사설 ssl인증서 적용

테스트 서버에서 주로 많이 사용 되게 됩니다.

ssl을 만들어서 nginx 에 적용 하는거 까지 한번 해보려 합니다.

 

아래와 같이 개인키 이름과 인증서 이름에 그냥 영문 명칭을 써주시면 됩니다.

$ openssl req -new -newkey rsa:2048 -nodes -keyout 개인키이름.key -out 인증서이름.csr

 

이런식으로 사용해 주시면 될거 같아요

[root@t1 ~]# openssl req -new -newkey rsa:2048 -nodes -keyout test.key -out test.csr
Generating a RSA private key
......................................+++++
..+++++
writing new private key to 'test.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:
State or Province Name (full name) []:
Locality Name (eg, city) [Default City]:
Organization Name (eg, company) [Default Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

이제 private key와 csr (Certificate Signing Request) 을 합쳐서 인증서를 만들어 줍니다.

[root@t1 ~]# openssl x509 -req -days 365 -in test.csr -signkey test.key -out test.crt
Signature ok
subject=C = XX, L = Default City, O = Default Company Ltd
Getting Private key

 

이제 nginx에 ssl 적용을 해줍니다.

해당 파일을 vi로 만드셔서 include 해주시면 적용 됩니다.

[root@t1 nginx]# cat ssl.include
ssl on;
ssl_certificate         /etc/nginx/conf.d/ssl/test.crt;
ssl_certificate_key     /etc/nginx/conf.d/ssl/test.key;
ssl_session_cache       shared:SSL:10m;
ssl_session_timeout     10m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE

ssl_prefer_server_ciphers on;
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';

 

궁금하신 사항은 댓글 달아주세요^^