload

 

다음 포스팅에선 openssl 적용한 후 haproxy적용하는 방법을 적어봐야지

2022.04.07 - [개발/리눅스] - openssl 적용한 후 haproxy적용하는 방법