System Linux Network : SLN

Configuration Apache2.0-mod_SSL



Tout d'abord il faut installer :
openssl-0.9.7a-1mdk
libopenssl0.9.7-0.9.7a-1mdk
libopenssl0.9.7-devel-0.9.7a-1mdk
libopenssl0-0.9.6h-2mdk
apache2-mod_ssl-2.0.44-11mdk

Générer ses clefs !

Il faut pour cela le script gentestcrt.sh qui se trouve dans /usr/lib/ssl/apache2-mod_ssl/
On va dans le répertoire /etc/ssl/apache...
On archive les fichiers

On lance /usr/lib/ssl/apache2-mod_ssl/gentestcrt.sh
Vous devriez avoir :
29141426 semi-random bytes loaded
Generating RSA private key, 1024 bit long modulus
................++++++
.....................................................................++++++
e is 65537 (0x10001)
______________________________________________________________________

STEP 2: Generating X.509 certificate signing request for CA
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Vous devez remplir les premiers champs pour créer votre clef ca.crt
1. Country Name             (2 letter code) [XY]:FR
2. State or Province Name   (full name)     [Snake Desert]:France
3. Locality Name            (eg, city)      [Snake Town]:Lyon
4. Organization Name        (eg, company)   [Snake Oil, Ltd]:SLN
5. Organizational Unit Name (eg, section)   [Certificate Authority]:SSLN
6. Common Name              (eg, CA name)   [Snake Oil CA]:SLN
7. Email Address            (eg, name@FQDN) [ca@snakeoil.dom]:votre@mail
Passez à la suite

STEP 3: Generating X.509 certificate for CA signed by itself
Signature ok
subject=/C=FR/ST=France/L=Lyon/O=SLN/OU=SSLN/CN=SLN/emailAddress=lolo@system-linux.net
Getting Private key
______________________________________________________________________

RESULT:
./ca.crt: /C=FR/ST=France/L=Lyon/O=SLN/OU=SSLN/CN=SLN/emailAddress=lolo@system-linux.net
error 18 at 0 depth lookup:self signed certificate
OK

Generating custom SERVER
______________________________________________________________________

STEP 5: Generating RSA private key for SERVER (1024 bit)
29145754 semi-random bytes loaded
Generating RSA private key, 1024 bit long modulus
............++++++
.............++++++
e is 65537 (0x10001)
______________________________________________________________________

STEP 6: Generating X.509 certificate signing request for SERVER
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
1. Country Name             (2 letter code) [XY]:FR
2. State or Province Name   (full name)     [Snake Desert]:France
3. Locality Name            (eg, city)      [Snake Town]:Lyon
4. Organization Name        (eg, company)   [Snake Oil, Ltd]:SLN
5. Organizational Unit Name (eg, section)   [Webserver Team]:SSLN
6. Common Name              (eg, FQDN)      [www.snakeoil.dom]:lesite.quiutilisera.ssl
7. Email Address            (eg, name@fqdn) [www@snakeoil.dom]:votre@mail
______________________________________________________________________

STEP 7: Generating X.509 certificate signed by own CA
Signature ok
subject=/C=FR/ST=France/L=Lyon/O=SLN/OU=SSLN/CN=www.system-linux.net/emailAddress=lolo@system-linux.net
Getting CA Private Key
Enter Export Password:********
Verifying - Enter Export Password:********
______________________________________________________________________

RESULT:
./server.crt: OK
______________________________________________________________________

STEP 8: Enrypting RSA private key of SERVER with a pass phrase for security
writing RSA key
Enter PEM pass phrase:********
Verifying - Enter PEM pass phrase:********
Voilà c'est fait !

Redémarrez Apache ! : /etc/init.d/httpd restart

On vérifie que cela fonctionne : Vérification

Ouala !!!

Voir le fichier ssl.default-vhost.conf
Navigation Précédent     index6b.html     Suite
Informations légales

Valid HTML 4.01! Valid CSS!