![[PukiWiki]](image/pukiwiki.png "[PukiWiki]")
Webページへのアクセス制限にクライアント証明書によるアクセス制限をかける。ここでは、サーバー側で発行したクライアント証明書をインストールした端末(PC、スマホ)からしか特定のWebページへアクセスできないようにする。ただし、内部からはアクセス制限なしにアクセスできるようにする。
ユーザー名／パスワードによるアクセス制限では、ユーザー名／パスワードが漏れると誰でもアクセスできてしまうが、クライアント証明書によるアクセス制限では、サーバー側で発行したクライアント証明書をインストールした端末(PC、スマホ)からしかアクセスできないため、より強固なアクセス制限が可能となる。
※Webサーバー、Webサーバー間通信内容暗号化が導入済であること
| [root@localhost ~]# vi /etc/pki/tls/misc/CA ← CAスクリプト編集 |
| CADAYS="-days 36500" ← CA証明書有効期限を100年(事実上無期限)にする |
| [root@localhost ~]# vi /etc/pki/tls/openssl.cnf ← openssl.cnf編集 |
| # Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs # so this is commented out by default to leave a V1 CRL. # crlnumber must also be commented out to leave a V1 CRL. # crl_extensions = crl_ext default_days = 36500 ← クライアント証明書有効期限を100年(事実上無期限)にする default_crl_days= 30 # how long before next CRL default_md = sha256 # use SHA-256 by default preserve = no # keep passed DN ordering [ req_distinguished_name ] countryName = Country Name (2 letter code) countryName_default = JP ← 国コードを指定 countryName_min = 2 countryName_max = 2 stateOrProvinceName = State or Province Name (full name) #stateOrProvinceName_default = Default Province stateOrProvinceName_default = Tokyo ← 都道府県を指定 localityName = Locality Name (eg, city) localityName_default = shinjuku ← 市区町村を指定 0.organizationName = Organization Name (eg, company) 0.organizationName_default = hogehoge ← サーバー名を指定 # we can do this but it is not needed normally :-) #1.organizationName = Second Organization Name (eg, company) #1.organizationName_default = World Wide Web Pty Ltd organizationalUnitName = Organizational Unit Name (eg, section) #organizationalUnitName_default = commonName = Common Name (eg, your name or your server\'s hostname) commonName_max = 64 emailAddress = Email Address emailAddress_max = 64 emailAddress_default = webmaster@hogehoge ← サーバー管理者メールアドレスを指定 |
| [root@localhost ~]# cp /etc/pki/tls/openssl.cnf /etc/pki/tls/openssl-ca.cnf ← openssl.cnfをコピーしてCA用openssl.cnfを作成 |
| [root@localhost ~]# vi /etc/pki/tls/openssl-ca.cnf ← CA用openssl.cnf編集 |
| [ usr_cert ] # These extensions are added when 'ca' signs a request. # This goes against PKIX guidelines but some CAs do it and some software # requires this to avoid interpreting an end user certificate as a CA. basicConstraints=CA:TRUE ← CA用にする [ v3_ca ] # Extensions for a typical CA # PKIX recommendation. subjectKeyIdentifier=hash authorityKeyIdentifier=keyid:always,issuer # This is what PKIX recommends but some broken software chokes on critical # extensions. #basicConstraints = critical,CA:true # So we do this instead. basicConstraints = CA:true # Key usage: this is typical for a CA certificate. However since it will # prevent it being used as an test self-signed certificate it is best # left out by default. # keyUsage = cRLSign, keyCertSign # Some might want this also nsCertType = sslCA, emailCA ← CA用にする |
| [root@localhost ~]# cp /etc/pki/tls/openssl.cnf /etc/pki/tls/openssl-client.cnf ← openssl.cnfをコピーしてクライアント用openssl.cnfを作成 |
| [root@localhost ~]# vi /etc/pki/tls/openssl-client.cnf ← クライアント用openssl.cnf編集 |
| [ usr_cert ] # These extensions are added when 'ca' signs a request. # This goes against PKIX guidelines but some CAs do it and some software # requires this to avoid interpreting an end user certificate as a CA. basicConstraints=CA:FALSE # Here are some examples of the usage of nsCertType. If it is omitted # the certificate can be used for anything *except* object signing. # This is OK for an SSL server. # nsCertType = server # For an object signing certificate this would be used. # nsCertType = objsign # For normal client use this is typical # nsCertType = client, email # and for everything including object signing: nsCertType = client, email, objsign ← クライアント用にする |
| SSLEAY_CONFIG="-config /etc/pki/tls/openssl-ca.cnf" /etc/pki/tls/misc/CA -newca ← CA証明書作成 |
| CA certificate filename (or enter to create) ← 空ENTER Making CA certificate ... Generating a 2048 bit RSA private key ..........................+++ .........................+++ writing new private key to '/etc/pki/CA/private/./cakey.pem' Enter PEM pass phrase: ← 任意のCA秘密鍵パスフレーズ応答 Verifying - Enter PEM pass phrase: ← 任意のCA秘密鍵パスフレーズ応答(確認) ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [JP]: ← 空ENTER State or Province Name (full name) [Tokyo]: ← 空ENTER Locality Name (eg, city) [shinjuku]: ← 空ENTER Organization Name (eg, company) [hoge.com]: ← 空ENTER Organizational Unit Name (eg, section) []: ← 空ENTER Common Name (eg, your name or your server's hostname) []:hoge.com ← サーバー名を応答 Email Address [webmaster@hoge.com]: ← 空ENTER Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: ← 空ENTER An optional company name []: ← 空ENTER Using configuration from /etc/pki/tls/openssl-ca.cnf Enter pass phrase for /etc/pki/CA/private/./cakey.pem: ← CA秘密鍵パスフレーズ応答 Check that the request matches the signature Signature ok Certificate Details: Serial Number: a9:30:4e:7e:67:c0:62:1b Validity Not Before: Oct 17 04:12:26 2017 GMT Not After : Sep 23 04:12:26 2117 GMT Subject: countryName = JP stateOrProvinceName = Tokyo organizationName = hoge.com commonName = hoge.com emailAddress = webmaster@hoge.com X509v3 extensions: X509v3 Subject Key Identifier: 5D:D8:35:14:AE:15:42:2A:BA:AA:2E:C0:58:27:01:33:D3:9E:CF:FC X509v3 Authority Key Identifier: keyid:5D:D8:35:14:AE:15:42:2A:BA:AA:2E:C0:58:27:01:33:D3:9E:CF:FC X509v3 Basic Constraints: CA:TRUE Netscape Cert Type: SSL CA, S/MIME CA Certificate is to be certified until Sep 23 04:12:26 2117 GMT (36500 days) Write out database with 1 new entries Data Base Updated |
| [root@localhost ~]# echo 00 > /etc/pki/CA/crlnumber ← 証明書失効に必要なcrlnumber初期作成※証明書失効については後述 |
| Generating a 2048 bit RSA private key ......+++ .........+++ writing new private key to 'newkey.pem' Enter PEM pass phrase: ← 任意のクライアント証明書パスフレーズ応答 Verifying - Enter PEM pass phrase: ← 任意のクライアント証明書パスフレーズ応答(確認) ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [JP]: ← 空ENTER State or Province Name (full name) [Tokyo]: ← 空ENTER Locality Name (eg, city) [shinjuku]: ← 空ENTER Organization Name (eg, company) [hoge.com]:& color(lime){← 空ENTER}; Organizational Unit Name (eg, section) []: ← 空ENTER Common Name (eg, your name or your server's hostname) []:user1 ← 任意のユーザー名を応答 Email Address [webmaster@hoge.com]:user1@hoge.com ← ユーザーのメールアドレスを応答 Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: ← 空ENTER An optional company name []: ← 空ENTER Request is in newreq.pem, private key is in newkey.pem |
| [root@localhost ~]# SSLEAY_CONFIG="-config /etc/pki/tls/openssl-client.cnf" /etc/pki/tls/misc/CA -sign ← クライアント署名要求に署名してクライアント証明書作成 |
| Using configuration from /etc/pki/tls/openssl.cnf Enter pass phrase for /etc/pki/CA/private/cakey.pem: ← CA秘密鍵パスフレーズ応答 Check that the request matches the signature Signature ok Certificate Details: Serial Number: b4:2b:0c:e4:e7:18:6e:ea Validity Not Before: Oct 16 05:11:27 2017 GMT Not After : Sep 22 05:11:27 2117 GMT Subject: countryName = JP stateOrProvinceName = Tokyo localityName = shinjuku organizationName = hoge.com commonName = user1 emailAddress = user1@hoge.com X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: BD:E1:55:B3:90:08:50:B0:36:48:08:E0:FA:A7:70:E3:80:E9:C3:61 X509v3 Authority Key Identifier: keyid:21:05:77:E9:A5:E6:DE:8D:46:F6:1B:43:5A:E2:2C:C0:60:13:BE:37 Certificate is to be certified until Sep 22 05:11:27 2117 GMT (36500 days) Sign the certificate? [y/n]:y ← y応答 1 out of 1 certificate requests certified, commit? [y/n]y ← y応答 Write out database with 1 new entries Data Base Updated Certificate: Data: Version: 3 (0x2) Serial Number: b4:2b:0c:e4:e7:18:6e:ea Signature Algorithm: sha256WithRSAEncryption Issuer: C=JP, ST=Tokyo, O=hoge.com, CN=hoge.com/emailAddress=webmaster@hoge.com Validity Not Before: Oct 16 05:11:27 2017 GMT Not After : Sep 22 05:11:27 2117 GMT Subject: C=JP, ST=Tokyo, L=shinjuku, O=hoge.com, CN=user1/emailAddress=user1@hoge.com Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus: 00:da:23:83:62:33:53:a1:ca:88:1a:2f:e0:ea:ff: f9:ce:2f:dc:a4:ad:1c:78:6f:16:f2:48:a6:54:28: 1b:db:a7:01:a2:f3:3d:32:c6:b8:f2:91:86:a2:62: 73:f0:e0:f5:89:cb:24:9b:e8:e0:f8:1a:32:62:a9: 5e:b8:74:a0:e7:59:d0:fb:4d:3d:e6:70:3e:7e:4a: 27:c3:c1:b6:bc:f4:b3:89:6e:eb:a8:7f:e3:01:17: 19:90:4a:44:a0:38:2c:2b:3c:b9:ee:7b:98:53:58: f1:17:ac:fa:8d:a1:7e:2c:ef:ab:54:1a:d2:07:90: 22:0d:a9:19:69:7b:da:a6:78:e3:4e:7f:98:43:81: 76:7f:b7:ae:02:61:39:39:9f:7e:7b:4e:50:12:c9: 2d:b6:39:a1:01:96:fa:9f:e7:6d:03:1a:f1:3b:98: e3:aa:de:34:b5:cd:c0:73:47:74:f2:5c:2a:89:3c: 44:5f:a3:5d:35:72:82:82:bf:f6:64:6a:db:17:97: c4:0f:ec:37:46:63:7f:ac:de:25:2d:58:2a:e2:2a: af:53:02:11:bd:39:16:ae:f3:b6:70:bd:6c:25:87: ce:7e:33:2f:d5:0a:13:86:bd:26:f8:9f:45:e3:77: 9c:29:97:1f:cf:c8:9f:3c:42:f4:65:87:c1:73:81: 7c:75 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: BD:E1:55:B3:90:08:50:B0:36:48:08:E0:FA:A7:70:E3:80:E9:C3:61 X509v3 Authority Key Identifier: keyid:21:05:77:E9:A5:E6:DE:8D:46:F6:1B:43:5A:E2:2C:C0:60:13:BE:37 Signature Algorithm: sha256WithRSAEncryption 84:f3:b9:52:d9:8e:d6:75:cf:2b:0b:c1:a0:ba:6f:71:4e:d2: 39:18:03:2a:3d:1d:d3:86:8c:5d:27:4e:4b:c4:5e:ae:fe:4a: e8:ee:8c:22:4f:70:29:11:d4:8c:b3:e8:92:9a:09:03:45:7d: 19:8a:f8:7c:10:53:2f:f9:d2:28:8a:78:84:d0:bb:7d:67:80: 45:02:94:01:36:02:9e:fa:a9:93:f2:83:62:d7:62:a4:78:49: c5:e1:36:88:bf:f0:8d:b0:77:39:e0:38:ea:d6:29:1b:56:98: ff:56:95:fa:83:c4:43:b6:62:c5:fb:96:71:69:d1:c2:4a:b8: c7:08:0f:ab:2b:0d:4c:78:94:e8:a1:8e:bd:fc:ee:68:35:9f: 42:5e:65:78:4e:d0:7c:b5:63:bc:b5:9c:6e:c1:30:ad:0e:46: a1:c7:25:79:f8:b1:f8:34:5f:00:d0:67:6f:94:36:b6:35:46: 6a:84:07:b8:a2:f7:f8:c6:c6:14:f5:14:74:3d:b3:19:3d:cf: e4:56:64:3a:9f:0b:da:16:cd:82:ca:ab:27:7a:45:68:51:55: a3:9f:74:c9:3b:96:ed:91:92:68:ff:ba:f0:a7:ff:e8:16:d9: 94:d9:91:33:7f:5c:de:b6:9b:c0:c8:90:eb:8d:79:a8:61:ed: fa:84:f8:39 -----BEGIN CERTIFICATE----- MIIECDCCAvCgAwIBAgIJALQrDOTnGG7qMA0GCSqGSIb3DQEBCwUAMHUxCzAJBgNV BAYTAkpQMQ4wDAYDVQQIDAVUb2t5bzEWMBQGA1UECgwNY2VudG9zc3J2LmNvbTEW MBQGA1UEAwwNY2VudG9zc3J2LmNvbTEmMCQGCSqGSIb3DQEJARYXd2VibWFzdGVy QGNlbnRvc3Nydi5jb20wIBcNMTcxMDE2MDUxMTI3WhgPMjExNzA5MjIwNTExMjda MIGSMQswCQYDVQQGEwJKUDEOMAwGA1UECAwFVG9reW8xEDAOBgNVBAcMB3NoaW51 a3UxFjAUBgNVBAoMDWNlbnRvc3Nydi5jb20xGjAYBgNVBAMMEXRha2FzaGkuaGFz aGltb3RvMS0wKwYJKoZIhvcNAQkBFh50YWthc2hpLmhhc2hpbW90b0Brc2RuZXQu Y28uanAwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaI4NiM1Ohyoga L+Dq//nOL9ykrRx4bxbySKZUKBvbpwGi8z0yxrjykYaiYnPw4PWJyySb6OD4GjJi qV64dKDnWdD7TT3mcD5+SifDwba89LOJbuuof+MBFxmQSkSgOCwrPLnue5hTWPEX rPqNoX4s76tUGtIHkCINqRlpe9qmeONOf5hDgXZ/t64CYTk5n357TlASyS22OaEB lvqf520DGvE7mOOq3jS1zcBzR3TyXCqJPERfo101coKCv/ZkatsXl8QP7DdGY3+s 3iUtWCriKq9TAhG9ORau87ZwvWwlh85+My/VChOGvSb4n0Xjd5wplx/PyJ88QvRl h8FzgXx1AgMBAAGjezB5MAkGA1UdEwQCMAAwLAYJYIZIAYb4QgENBB8WHU9wZW5T U0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0GA1UdDgQWBBS94VWzkAhQsDZICOD6 p3DjgOnDYTAfBgNVHSMEGDAWgBQhBXfppebejUb2G0Na4izAYBO+NzANBgkqhkiG 9w0BAQsFAAOCAQEAhPO5UtmO1nXPKwvBoLpvcU7SORgDKj0d04aMXSdOS8Rerv5K 6O6MIk9wKRHUjLPokpoJA0V9GYr4fBBTL/nSKIp4hNC7fWeARQKUATYCnvqpk/KD YtdipHhJxeE2iL/wjbB3OeA46tYpG1aY/1aV+oPEQ7ZixfuWcWnRwkq4xwgPqysN THiU6KGOvfzuaDWfQl5leE7QfLVjvLWcbsEwrQ5Gocclefix+DRfANBnb5Q2tjVG aoQHuKL3+MbGFPUUdD2zGT3P5FZkOp8L2hbNgsqrJ3pFaFFVo590yTuW7ZGSaP+6 8Kf/6BbZlNmRM39c3rabwMiQ6415qGHt+oT4OQ== -----END CERTIFICATE----- Signed certificate is in newcert.pem |
| [root@localhost ~]# openssl pkcs12 -export -in newcert.pem -inkey newkey.pem -certfile /etc/pki/CA/cacert.pem -out 任意のユーザー名.p12 ← クライアント向けクライアント証明書登録ファイル作成 |
| Enter pass phrase for newkey.pem: ← クライアント証明書パスフレーズ Enter Export Password: ← 任意のクライアント証明書登録用パスフレーズ※クライアント証明書をクライアントの端末にインストールするときに必要 Verifying - Enter Export Password: ← 任意のクライアント証明書登録用パスフレーズ(確認) ここで作成された「ユーザー名.p12」ファイルをクライアントへ送付する |
| [root@localhost ~]# openssl req -config /etc/pki/tls/openssl-client.cnf -new -keyout newkey.pem -out newreq.pem -days 36500 -passout pass:任意のクライアント証明書パスフレーズ -subj "/CN=${CN:-任意のユーザー名}" ← クライアント秘密鍵・署名要求作成 |
| Generating a 2048 bit RSA private key ........................................+++ ..+++ writing new private key to 'newkey.pem' ----- |
| [root@localhost ~]# openssl ca -batch -key CA秘密鍵パスフレーズ -config /etc/pki/tls/openssl-client.cnf -policy policy_anything -out newcert.pem -infiles newreq.pem ← クライアント署名要求に署名してクライアント証明書作成 |
| Using configuration from /etc/pki/tls/openssl-client.cnf Check that the request matches the signature Signature ok Certificate Details: Serial Number: a9:30:4e:7e:67:c0:62:1e Validity Not Before: Oct 17 04:45:54 2017 GMT Not After : Sep 23 04:45:54 2117 GMT Subject: commonName = user1 X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Cert Type: SSL Client, S/MIME, Object Signing Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: 80:2E:01:40:D9:BB:B3:7E:20:09:1A:41:D1:30:6B:0B:4E:0D:68:51 X509v3 Authority Key Identifier: keyid:5D:D8:35:14:AE:15:42:2A:BA:AA:2E:C0:58:27:01:33:D3:9E:CF:FC Certificate is to be certified until Sep 23 04:45:54 2117 GMT (36500 days) Write out database with 1 new entries Data Base Updated |
| [root@localhost ~]# openssl pkcs12 -passin pass:クライアント証明書パスフレーズ -passout pass:任意のクライアント証明書登録用パスフレーズ -in newcert.pem -inkey newkey.pem -certfile /etc/pki/CA/cacert.pem -out 任意のユーザー名.p12 -export ← クライアント向けクライアント証明書登録ファイル作成 |
| ここで作成された「ユーザー名.p12」ファイルをクライアントへ送付する |
| [root@localhost ~]# cp newcert.pem /etc/pki/CA/certs/任意のユーザー名.crt ← クライアント証明書を失効用に退避※証明書失効については後述 |
| [root@localhost ~]# rm -f newcert.pem newkey.pem newreq.pem ← 後始末 |
| BASIC認証用ユーザーデータベース(例:/etc/httpd/conf/.htpasswd)がない場合＝1件目の場合 |
| [root@localhost ~]# htpasswd -bcm /etc/httpd/conf/.htpasswd `openssl x509 -noout -subject -in /etc/pki/CA/certs/ユーザー名.crt | sed -e 's/subject= \([^ ]*\)/\1/p' -e d` password ← クライアント証明書をBASIC認証用ユーザーデータベース(例:/etc/httpd/conf/.htpasswd)へ登録 |
| BASIC認証用ユーザーデータベース(例:/etc/httpd/conf/.htpasswd)がある場合＝2件目以降の場合 |
| [root@localhost ~]# htpasswd -bm /etc/httpd/conf/.htpasswd `openssl x509 -noout -subject -in /etc/pki/CA/certs/ユーザー名.crt | sed -e 's/subject= \([^ ]*\)/\1/p' -e d` password ← クライアント証明書をBASIC認証用ユーザーデータベース(例:/etc/httpd/conf/.htpasswd)へ登録 |
| ※ password は例ではないので、そのまま password と指定すること |
| [root@localhost ~]# vi /etc/httpd/conf.d/ssl.conf ← SSL設定ファイル編集 |
| [root@localhost ~]# vi /etc/httpd/conf.d/virtualhost-hoge.com.conf ← SSL設定ファイル編集※バーチャルホスト設定している場合 |
| # Certificate Authority (CA): # Set the CA certificate verification path where to find CA # certificates for client authentication or alternatively one # huge file containing all of them (file must be PEM encoded) #SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt #SSLCACertificateFile /etc/pki/tls/certs/ca.pem SSLCACertificateFile /etc/pki/CA/cacert.pem ← CA証明書 SSLCARevocationFile /etc/pki/CA/crl.pem ← 証明書失効リスト SSLCARevocationCheck chain ← 証明書失効リストチェック有効化 |
| [root@localhost ~]# systemctl reload httpd ← Apache設定反映 |
| [root@localhost ~]# mkdir /var/www/html/strictsecret ← クライアント証明書アクセス制限ディレクトリ作成 |
| [root@localhost ~]# vi /var/www/html/strictsecret/.htaccess ← クライアント証明書アクセス制限ディレクトリに.htaccess作成 |
| # アクセス元が内部以外の場合はクライアント証明書を要求する <If "! -R '10.0.0.0/8' && ! -R '172.16.0.0/12' && ! -R '192.168.0.0/16'"> SSLVerifyClient require SSLVerifyDepth 1 SSLOptions +FakeBasicAuth AuthUserFile /etc/httpd/conf/.htpasswd AuthName "secret page" AuthType Basic require valid-user </If> |
| [root@localhost ~]# echo test > /var/www/html/strictsecret/index.html ← クライアント証明書アクセス制限ディレクトリにテスト用ページ作成 |
【PCの場合】
サーバーから送付された「ユーザー名.p12」ファイルをクライアント側で開いてインストールする
【スマホの場合】
サーバーからメール添付で送付された「ユーザー名.p12」ファイルをスマホ側のメールアプリで開いてインストールする
※パスワードはクライアント証明書登録用パスフレーズを指定する
クライアント証明書が不要になった場合に、該当のクライアント証明書を失効させて使用できないようにする。
| [root@localhost ~]# openssl ca -gencrl -revoke /etc/pki/CA/certs/ユーザー名.crt ← クライアント証明書失効 |
| Using configuration from /etc/pki/tls/openssl.cnf Enter pass phrase for /etc/pki/CA/private/cakey.pem: ← CA秘密鍵パスフレーズ応答 -----BEGIN X509 CRL----- MIICsjCCAZoCAQEwDQYJKoZIhvcNAQELBQAwdTELMAkGA1UEBhMCSlAxDjAMBgNV BAgMBVRva3lvMRYwFAYDVQQKDA1jZW50b3NzcnYuY29tMRYwFAYDVQQDDA1jZW50 b3NzcnYuY29tMSYwJAYJKoZIhvcNAQkBFhd3ZWJtYXN0ZXJAY2VudG9zc3J2LmNv bRcNMTcxMDE3MDg0MjA3WhcNMTcxMTE2MDg0MjA3WjCB4DAaAgkAqTBOfmfAYhwX DTE3MTAxNzA0MzMxOVowGgIJAKkwTn5nwGIeFw0xNzEwMTcwNDQ5MjJaMBoCCQCp ME5+Z8BiHxcNMTcxMDE3MDUwNjU1WjAaAgkAqTBOfmfAYiAXDTE3MTAxNzA1MzQx NlowGgIJAKkwTn5nwGIhFw0xNzEwMTcwNzUyMzBaMBoCCQCpME5+Z8BiIhcNMTcx MDE3MDc1NTQ4WjAaAgkAqTBOfmfAYiMXDTE3MTAxNzA4MTg0OVowGgIJAKkwTn5n wGIkFw0xNzEwMTcwODM3MDdaoA4wDDAKBgNVHRQEAwIBATANBgkqhkiG9w0BAQsF AAOCAQEA7Xx4PxTejaONp+J8pd8zx1yy3SSeYgIBAmWWvsJBjmbWNATkYWTWMyc2 cvBK8dURRC6tQ7nqLEOhOAv1/jn27qylL/1pBAujbV7xDO++YsqRAn1qkr2kQmy3 vAnqA7SaCQij31410ZNxfQViD5CxDK4e36SlouqtqNONQx3Ji6VuhaiHRr9TJUxc EKijbTOWiqYm+b1NxxmJm4y9LEL3CGVguBYHS8o6TZDWOml2O4Sz5N4Y2Gor0wnU wUoS14e+DONCaEvJxhEblcx7Dd8zLDUkPixVqyuQIOBG7k7cWg6Jt9MtjCpHcvMl zy+fierK3X3yjtM+QMiCh1TzwG/kRw== -----END X509 CRL----- Revoking Certificate A9304E7E67C0621C. Data Base Updated |
| [root@localhost ~]# openssl ca -gencrl -out /etc/pki/CA/crl.pem ← 証明書失効リスト更新 |
| Using configuration from /etc/pki/tls/openssl.cnf Enter pass phrase for /etc/pki/CA/private/cakey.pem: ← CA秘密鍵パスフレーズ応答 |
| [root@localhost ~]# systemctl reload httpd ← 証明書失効リスト反映 |
| [root@localhost ~]# vi /etc/cron.weekly/crlupdate ← 証明書失効リスト自動更新スクリプト作成 |
| #!/bin/sh openssl ca -batch -key CA証明書パスフレーズ -gencrl -out /etc/pki/CA/crl.pem > /dev/null 2>&1 systemctl reload httpd > /dev/null 2>&1 |
| [root@localhost ~]# chmod 700 /etc/cron.weekly/crlupdate ← 証明書失効リスト自動更新スクリプトに実行権限付加 |
※証明書失効リストの有効期限は初期設定で30日となっており、有効期限が過ぎるとクライアント証明書認証が行えなくなってしまうため、証明書失効が30日以内に行われなくても大丈夫なように定期的に空更新する。
![[heart]](image/face/heart.png)
