Sophie: howto-text-ja-9.0-1mdk noarch

howto-text-ja-9.0-1mdk.noarch.rpm

  ÀSÈ RedHat Apache T[oÌ\zû@
  Richard Sigle, Richard.sigle@equifax.com
  0.1, 2001-02-06
  KURASHIKI Satoru (ouka@fx.sakura.ne.jp)
  0.1J, 2002-02-22

  ±ÌKChÍAPKI Æ SSL ðêÉ®©·û@ðà¾·éæ¤ÉÓ}³êÄ
  ¢Ü·BÀSÈT[oð\z·é½ßÉÍASSL vgRªÇ¤@\µÄ¢
  é©ðð·éKvª èÜ·B
  ______________________________________________________________________

  Ú

  1. ±ÌKChÌÚI/ÍÍ
     1.1 Secure Sockets Layer (SSL) ÉÂ¢Ä
     1.2 tB[hobN
     1.3 ì Æ¤W
     1.4 Ó«

  2. Secure Sockets Layer/Private Key Infrastructure ÖÌµÒ
     2.1 SSL/PKI ÌM«
     2.2 SSL ÍÇ¤@\·éÌ©
        2.2.1 SSL nhVFCNvgR
        2.2.2 ZbV® (ÎÌ®)
        2.2.3 öJ/é§®ÌyA(ñÎÌR[h)
     2.3 PKI ÌdgÝ
     2.4 Ø¾(x509 W)
     2.5 fW^Ø¾Ìé§®
     2.6 fW^Ø¾ÌöJ®
     2.7 Ø¾¼v(CSR)

  3. Ø¾ÉæéìÆ
     3.1 é§®Ìì¬
     3.2 Ø¾¼vÌì¬
     3.3 ©Ø¾Ìì¬
     3.4 EFuT[oÖÌØ¾ÌCXg[

  4. Apache Server ÌÝè
     4.1 ZLAÈ@[`zXgÌè`
        4.1.1 SSL Engine
        4.1.2 SSLCertificateFile
        4.1.3 SSLCertificateKeyFile
        4.1.4 SSLCACertificateFile
     4.2 Ø¾Ìá
        4.2.1 T[oØ¾t@C
        4.2.2 Ø¾t@CÌàe
        4.2.3 é§®t@C
        4.2.4 é§®t@CÌàe
     4.3 Web T[oÌÄN®

  5. guV[eBO
     5.1 T[oÍN®µ½æ¤É©¦éªAZLATCgÉANZXÅ«È¢
     5.2 Certificate Name Check Warning is issued by the client's browser
     5.3 NCAgÌuEUÉAØ¾ªM³êÄ¢È¢Ø¾s@Ö
     5.4 SSLEngine on is an un-recognized command (Apache ÌN®)
     5.5 "PEM pXt[Y" ðYêÄµÜ¢AÇ¤âÁÄ»êðÄÝè·é©mè½¢B

  6. pêW

  ______________________________________________________________________

  1.  ±ÌKChÌÚI/ÍÍ

  ±ÌKChÌÚIÍARedHat Linux Ì[Uª Apache EFuT[oðgÁ
  ÄT[o(SSL)Ø¾ðCXg[·éÌðè¯·é±ÆÅ·BÚWÍA
  ÔÆA½Ìê¨àðßñµÄêéèðÍÁ«è¦·±ÆÅ·I

  ÅÉA SSL vgRÆfW^Ø¾ÉÂ¢ÄmÁÄ¨×«±Æðà
  ¾µÜ·BÌo±ÅÍAModSSL Æ OpenSSL ðgÁÄ Apache EFuT[o
  ð\z·éÌªAÅàLvÈ\tgEFAÌgÝí¹Å·BOpenSSL ÍÄp
  IÈÃ»CuÅASSL v2/v3 Æ TLS v1 vgRðT|[gµÄ¢
  Ü·B ModSSL ÍAApache API W[ÅAApache Æ OpenSSL ÔÌC
  ^[tFCXÆµÄ®ì·éæ¤ÉìçêÄ¢Ü·BÅåÌvÍA±êç 3
  ÂÌpbP[Wªt[Å é±ÆÅ·B

  »µÄ 4 Í©çÍA®Ì¶¬ÆAModSSL Æ OpenSSL ðgÝ±ñÅRpC
  ³ê½ RedHat-Apache T[oÖÌØ¾ÌCXg[ððÇÁÄ©Ä
  ¢«Ü·B 4 ÍÌèÍAApache Æ§ÚÉÖWµÄ¢é Stronghold â
  Raven Æ¢Á½¤p SSL T[oÌpbP[WÉàKpÅ«éÅµå¤B

  xFÍAEquifax Secure Inc. Æ¢¤Ø¾s@ÖÌeNjJT|[
  gZpÒÅ·BÅ·©çAÍ Equifax Secure ÌØ¾ðg¢Ü·µAáÍ
  Equifax Secure ÌØ¾ðCXg[ÉKµ½`ÉÈÁÄ¢Ü·BÆÍ
  ¢¦Aèø«Í¼ÌØ¾s@ÖÉæéØ¾Éàg¦éÍ¸Å·B±Ì¶
  ðª¦æµÄ¢½©çÆ¢ÁÄàAEquifax Secure Inc. ÍA±êçÌ
  èðg¤±ÆÉæÁÄ¶¶é½@ÈéÊÉÂ¢ÄàA`±àÓCà¢Ü
  ¹ñB

  ÇÒÉÎ·éÌRgÍA±ÌX^C(²)Å·B.

  áÍÊÌX^CÅ¦µÜ·B.

  xÈRgâAhoCXÍASGML \[XÌRgÆµÄ¢Ä è
  Ü·B

  1.1.  Secure Sockets Layer (SSL) ÉÂ¢Ä

  SSL ÍATCP ÆAvP[VwÌÔÉ éAv[e[VwÌT[
  rXÅ·B±êÍvbgtH[âAvP[VÉÍË¶µÜ¹ñB
  SSL ÍNCAgÆT[oÔÌZLAÈÊM`lðÇ·éðÚð
  ÁÄ¢Ü·B SSL ÍNCAgÆT[oÔÅ]³êéf[^ðÃ»
  ·éAÍÈ@\ðñµÜ·B

  1.2.  tB[hobN

  ±ÌKChÉÂ¢ÄÌRgÍAÒ (richard.sigle@equifax.com) É 
  ÄÉ¨è¢µÜ·B

  1.3.  ì Æ¤W

  Copyright (c) 2001 by Richard L. Sigle

  Please freely copy and distribute this document in any format. It's
  requested that corrections and/or comments be forwarded to the
  document maintainer. You may create a derivative work and distribute
  it provided that you:

  o  Send your derivative work (in the most suitable format such as
     sgml) to the LDP <http://www.LinuxDoc.org/> (Linux Documentation
     Project) or the like for posting on the Internet. If not the LDP,
     then let the LDP know where it is available.

  o  License the derivative work with this same license or use GPL.
     Include a copyright notice and at least a pointer to the license
     used.

  o  Give due credit to previous authors and major contributors.

  If you're considering making a derived work other than a translation,
  it's requested that you discuss your plans with the current
  maintainer.

  1.4.  Ó«

  Þ±ÆÈÌhtgðÇñÅAAhoCXðê½ Tony Villasenor
  É´ÓðB Tony ª¢È¯êÎA±Ì¶Í«ã°é±ÆªÅ«È©Á½Å
  µå¤B

  2.  Secure Sockets Layer/Private Key Infrastructure ÖÌµÒ

  PKI ÍAöJ® (NCAgÉçêÜ·) Æé§® (T[oãÉ¶ÝµÜ
  ·) ©çÈéAñÎÌÌ®VXeÅ·BPKI ÍANCAgÆT[oÌ¼
  ûªÃ»/»É¯¶®ðg¤AÎÌÌ®VXeÆÍÙÈèÜ·B

  2.1.  SSL/PKI ÌM«

  NWbgJ[hîñâãÃL^A@¥¶Ae-commerce AvP[V
  Æ¢Á½AÅà@§ÉÓµÈ¯êÎÈçÈ¢ÌÊMÉàpÂ\Å é
  æ¤ÉAÆ¢¤vð½·½ßÉ SSL ÍÝv³êÜµ½BeAvP[
  VÍA@§«â³êéæøÌ¿lÉæÁÄAÈºÌÁ¥ÌÇêð ( 
  é¢Í·×Äð) g¤©IðÅ«Ü·B

     vCoV[
        á¦ÎAA ©ç B Ö`B·é½ßÉAbZ[Wª»³êéÆµ
        Ü·BA Í B ÌöJ®ðgÁÄbZ[WðÃ»µÜ·B±¤·é
        ÆAB Í©ªÌé§®ðgÁÄ±ÌbZ[Wð»µÄÇÞ±Æª
        Å«éBêÌl¨ÆÈèÜ·Bµ©µAA ª©ÌµÄ¢éÊèÌl¨Å
         é©Íè©ÅÍ èÜ¹ñB

     FØ
        A ª©ÌµÄ¢éÊèÌl¨Å é±Æðm©ßé½ßÉÍAÛØ³ê
        ½FØªKvÅ·B±êÉÍµÎ©è¡GÈÃ»ÌßöªKvÅ
        ·B±ÌêAA ©ç B ÖÌbZ[WÍAÅÉ A Ìé§®ÅA
        É B ÌöJ®ÅÃ»³êÜ·BB ÍÜ¸©ªÌé§®ÅAÂ¢Å A
        ÌöJ®Å»µÈ¯êÎÈèÜ¹ñB±êÅAB Í A ª©ÌµÄ
        ¢éÊèÌl¨¾ÆmMÅ«Ü·B¼ÌlÍNà A Ìé§®ÅÃ»
        µ½bZ[Wðìé±ÆÍÅ«È¢ÌÅ·©çB SSL Í±êðAØ
        ¾ (PKI) ðg¤±ÆÅB¬µÄ¢Ü·BØ¾ÍA| Ø¾s@
        Ö (CA)Ìæ¤È | §ÌT[hp[eB©çs³êAØ¾³ê½
        èÌöJ®ÉÁ¦ÄAfW^¼â^CX^vðÜñÅ¢Ü
        ·B³µ¢ SSL c[ðg¦ÎNÅà©µ½fW^Ø¾ðì¬
        Å«Ü·ªA©µ½Ø¾ÅÍA¤ÊÉhÓð¥íêÄ¢é§ÌT
        [hp[eBªs¤AáyÌdÝÉ¯Ü·B

     ³T«
        SSL É¨¢ÄÍAMAC (Message Authentication Code: bZ[WFØ
        R[h) ðK{ÌnbVe[uÖÆÆàÉg¤±ÆÅ³T«ªÛ
        Ø³êÄ¢Ü·BbZ[WÌ¶¬ÉAnbVÖðg¤±ÆÅ
        MAC ª¾çêA»ÌÊªbZ[WÉÇÁ³êÜ·BbZ[Wªó
        M³êéÆAbZ[WÉß±Üê½ MAC ðó¯ÆÁ½bZ[W
        ©çvZµ½Vµ¢ MACÆär·é±ÆÅAÃ«ªØ³êÜ·B±
        êÅAæOÒÉæÁÄÏX³ê½bZ[WÍ·®É¾ç©ÉÈèÜ
        ·B

     ÛFh~
        ÛFh~ÍAICÌâèÆèÌÔA¼ûÌÊMÒð¨Ý¢©çÛ
        ìµÜ·B±êÍAÇ¿ç©ªAîñÌ¤¿ÁèÌêªðçÈ©Á
        ½AÆ¾¤Ìðh¬Ü·BÛFh~ÍAÇ¿ç¤ÉÂ¢ÄàAùÉÈ³
        ê½âèÆèÌàeðüÏ·é±ÆðµÜ¹ñBfW^ÛFh~Í
        `IÈ´oÅ¢¦ÎA_ñÉTC·éÌÆ¿Å·B

  2.2.  SSL ÍÇ¤@\·éÌ©

  SSL vgRÍA2 ÂÌTuvgRðÜÝÜ· | SSL R[hvg
  RÆ SSL nhVFCNvgRÅ·BSSL R[hvgRÍf[
  ^Ì`Ég¤tH[}bgðè`µÜ·BSSL nhVFCNvgRÉ
  ÍA SSL R[hvgRÌpªÜÜêÄ¢Ü·B±êÍ SSL »³ê½
  T[oÆNCAgªÅÉ SSL Ú±ðm§·éÆ«ÉâèÆè·éêA
  ÌbZ[Wð·Ép¢çêÜ·B±ÌbZ[Wð·ÍAÈºÌ@\ðeÕ
  É·é×Ýv³êÄ¢Ü·B

  o  T[o©çNCAgÖÌFØBT[oØ¾ÍAØ¾s@ÖÉ
     æÁÄ¼³êÄ¨èAØ¾ªóêÄ¨ç¸AMÌ½ª¬§µÄ¢é
     ±ÆðÛØµÜ·B

  o  NCAgÆT[oªAoûªÆàÉT|[gµÄ¢éÃ»AS
     YAÂÜèTCt@[(cipher)ðI×éæ¤ÉµÜ·B

  o  CÓÅAT[oÉÎµÄNCAgðFØB

  o  ¤LÌé§ð¶¬·éÌÉAöJ®ÃZpðg¢Ü·B

  o  Ã»³ê½ SSL Ú±ðm§µÜ·B

  2.2.1.  SSL nhVFCNvgR

  nhVFCNvgRÍANCAgÆT[oÌóÔð²®·éÌÉg
  íêÜ·BnhVFCNÌÔAÈºÌCxgª¶µÜ· |

  o  NCAgÆT[oÌÔÅØ¾ªð·³êÜ· (ñÎÌÌ®)BT[o
     ÍöJ®ðNCAgÉèÜ·BT[oªØ¾ðgÁÄNCA
     gÌFØðs¤æ¤Ýè³êÄ¢éÈçANCAgÍöJ®ðT[o
     ÉèÜ·BØ¾ÌLøúÀúðmFµAM³ê½Ø¾s@ÖÌ
     fW^¼ð`FbNµÜ·BLøúÀúâfW^¼ªÔáÁÄ¢
     êÎAuEUÍ[UÉxðoµÜ·B[UÍ»ê©çØ¾ÌÛ
     ÒðM·é±ÆàÅ«Ü·B

  o  ÉNCAgÍ_È® (ÎÌ®) ð¶¬µÜ·B±êçÍÃ
     »Æ MAC ÌvZÉgíêÜ·B±Ì®ÍAT[oÌöJ®ÅÃ»³êA
     T[oÉçêÜ·B±ÌVµ¢ÎÌ®ÍAT[oÌÝª»Å«Ü
     ·BVµ¢ÎÌ®ÍANCAgÆT[oÔÅçêéf[^ÌÃ»
     ÉgíêÜ·B

     F T[o - uEUÔFØÌãÉÎÌ®ðg¤±ÆÅA»ÌãÌ
     ptH[}XªåÉüP³êÜ·B

  o  bZ[WÌÃ»ASYÆA³T«Ì½ßÌnbVÖÆªð
     Â (negotiate) ³êÜ·B±Ì²®ßöÍANCAgªT|[gµÄ
     ¢éASYÌêðT[oÉ¦µAÉT[oªoûÅpÂ\È
     Åà¢ÃðIÔAÆ¢¤æ¤ÉÀs³êÜ·BIð³ê½Ã»A
     SYÆnbVÖÌ¯ÊqÍA»ÝÌXe[^XÌÃû@Xyb
     NtB[hÉÛ¶³êAR[hvgR©çp³êÜ·B

  o  ÈºÌtB[hÍSÄAnhVFCNÌÔÉZbg³êÜ· |vg
     RÌo[WAZbV IDAÃÌgA³kû@A»ê©ç 2 Â
     Ì_l ClientHello.random Æ ServerHello.randomB

  F IP AhXÍAe SSL Ú±ÉKvÉÈèÜ·B¼Ox[XÌ@[
  `zXgÍAvP[VwÅð³êÜ·B SSL ªAvP[V
  wÌºÉ¶ÝµÄ¢é±Æðv¢oµÜµå¤B

  2.2.2.  ZbV® (ÎÌ®)

  o  40 rbgÍAàÆàÆAopÌàÌÅµ½

  o  56 rbgÍ DES Åp³êÄ¢Ü·

  o  64 rbg® | CAST Åp³êÄ¨èA56 rbgæè 256 {ÍÅ·

  o  80 rbg® | CAST Åp³êÄ¨èA56 rbgÌ 16,000,000{Í
     Å· (»ÝÌZpÅÍAjé±ÆÍÅ«Ü¹ñ)

  o  128 rbg® | CAST â RC2 ÅgíêÄ¨èA»ÝàA\ªÅ«é¢
     É¨¢ÄàAÔIÉ®ððÇ·é±ÆÍsÂ\Å·

  2.2.3.  öJ/é§®ÌyA(ñÎÌR[h)

  o  512-bit

  o  768-bit

  o  1024-bit

  o  2048-bit

  2.3.  PKI ÌdgÝ

  NCAgÆT[oÍA»ê¼êöJ®Æé§®ð¿Ü· (NCAg
  ª©ªÌØ¾ðÁÄ¨èA»êªT[oÉv³êÈ¢ÀèANCA
  gÌuEUÍ SSL ÌZbVpÉ®ÌyAð_É¶¬µÜ·)B

  MÒÍA©ªÌé§®ðgÁÄbZ[WðÃ»µÜ·B±êÉæèA
  bZ[WÌ\[XªFØ³êÜ·BÊÌÃÍAó¯èÌöJ®Åà¤ê
  xÃ»³êÜ·B±êÍAó¯èÌÝªA©gÌé§®ðgÁÄbZ[W
  ðÅÉðÇ·é±ÆªÅ«éæ¤É·é±ÆÅA@§«ðà½çµÜ·Bó
  MÒÍAÃ»³ê½bZ[Wð³çÉðÇ·é½ßAMÒÌöJ®ðg
  ¢Ü·BMÒÌÝª©ªÌé§®ÉANZXÅ«éÌÅAóMÒÍÃ»³
  ê½bZ[Wª»ÌMÒ©çÌàÌÅ éÆ¢¤±ÆðÛØ³êÜ·B

  bZ[W_CWFXgÍAÖWÒàæOÒàAbZ[WÉ½ç©Ìüââ
  ÏXð{µÄ¢È¢±ÆðmF·éÌÉp³êÜ·BbZ[W_CWFX
  gÍAbZ[WÉnbVÖ (wäÆµÄmçêéAé§®Ìê) ðg
  ¤±ÆÅ¾çêÜ·B_CWFXg (¼ÆÄÎêÜ·) ÍbZ[WÉYt
   é¢ÍÇÁ³êÜ·B¼Ì·³Í (bZ[WÌ·³ÉÖç¸) êèÅA
  é§®ªàÂbZ[W_CWFXgÌ^Cv (md5 Í 128 rbgA sha1
  Èç 160 rbgAÈÇ) ÉæèÜ·BbZ[Wð½Á½ 1 rbgÏXµ½
  ¾¯Åà¼Ì·³ÍÏ»·éÌÅAbZ[WªÏX³ê½±ÆªØ¾³ê
  Ü·B

  2.4.  Ø¾(x509 W)

  fW^Ø¾ÍC^[lbgãÌ¶ÝðMÅ«éæ¤ÉµÜ·BfW^
  ¼ÍA§ÌæOÒÅ éØ¾s@ÖÉæÁÄ§Ø³ê½A[UÌ
  ÛØðÜÝÜ·B

  wIÈASYÆl (®) ªf[^ðÇßÈ¢`ÉÃ»·é½ßÉg
  íêÜ·Bf[^ÌÉÍ 2 ÂßÌ®ªp¢çêA±êÍâIÈAS
  YÆlðg¢Ü·B 2 ÂÌ®ÍÖAÃ¯çê½lðÁÄ¢È¯êÎÈ
  ç¸A®ÌyA ÆÄÎêÜ·B

  FITU-T Ì© X.509 [CCI88c] Í X.509 Ø¾ÌL@ÌÝÈç¸A
  X.500 fBNgÖÌFØT[rXÌdlðèßÄ¢Ü·BØ¾ÍAÎÛ
  Ì([UÌ)¼OÆ[UÌöJ®ÆÌÂÈªèðFØ·é½ßÉAsÒÉ
  æÁÄ¼³êÜ·BSSLv3 Í 1994 NÉÌð³êÜµ½Bo[W 2 Æ
  3 ÌåÈá¢ÍAg£tB[hªÇÁ³ê½±ÆÅ·B±ÌtB[hÉæ
  èAPÈé®Æ¼OÌÂÈªè¾¯ÅÈAÇÁÌîñð`B·é±ÆªÅ«
  éæ¤ÉÈèAæè_îÉÈèÜ·BWIÈg£ÅÍAÎÛÆsÒÌA
  ®AFØ|V[îñA®Ìp§ÀÈÇªÜÜêÜ·B

  X.509 Ø¾ÍA±êçÌtB[hÅ\¬³êÜ· |

  o  o[W

  o  VAÔ

  o  ¼ASY ID

  o  sÒ¼

  o  LøúÀ

  o  ÎÛÌ([UÌ)¼O

  o  ÎÛÌöJ®îñ

  o  sÒÅLÌ¯Êq(o[W 2 Æ 3 ÌÝ)

  o  ÎÛÅLÌ¯Êq(o[W 2 Æ 3 ÌÝ)

  o  g£(o[W 3 ÌÝ)

  o  ãLtB[hÉÂ¢ÄÌ¼

  2.5.  fW^Ø¾Ìé§®

  é§®ÍAfW^Ø¾Éß±ÜêÄÍ¢Ü¹ñBé§®ÍÇñÈT[o
  îñàà¿Ü¹ñBé§®ªÂÌÍÃîñÆwäÅ·B±êÍ©ªÌVX
  eãÅ[JÉ¶¬³êAÀSÈÂ«ÌÜÜÅÈ¯êÎÈèÜ¹ñBé§
  ®ªë¯É³ç³êêÎAÁQÒÍA{¿IÉ»ÌZLeBVXeÌR
  [hðèÉµ½±ÆÉÈèÜ·BNCAgÆT[oÔÌMÍATó³
  êAðÇ³ê¾Ü·B±¤¢Á½ã_ªAtriple DES ZpðgÁÄÃ»³
  ê½é§®ðìé±Æª§³êÄ¢éRÅ·B·éÆt@CÍÃ»³
  êApX[hÅÛì³êÜ·B±êÉæèA³mÈpXt[YÈµÉg¤
  ±ÆªÙÆñÇsÂ\ÉÈèÜ·B

  gUNVÌZLeBÍA»Ìé§®ÉË¶µÜ·B±Ì®ªëÁ
  ½lèÉí½Á½çANÅàÈPÉ»Ì®ðìÁÄAZLeBðjé½
  ßÉgpÅ«Ü·Bë¤¢®ÍAT[oÖÌbZ[Wª³@ÈnbJ[É
  æÁÄTó³êAì³êéÔðµ«©ËÜ¹ñB®SÉZLAÈVXe
  ÅÍA¼ÌðmÅ«A®Ì¡»ðWQ·éæ¤ÉÈÁÄ¢È¯êÎÈèÜ
  ¹ñB

  2.6.  fW^Ø¾ÌöJ®

  öJ®ÍfW^Ø¾Éß±ÜêÄ¨èAZLAÈÚ±ªv³ê½
  ÉAT[o©çNCAgÖçêÜ·B±ÌßöÉæèAØ¾ðgÁÄ
  T[oÌg³ªmF³êÜ·BöJ®Í®S«AMß«ðØµAé§Ìf[
  ^]ð·é½ßÉf[^ðÃ»·éÌÉàgíêÜ·B

  2.7.  Ø¾¼v(CSR)

  CSR ÍØ¾s@ÖªØ¾ðì¬·éÌÉKvÆÈéîñðÜÞàÌÅ
  ·B CSR ÍAé§®ÉÎµÄâIÈASYAT[oÌg³ðØ¾·
  éîñðà¿Ü·B±ÌîñÉÍAABAgDAêÊ¼(hC¼)AA
  æÆ¢Á½îñªÜÜêÜ·ªAÀè³êéí¯ÅÍ èÜ¹ñB

  3.  Ø¾ÉæéìÆ

  ±êÈ~ÌßÅÍAé§®t@CÌì¬AØ¾¼vA»ê©ç©Ø
  ¾ðÜÞèð¨³¦Ü·BØ¾s@ÖÉæÁÄ¼³ê½Ø¾ðü
  è·éÂàèÈçAØ¾¼v (CSR) ðì¬·éKvª èÜ·B é
  ¢ÍA©Ø¾ðì¬·é±ÆàÅ«Ü·B

  3.1.  é§®Ìì¬

  é§®ðìéÉÍAOpenSSL c[LbgªCXg[³êÄ¢ÄA
  Apache pÉÝè³êÄ¢éKvª èÜ·B±±©çÌáÅÍAftHg
  Ì /usr/local/ssl/bin fBNgÉ é OpenSSL ÌR}hCc[
  ðg¢Ü·BáÅÍAOpenSSL ÌR}hCc[ª éfBNg
  ª $PATH ÉÇÁ³êÄ¢é±ÆðzèµÄ¢Ü·B

  gv DES ÃW (§) ðgÁÄé§®ðìéÉÍA±ÌR}hð
  g¢Ü· |

       openssl genrsa -des3 -out filename.key 1024

  pXt[YðüÍµAÜ½ÄüÍ·éæ¤ÉßçêÜ·Bgv DES
  ðg¤±ÆÉµ½ÈçASSL T[oðR[hX^[gÅN®³¹éxÉpX
  [hðßçêÜ·B(ÄN®R}hðg¤êÍApX[hÍ·©ê
  Ü¹ñB) ÁÉVXeðxÝÌÔÉN®¹ËÎÈçÈ¢êA±ÌpX[
  hüÍª¤´Á½¢Æv¤©àµêÜ¹ñBÜ½AVXeÍùÉ\ªÉS
  ¾ÆmMµÄ¢é©àµêÜ¹ñBÅ·©çApX[hüÍªÈ¢æ¤ÉI
  ð·é (]ÁÄgv DES Ã»ðgí¸É) ÈçAÈºÌR}hðÀ
  sµÄ¾³¢BtÉAPÉ 512 bit Ì®ðìè½¢ÈçAR}hÌÅã
  É é 1024 ðíÁÄ¾³¢B·éÆ OpenSSL ÍftHgÌ 512 bit Å
  ®ðìèÜ·B¬³È®ðg¤ÆAµÎ©èÈèÜ·ªAÀS«àáº
  µÜ·B

  é§®ðgv DES Ã»ÈµÅì¬·éÉÍA±ÌR}hðg¢Ü·
  |

       openssl genrsa -out filename.key 1024

  ù¶Ìé§®ÉpX[hðÇÁ·éÉÍA±ÌR}hðg¢Ü· |

       openssl -in filename.key -des3 -out newfilename.key

  ù¶Ìé§®©çpX[hðí·éÉÍA±ÌR}hðg¢Ü· |

       openssl -in filename.key -out newfilename.key

  ÓFÊrwèµÈ¯êÎAé§®ÍJgfBNgÉì¬³êÜ·B
  ±êðæèµ¤ÉÍ 3 ÂÌÈPÈû@ª èÜ·BOpenSSL ªpXÉüÁÄ
  ¢êÎA®t@CðÛ¶·é½ßÉIñ¾fBNg©çÀs·é±Æª
  Å«Ü· (Apache ÌCXg[É RPM ðgÁ½êÌftHgÍ
  /etc/httpd/conf/ssl.key ÅA\[Xt@C©çCXg[µ½ÌÈç
  /usr/local/apache/conf/ssl.key Å·)BÊðÍA®ªì¬³ê½fBNg
  ©çA³µ¢fBNgÖÆt@CðRs[·é±ÆÅ·B³çÉAå
  È±Æð¾¢YêÜµ½ªAR}hÌÀsÉpXðwè·é±ÆªÅ«
  Ü· (eg.  openssl genrsa -out /etc/httpd/conf/ssl.key/filename.key
  1024)BÉiÞOÉìÆªIíÁÄ¢êÎAû@ÍÇêÅà\¢Ü¹ñB

  OpenSSL c[LbgÉÂ¢ÄÌæèÚµ¢îñÍA±±©Ä¾³¢ |
  OpenSSL Website <http://www.openssl.org/>

  3.2.  Ø¾¼vÌì¬

  Ø¾s@ÖÉæÁÄ¼³ê½Ø¾ðüè·éÉÍAØ¾¼v
  (CSR) ðì¬·éKvª èÜ·BÚIÍAé§®ðÛ²ÆÁ½èAµ¢Ì
  ïµ¢îñðë¯É³çµ½è·é±ÆÈAØ¾ðì¬·éÉ«éîñð
  Ø¾s@ÖÉé±ÆÅ·BCSR ÍAá¦ÎhC¼ânæîñÆ¢Á
  ½AØ¾ÉÜÜêéîñààÁÄ¢Ü·B

  o  CSR ðìéàÆÌé§®ðmFµÜ·B±ÌR}hðüÍµÄ¾³¢
     |

       openssl req -new -key filename.key -out filename.csr

  o  næîñA¤Ê¼ (hC¼)AgDîñÈÇÌüÍðßçêÜ·BK
     vÆ³êéÚÆAsKØÈGgÌîñðAÌpµæ¤ÆµÄ¢é CA
     Éâ¢í¹Ä¾³¢B

  o  CSR ð CA Ìw¦É]ÁÄèÜ·B

  o  Vµ¢Ø¾ðÒ¿ÂÂA é¢Í©Ø¾ðì¬µÄ¾³¢B©
     Ø¾ÍØ¾s@Ö©çØ¾ðó¯ÆéÜÅgp·é±ÆªÅ«Ü
     ·B

  ÓFé§®Æv(ó:CSR)ð¯Éì¬·éÉÍAÌR}hðg¢Ü
  ·B

       openssl genrsa -des3 -out filename.key 1024

  3.3.  ©Ø¾Ìì¬

  CA Ì¼µ½Ø¾ðüèµæ¤ÆµÄ¢éÈçA©Ø¾ðìéKvÍ
   èÜ¹ñBÆÍ¢¦A©Ø¾Ìì¬Í½¢ÖñÈPÅ·BKvÈÌÍA
  é§®ÆZLAÉµ½¢T[oÌ¼O (®SCühC¼) Å·Bnæî
  ñâ¤Ê¼ (hC¼)AgDîñÈÇðuËçêÜ·BOpenSSL ÅÍA±
  ±Å©ÈèÌ©Rª««Ü·BØ¾ª³íÉ@\·é½ßÉBêKvÈîñ
  ÍA¤Ê¼ (hC¼) Å·B±êªÈ©Á½èA¯½èµÄ¢é
  ÆACertificate Name Check xðuEU©çó¯é±ÆÉÈèÜ·B

  ©Ø¾ðì¬·éÉÍ |

       openssl req -new -key filename.key -x509 -out filename.crt

  3.4.  EFuT[oÖÌØ¾ÌCXg[

  ±êçÌw¦É]ÁÄ¢½çA¡ÜÅÌÆ±ëA±±ÜÅÅÍÁÉâèÍN«
  Ä¢È¢Í¸Å·BCSR ðØ¾s@ÖÉÁÄAÜ¾Ø¾ðó¯ÆÁÄ
  ¢È¢ÈçA¿åÁÆêxÝµÜµå¤I ©Ø¾ðgÁÄ¢é©AØ¾
  ðó¯Æè¸ÝÈçAÉiñÅà\¢Ü¹ñB

  o  é§®t@CªAg¤Æß½êÉ é±ÆðmFµÄ¾³¢B±
     áÍ RedHat RPM ÉæéCXg[ÌftHg
     lA/etc/httpd/conf/ssl.key Éî¢Ä¢Ü·B

  o  CA ª¼µ½A é¢Í©ÌØ¾ªwè³ê½fBNgÉ é±
     ÆðmFµÄ¾³¢BJèÔµÜ·ªAÍ RPM ÌftHgÅ é
     /etc/httpd/conf/ssl.crt ðg¢Ü·BÜ¾»±ÉÈ¯êÎA»±Ézu
     µÄ¾³¢B

  o  àµACXg[·éÔØ¾ (Ü½Í[gØ¾) ª éÈçA
     »êà /etc/httpd/conf/ssl.crt fBNgÉRs[µÄ¾³¢B

  o  ÍAhttpd.conf t@CðÒW·éKvª èÜ·BÌXeb
     vA``Apache Server ÌÝè'' ÉiÞOÉA±Ìt@CÌobNAbv
     ðìÁÄ¾³¢B

  4.  Apache Server ÌÝè

  SSL ðT|[g·é½ßÉÍAApache ÍÇÁÌ API W[ðg¤æ¤É
  Ýè³êéKvª èÜ·B½Ì SSL \tgEFApbP[WªpÅ«
  Ü·BÌáÅÍAModSSL Æ OpenSSL pÉÝè³ê½ Apache ð³ÉµÄ¢
  Ü·B±êçÌv_NgðT|[g·é¦ØêÈ¢ç¢Ì[O
  Xgâj[XO[vª èÜ·B Apache EFuT[oð³ÉµÄ¢é¢
  Â©Ì¤p SSL pbP[WÉàA±êçÌèø«ªLp¾Æv¤©àµê
  Ü¹ñB

  ¢Â©ªÉüêÄ¨×«±Æª èÜ· | ¯¶T[oÉ¡Ì@[
  `zXgð½Äé±ÆªÅ«Ü·B¯¶ IP AhXÅA¼Ox[XÌ
  @[`zXgð½½Äé±ÆªÅ«Ü·B¯¶ IP AhXÅA¼O
  x[XÌ@[`zXgð½ÆAZLAÈ@[`zXgð 1
  Â½Äé±ÆàÅ«Ü·B½¾µ | ¯¶ IP AhXÅA¡ÌZLAÈ
  @[`zXgð½Äé±ÆÍÅ«Ü¹ñB½Ìlª±¤uËéÅµå
  ¤ | ½ÌH ÆB¦Í±¤Å· | SSL ÍAvP[VwÌºÅ@\
  µÜ·B¼Ox[XÌzXgÍAAvP[VwÜÅÍè`³êÄ¢Ü¹
  ñB

  ÁÉA¯¶ SOCKET (IP AhX + |[g) ÉÂ¢ÄA¡ÌZLAÈ
  @[`zXgð½Äé±ÆÍÅ«Ü¹ñBftHgÅÍAZLAÈ
  zXgÍ|[g 443 ðg¢Ü·B@[`zXgª¯¶ IP AhXÅ
  ÙÈé|[gÔðg¤±ÆÅAÊÌ\Pbgðì¬·éæ¤ÉÝèðÏX·
  é±ÆÍÅ«Ü·B±Ìû@ÉÍ½Ìssª èÜ·BêÔ¾mÈss
  ÍAftHg|[gðgÁÄ¢È¢êAZLATCgÖÌANZXÉ
  ¨¢ÄAURL É|[gÔðÜßÈÄÍÈçÈ¢±ÆÅ·B

  á¦ÎF

  o  ftHg|[gðg¤TCgAwww.something.com
     ÍAhttps://www.something.com ÅANZXÅ«Ü·

  o  |[g 8888 ðg¤TCgÅÍAhttps://www.something.com:8888 ÅAN
     ZXÅ«Ü·B

  à¤êÂÌssÍA½³ñÌ|[gðg¤ÆA|[gðk¬ÜíénbJ
  [Éæè@ïð^¦é±ÆÉÈéAÆ¢¤±ÆÅ·BÅãÉAIñ¾|[gª
  ½©¼ÅgíêÄ¢éÆAÕËâèª¶·é±ÆÉÈèÜ·B

  4.1.  ZLAÈ@[`zXgÌè`

  @[`zXgÌÝuÍASÈPÅ·BZLAÈ@[`zXg
  ðÝè·éî{ðA¢µÄ¢«Ü·B

  ±êçÌáÉ¨¢ÄA.crt Æ .key t@Cg£qðg¢Ü·B±êÍAl
  XÈt@CÆÌ¬ðð¯éAÂlIÈû@Å·BApache ðg¤ÈçAD
  «Èg£qðg¦Ü·µA é¢Íg£qÈµÉàÅ«Ü·B

  ZLAÈ@[`zXgÍSÄAÊíÍ httpd.conf t@CÌöÉ
  zu³êéA<IfDefine SSL> Æ </IfDefine SSL> ÉïÜ³êéKvª èÜ
  ·B

  ZLAÈ@[`zXgÌáÅ· |

       <VirtualHost 172.18.116.42:443>
       DocumentRoot /etc/httpd/htdocs
       ServerName www.somewhere.com
       ServerAdmin someone@somewhere.com
       ErrorLog /etc/httpd/logs/error_log
       TransferLog /etc/httpd/logs/access_log
       SSLEngine on
       SSLCertificateFile /etc/httpd/conf/ssl.crt/server.crt
       SSLCertificateKeyFile /etc/httpd/conf/ssl.key/server.key
       SSLCACertificateFile /etc/httpd/conf/ssl.crt/ca-bundle.crt
       <Files ~ "\.(cgi|shtml)$">
             SSLOptions +StdEnvVars
       </Files>
       <Directory "/etc/httpd/cgi-bin">
             SSLOptions +StdEnvVars
       </Directory>
       SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
       CustomLog /etc/httpd/logs/ssl_request_log \
                 "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
       </VirtualHost>

  SSL ÉÂ¢ÄÅàdvÈfBNeBuÍASSLEngine on,
  SSLCertificateFile, SSLCertificateKeyFile, »ê©ç½ÌêÅ
  SSLCACertificateFile Å·B

  4.1.1.  SSL Engine

  "SSLEngine on"| ±êÍASSL ðJn·é½ßÌ ModSSL R}hÅ·B

  4.1.2.  SSLCertificateFile

  SSLCertificateFile ÍAApache ÉØ¾t@CÌÝÆA»êªÈñÆ¢
  ¤¼OÈÌ©ðw¦µÜ·BãÌáÅÍA"server.crt" ªØ¾t@C¼
  ÆµÄ¦³êÄ¢Ü·B±êÍAApache ÆêÉ ModSSL ðÝèµ½ÉÇ
  Á³êéftHgÅ·BÂlIÉÍAftHgÌ¼Oðg¤±ÆÍ¨©ß
  µÜ¹ñBÊ|ÈÌð±ç¦ÄAØ¾ÉT[o¼.crt (hC¼.crt) Æ
  ¼t¯Ä¾³¢B¯¶æ¤ÉAftHgÌ /etc/httpd/conf/ssl.crt â
  /usr/local/apache/conf/ssl.crt ÆÍÊÌfBNgðg¤±ÆàÅ«Ü
  ·B

  4.1.3.  SSLCertificateKeyFile

  SSLCertificateKeyFile ÍAApache Éé§®Ì¼OÆ»ÌÝðw¦µÜ
  ·B±±Åwè³ê½fBNgÍ root ÌÝªÇÝ/« ÀðÁÄ¢
  éKvª èÜ·B¼ÉÍNà±ÌfBNgÉANZX·é×«ÅÍ è
  Ü¹ñB

  4.1.4.  SSLCACertificateFile

  SSLCACertificateFile fBNeBuÍAApache ÉÔØ¾Ìêðw¦
  µÜ·B±ÌfBNeBuÍAgpµÄ¢é CA ÉæÁÄKv¾Á½èsK
  v¾Á½èµÜ·B±ÌØ¾ª{¿IÉMÌÖÆÈèÜ·B

  ÔØ¾ | Ø¾s@ÖÍA È½ÆÙÆñÇ¯¶û@ÅØ¾ð¾Ü
  ·B±êÍAÔØ¾ÆµÄmçêÄ¢Ü·B±êÍAî{IÉÍÔØ¾
  ÌÒªA¢¤àÌÅ·BEFuuEUÍAe[X²ÆÉXV³ê
  éA"MÅ«é" Ø¾s@ÖÌXgðÁÄ¢Ü·BØ¾s@Öª
  SVµ¢ÈçA»ÌÔØ¾ÍAuEUÌMÅ«é CA XgÉÍ
  üÁÄ¢È¢Åµå¤BÙÆñÇÌlª©ªÌuEUð»¤pÉÉAbvf
  [gµ½èµÈ¢Æ¢¤Àð±êÆí¹éÆA±¤ÈèÜ· | CA ª©
  ®IÉMÅ«éàÌÆµÄF¯³êéÉÍAN©©èÜ·BðôÍA
  SSLCACertificateFile fBNeBuðgÁÄAT[oÉÔØ¾ðC
  Xg[·é±ÆÅ·B½¢Ä¢A"M³ê½" CA ÍÔØ¾ðsµÄ
  ¢Ü·Bàµ»¤ÅÈ¯êÎASSLCertificateChainFile fBNeBuðg
  íËÎÈçÈ¢©àmêÜ¹ñªA±êÍÜ¸È¢±ÆÅ·B

  4.2.  Ø¾Ìá

  4.2.1.  T[oØ¾t@C

       -----BEGIN CERTIFICATE-----
       MIIC8DCCAlmgAwIBAgIBEDANBgkqhkiG9w0BAQQFADCBxDELMAkGA1UEBhMCWkEx
       FTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3duMR0wGwYD
       VQQKExRUaGF3dGUgQ29uc3VsdGluZyBjYzEoMCYGA1UECxMfQ2VydGlmaWNhdGlv
       biBTZXJ2aWNlcyBEaXZpc2lvbjEZMBcGA1UEAxMQVGhhd3RlIFNlcnZlciBDQTEm
       MCQGCSqGSIb3DQEJARYXc2VydmVyLWNlcnRzQHRoYXd0ZS5jb20wHhcNOTkwNTI1
       MDMwMDAwWhcNMDIwNjEwMDMwMDAwWjBTMQswCQYDVQQGEwJVUzEbMBkGA1UEChMS
       RXF1aWZheCBTZWN1cmUgSW5jMScwJQYDVQQDEx5FcXVpZmF4IFNlY3VyZSBFLUJ1
       c2luZXNzIENBLTIwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMYna8GjS9mG
       q4Cb8L0VwDBMZ+ztPI05urQb8F0t1Dp4I3gOFUs2WZJJv9Y1zCFwQbQbfJuBuXmZ
       QKIZJOw3jwPbfcvoTyqQhM0Yyb1YzgM2ghuv8Zz/+LYrjBo2yrmf86zvMhDVOD7z
       dhDzyTxCh5F6+K6Mcmmar+ncFMmIum2bAgMBAAGjYjBgMBIGA1UdEwEB/wQIMAYB
       Af8CAQAwSgYDVR0lBEMwQQYIKwYBBQUHAwEGCCsGAQUFBwMDBgorBgEEAYI3CgMD
       BglghkgBhvhCBAEGCCsGAQUFBwMIBgorBgEEAYI3CgMCMA0GCSqGSIb3DQEBBAUA
       A4GBALIfbC0RQ9g4Zxf/Y8IA2jWm8Tt+jvFWPt5wT3n5k0orRAvbmTROVPHGSLw7
       oMNeapH1eRG5yn+erwqYazcoFXJ6AsIC5WUjAnClsSrHBCAnEn6rDU080F38xIQ3
       j1FBvwMOxAq/JR5eZZcBHlSpJad88Twfd7E+0fQcqgk+nnjH
       -----END CERTIFICATE-----

  4.2.2.  Ø¾t@CÌàe

  Certificate:
     Data:
       Version: 3 (0x2)
       Serial Number: 1516 (0x5ec)
       Signature Algorithm: md5WithRSAEncryption
       Issuer: C=US, O=Equifax Secure Inc, CN=Equifax Secure E-Business CA
       Validity
         Not Before: Jul 12 15:21:01 2000 GMT
         Not After : Jun  2 22:42:34 2001 GMT
       Subject: C=us, ST=ga, L=atlanta, O=Equifax, OU=Rick, CN=172.18.116.44/Email=richard.sigle@equifax.com
       Subject Public Key Info:
         Public Key Algorithm: rsaEncryption
         RSA Public Key: (1024 bit)
             Modulus (1024 bit):
               00:c8:eb:93:26:97:ca:00:ce:4c:e4:f3:fd:43:31:
               cd:53:ed:b4:8a:ad:93:84:dc:7a:48:39:b5:28:57:
               03:7f:a9:ac:3e:58:6a:7a:e3:52:3e:1e:52:58:a2:
               6f:23:ad:bb:84:d8:88:ed:6d:a5:da:08:6b:c8:6c:
               a5:4c:34:67:d8:46:1c:ca:20:50:b0:e8:54:7f:ca:
               5e:ef:09:ff:6e:8d:a6:2b:02:f5:54:0f:c2:d0:45:
               12:ad:66:e7:8b:dd:68:be:64:a4:9b:69:bd:a4:1a:
               5e:ef:09:ff:6e:8d:a6:2b:02:f5:54:0f:c2:d0:45:
               12:ad:66:e7:8b:dd:68:be:64:a4:9b:69:bd:a4:1a:
               5a:2f:3b:6e:73:84:d8:d6:17:bd:12:39:34:fa:3d:
               d8:a9:e8:59:3c:c2:61:c5:b3
             Exponent: 65537 (0x10001)
       X509v3 extensions:
         X509v3 Key Usage: critical
            Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment
         Netscape Cert Type:
            SSL Server
         X509v3 Authority Key Identifier:
            keyid:5B:E0:A8:75:1C:78:02:47:71:AB:CE:27:32:E7:24:88:42:28:48:56
     Signature Algorithm: md5WithRSAEncryption
       87:53:74:e9:e1:a6:10:56:8c:fa:63:0e:7b:72:ff:76:4b:79:
       0e:49:2a:58:ed:71:7a:bf:77:61:fa:e8:74:04:37:8c:d3:6a:
       9a:3d:80:76:7a:c3:64:30:e7:1b:40:25:4e:2a:81:8b:e5:ac:
       76:a4:38:67:cc:3f:93:43:e1:1d:c3:8d:ba:ed:cc:d7:aa:a4:
       ab:d3:84:77:7c:8f:26:f6:dd:ba:3b:6a:99:81:e1:9e:7e:0f:
       ca:a6:ff:c0:c3:59:6e:dc:a6:03:23:bf:8f:24:ff:15:ad:ac:
       0d:85:fc:38:bf:d1:24:2d:1a:d3:72:55:12:95:5f:65:f0:60:
       df:b1

  4.2.3.  é§®t@C

  -----BEGIN RSA PRIVATE KEY-----
  Proc-Type: 4,ENCRYPTED
  DEK-Info: DES-EDE3-CBC,124F61450D85A480

  ELz64SV+tFSRybsHjY9NH7CP7yDHXP6xcd9FY6MVgQykTkq2h0n7j+tmpfUPbStT
  6jCgm/dTYM9mpkQ3jYZBALiVD5JNJ9t1dWisxQXY/nsak8LSTN7LhUtZSfk5xSmV
  Zsl4gwQS20UdBzFiJ+4qDajP/pzocSdSuQvxIHq7UzNwJsW8UYxR3I1qrDgyNXKS
  db41BWH4QdNtE0p+pi9VndDzXktqZGHEvtrQTV+39DV/dwOdnGBpYBETljMO5X6t
  D42xcVs0Doa1vZ6PiMCkwFNPXsPlKHZtHwEL4I3CQdiH4E0oYh3klBzlXBY4YldN
  A+s4xU44FpXp5xwt9nnVPUKHPo+NpdaRK7dAcRNO3GN3+ek1ggzvEjjuWKes3RQh
  PlHPuF7VWo4KeaTfTIwJWfGxz4nvwlVByPJ6Z73Mn0VcDXCkVm6+h3PLlYL0FMqM
  baUyQPpw6bhfW71FO/IIQxz3R1EqkxW7OHv74uuYl8kjHXf3S6qRZEGUG/zOGLGr
  mI5s2qnU69HlBObFkc6WQq0QxMq4PiUi7HhCLMkH8+wBsNNMnb75+7lQKkEhdOeE
  iUMKe5kgQqfd9w8jsBH5nu+J/nCfvPdp0isQW+P3/Rrh6YMwdKnlVfNZWdGiTzpQ
  ngThAGq5lit4uf4zdTIYYrs+T9I5ltjj0KgCUD4VL5/7OfnR3gcphpbHXQf0E2cz
  Qwq7q7ppKwCf/x92pHi8oVevlV5Dx9NQbGhEOA5pooqD6S2xZBbPLzkUKWDEO2il
  oBZ5L1jClR5jjdF2U61w7aRrL0t6luDU/aRv/fcoYes=
  -----END RSA PRIVATE KEY-----

  4.2.4.  é§®t@CÌàe

  read RSA key
  Enter PEM pass phrase:
  Private-Key: (1024 bit)
  modulus:
      00:c8:eb:93:26:97:ca:00:ce:4c:e4:f3:fd:43:31:
      cd:53:ed:b4:8a:ad:93:84:dc:7a:48:39:b5:28:57:
      03:7f:a9:ac:3e:58:6a:7a:e3:52:3e:1e:52:58:a2:
      6f:23:ad:bb:84:d8:88:ed:6d:a5:da:08:6b:c8:6c:
      a5:4c:34:67:d8:46:1c:ca:20:50:b0:e8:54:7f:ca:
      5e:ef:09:ff:6e:8d:a6:2b:02:f5:54:0f:c2:d0:45:
      12:ad:66:e7:8b:dd:68:be:64:a4:9b:69:bd:a4:1a:
      5a:2f:3b:6e:73:84:d8:d6:17:bd:12:39:34:fa:3d:
      d8:a9:e8:59:3c:c2:61:c5:b3
  publicExponent: 65537 (0x10001)
  privateExponent:
      00:b6:57:7d:3b:58:24:1e:a9:1b:85:e9:9c:9e:5f:
      d3:3d:69:0c:21:93:37:bf:2b:2c:da:e1:6c:74:48:
      cb:c7:0f:60:5f:50:74:8a:44:45:be:54:5c:5d:4e:
      45:58:f6:f1:a8:b5:af:46:f2:ec:c2:bc:43:bd:28:
      44:b7:ad:13:d3:ca:de:59:24:e8:fa:f8:e5:5f:45:
      38:2c:a0:a3:de:98:13:d8:80:38:e1:47:53:4c:ea:
      e4:66:c3:82:93:89:c3:90:83:44:e1:13:4f:74:76:
      e2:c0:89:97:77:5f:33:d8:7d:27:21:52:55:c2:d7:
      dc:01:f9:bc:21:8d:a3:f5:c1
  prime1:
      00:e3:2d:6b:5e:05:6b:e1:46:e6:ab:ae:f3:8b:d0:
      5f:94:5c:6f:f5:47:46:1d:4e:66:d3:7e:98:18:e0:
      2c:0d:08:ca:b7:29:72:af:53:62:30:ec:be:26:1f:
      cc:5a:ed:65:62:65:70:1e:18:19:61:e3:77:00:a7:
      3a:9e:4e:12:93
  prime2:
      00:e2:69:56:78:e8:39:ff:17:db:cc:39:d7:7f:70:
      41:dc:c5:59:43:16:c1:84:4c:ae:e7:5d:8a:c5:4b:
      da:88:8e:03:99:7c:88:f2:8a:13:31:57:44:e0:b5:
      c8:0a:60:b0:05:de:f6:9e:f2:00:ec:37:21:8d:3b:
      dc:8e:c9:d4:61
  exponent1:
      1a:ad:6a:be:4f:c4:ab:5f:b8:16:d1:24:a8:76:7f:
      c2:dc:58:09:65:a5:46:2b:be:c7:77:46:45:25:8e:
      06:b9:d1:94:50:b9:b6:fd:03:ba:db:12:39:47:e2:
      a7:8a:d9:2d:04:dc:75:ac:3e:ce:cf:f7:59:8c:49:
      c5:ed:45:21
  exponent2:
      2d:4e:fd:32:06:ef:0c:40:7f:08:d8:8e:6a:7f:51:
      7e:d7:b3:6c:3c:92:8f:62:35:22:31:d3:02:76:92:
      8d:ff:35:73:32:bb:c9:25:9e:7f:a2:42:33:61:cd:
      5d:5e:49:fb:72:ca:11:b6:c6:3e:7f:2d:e4:b0:95:
      0b:b2:12:21
  coefficient:
      50:52:09:22:cb:fb:b2:b8:58:85:ab:1d:82:b9:6e:
      d0:f6:dc:e8:ce:a6:5d:a1:ff:c8:4d:3b:2b:1c:19:
      64:f0:c4:4a:bc:b2:1d:2b:2d:09:59:83:a3:9a:89:
      f8:db:2c:2c:8a:bd:fd:a3:16:51:76:aa:ce:ea:85:
      6b:1c:9f:f7

  4.3.  Web T[oÌÄN®

  EFuT[oðÄN®·éXNvgÍA¨»ç
  /usr/local/sbin©A/usr/sbin (httpd Æ¢¤XNvg¼Å)A é¢Í
  /usr/local/apache/bin (apachectl Æ¢¤XNvg¼Å) É éÅµå
  ¤B SSL ðLøÉµÄT[oðN®µÄ¢È¢ÈçAT[oðâ~µÄAN
  ®³¹éKvª èÜ·BJnAÄN®Aâ~Ì½ßÉA©ªpÌJX^}C
  Yµ½XNvgð¢Äà\¢Ü¹ñBSSL GWªN®·éÀèAâè
  Í èÜ¹ñB

  R}hÍ |

       httpd stop
       httpd startssl
       httpd restart

   é¢Í

       apachectl stop
       apachectl startssl
       apachectl restart

  5.  guV[eBO

  ¶µ¤éA èª¿Èâèð¢Â©¢Ä¨«Ü·B

  5.1.  T[oÍN®µ½æ¤É©¦éªAZLATCgÉANZXÅ«È¢

  error_log t@Cð`FbNµÄ¾³¢B@[`zXgªG[
  Oðæ¤ÉÝèµÄ¢È¢ÈçAl¦¼µ½ûª¢¢©àmêÜ¹ñBá
  ¦µ½ SSL @[`zXgÍAG[Ot@CÉoÍµÜ·B½
  ªA2, 3 ÌxÆAOÌÅãÉG[ª èAî{IÉÍé§®ªØ¾
  ÆêvµÈ¢AÆ¢¤àeÅµå¤B

  áF

       [Tue Nov 21 09:09:02 2000] [notice] Apache/1.3.14 (Unix) mod_ssl/2.7.1
       OpenSSL/0.9.6 configured -- resuming normal operations
       [Tue Nov 21 09:09:16 2000] [notice] caught SIGTERM, shutting down
       [Tue Nov 21 14:39:54 2000] [notice] Apache/1.3.14 (Unix) mod_ssl/2.7.1
       OpenSSL/0.9.6 configured -- resuming normal operations
       [Tue Nov 21 14:40:31 2000] [notice] caught SIGTERM, shutting down
       [Tue Nov 21 14:43:53 2000] [error] mod_ssl: Init: (esi.fin.equifax.com:443)
       Unable to configure RSA server private key (OpenSSL library error follows)
       [Tue Nov 21 14:43:53 2000] [error] OpenSSL: error:0B080074:x509 certificate
       routines:X509_check_private_key:key values mismatch

  ãLÌG[bZ[Wð¾½ÈçAâèÍ®ÆØ¾ªêvµÈ¢±ÆÅ
  ·BftHgÌ server.keyt@CðgÁÄ¢È¢±ÆðmFµÄ¾³
  ¢BÜ½Ahttpd.conf t@Cð`FbNµÄAfBNeBuª³µ¢é
  §®ÆØ¾ðwµÄ¢é©ÌmFà·é×«Å·B

  mFÌ½ßAé§®ÆØ¾Ì®ª³mÅA¨Ý¢ÉÎðÈµÄ¢é±Æð
  ²×é±ÆàÅ«Ü·B±Ì½ßÉÍAºÌR}hðgÁÄé§®ð^[~
  iEBhEÉ»µAÊÌEBhEÅØ¾ð»µÄ¾³¢B
  är·éÌÍA®»ê¼êÌW[ÆÀÌÅ·B®ÌW[ÆÀÌª
  Ø¾Ì»êÆêv·éÈçÎA»ÌØ¾Æ®ª³µÎÉÈÁÄ¢éÆ¢
  ¦Ü·B

  If all else fails, create a new private key, CSR or self-signed
  certificate.  Before you do this, check your CA's re-issue policy.
  You may be charged for a re-issue.

  To view the contents of the certificate:

       openssl x509 -noout -text -in filename.crt

  To view the contents of the private key:

       openssl rsa -noout -text -in filename.key

  5.2.  Certificate Name Check Warning is issued by the client's browser

  The most common cause for this is omitting the "www" at the beginning
  of the domain name when creating the CSR.  The name defined by the
  "ServerName" directive for that virtual host must match the domain
  name presented by the certificate exactly or the browser will let the
  client know.  The exception is a wild card certificate.  A wild card
  certificate's domain name field would look like *.somedomain.com.
  This enables you to use one certificate for any number of sub-domains
  of somedomain.com (e.g. host1.somedomain.com and
  host2.somedomain.com).

  5.3.  NCAgÌuEUÉAØ¾ªM³êÄ¢È¢Ø¾s@Ö

  If you are using a self-signed certificate, you will get this warning.
  Your clients will be given the option to trust your certificate or
  not.  If you have a CA signed certificate and are getting the
  untrusted warning, you probably need to install their intermediate
  (root) certificate.

  5.4.  SSLEngine on is an un-recognized command (Apache ÌN®)

  ±ÌG[bZ[WÍAApache ÆêÉ ModSSL ðRpCµÈ©Á½
  êÉ¶µÜ·B@[`zXgÅ SSL ðg¤ÌÉAÊÌfBN
  eBuðg¤ SSL pbP[Wà èÜ·BÊÌfBNeBuðg¤pbP
  [WðgÁÄ¢éê±ÌG[bZ[WðÜ½©é±ÆÉÈèÜ·B

  5.5.  "PEM pXt[Y" ðYêÄµÜ¢AÇ¤âÁÄ»êðÄÝè·é©
  mè½¢B

  ±ÌpXt[YðÄÝè·éû@Í èÜ¹ñBð·éÉÍApXt[
  Yð¯¦Ä¨©AVµ¢é§®ðì¬·éµ© èÜ¹ñB»¤·éÆAV
  µ¢Ø¾ðæ¾·é©AVµ¢©Ø¾ðì¬·éKvªÅÄéÅµå
  ¤B

  6.  pêW

     FØ
        T[oâNCAgA[UÆ¢Á½lbg[NãÌ¶ÝðA¾m
        É¯êÅ éÆØ¾·é±ÆBSSL Ì¶¬ÅÍAFØÍT[oÆNC
        AgÉ¨¯éØ¾ÌÆßöð¢¢Ü·B

     ANZX§ä
        lbg[NÌæÖÌANZXð§À·é±ÆBÊí Apache Ì¶¬Å
        ÍA é URL ÖÌANZXð§À·é±ÆB

     ASY
        Àçê½èÅâèðð·é½ßÌ¾Èè®A é¢ÍK¥ÌgB
        Ã»Ì½ßÌASYÍAÊí cipher ÆÄÎêÜ·B(óF
        {¶ÅÍAcipher àÃAÈÇÆóµÄÜ·B)

     Ø¾
        T[oâNCAgÆ¢Á½lbg[NGeBeBðFØ·éÌ
        ÉgíêéAf[^R[hBØ¾ÍA»ÌLÒ (subject ÆÄÎ
        êÜ·) Æ¼ð·éØ¾s@Ö (issuer ÆÄÎêÜ·) ÉÖ·
        é X.509 ÌîñfÐAÁ¦ÄLÒÌé§®Æ CA ÉæÁÄì¬³ê
        ½¼ðÜÝÜ·Blbg[NGeBeBÍ±êçÌ¼ðØ·
        éÌÉA CA ÌØ¾ðg¢Ü·B

     FØ@Ö (CA)
        M³êÄ¢éæOÒ@ÖÅAlbg[NGeBeBªÀSÈèi
        ÅFØ³êé½ßÉA»ÌØ¾É¼·éÌªÚIÅ·B¼Ìlbg
        [NGeBeBÍ¼ð`FbNµÄA CA ªØ¾Ì^ÑèÆµ
        ÄFØ³êÄ¢é±ÆðmF·é±ÆªÅ«Ü·B

     Ø¾¼v (CSR)
        FØ@ÖÉño³êé¼³êÄ¢È¢Ø¾ÅA»Ì CA Ø¾Ìé
        §®Å¼³êÜ·BCSR Í¼³êé±ÆÅ^ÌØ¾ÆÈèÜ·B

     TCt@
        f[^ÌÃ»Ì½ßÉg¤ASYâVXeBá¦ÎADES,
        IDEA, RC4 ÈÇÅ·B(óF´¶Ì~XÆzèµÄóÉèðÁ¦Ä¢
        Ü·)

     Ã¶
        vCeLXgÉÃ@ð{µ½ÊB

     ÝèfBNeBu
        vOÌ®É¨¢ÄA1 ÂÈãÌ¤Êðì·éÝè½
        ßBApache Ì¶¬ÅÍAÝèt@CÌÅÌJÉ çäé½ß
        ª«Ü·B

     Ã» | ÎÌ
        NCAgÆT[oªAf[^ÌÃ»Æ»É¯¶®ðp¢Ü
        ·B

     Ã» | ñÎÌ
        ®ÌyA (öJ®Æé§®) Å\¬³êÜ·BPKI ÍñÎÌÃÅ·B

     fW^¼
        Ã»³ê½bZ[WÆÆàÉM³êéf[^ÅAì¬ÒÌØ¾ð
        µAüâ³êÄ¢È¢±ÆðmFµÜ·B

     HTTPS
        (ÀSÈ)nCp[eLXg]vgRÅAWorld Wide Web É¨¯
        éWÌÃ»³ê½ÊMJjYÅ·B±êÍAÀÛÉÍPÈé
        HTTP over SSL Å·B

     bZ[W_CWFXg
        bZ[WÌnbVÅAbZ[WÌàeª]ÉÏX³êÄ¢È
        ¢±ÆðmF·é½ßÉp³êÜ·B

     ÛFh~
        (CÓÌæOÒ@Ö©çCÓÌÉmFÂ\È) U¢sÂ\ÈÖWÆA
        {¨Å é±Æª¢mxÅf¾Å«éFØÆÌoûÉ¨¢ÄAf[^
        Ì³T«ÆN¹ÆªØ¾³êÄ¢éT[rXB

        ±êÍÃ»è@ÉæÁÄB¬³ê½Á¿ÅAÂl é¢ÍÀÌÉAf
        [^ÉÖ·éÁèÌs®ðæêÈ¢æ¤É·é (á¦ÎÛFÖ~âF
        Ø(o©)Ì@\A`±EÓuEÏCÈÇÌØ¾A é¢ÍL ÌØ¾
        ÈÇ)B

     OpenSSL
        I[v\[XÌ SSL/TLS c[LbgÅ·B
        http://www.openssl.org/ <http://www.openssl.org/> QÆB

     pXt[Y
        é§®t@CðÛì·éPêâZ¶BFØ³êÈ¢[UªA»êç
        ðÃ»Ég¤Ìðh¬Ü·B½¢Ä¢ÍATCt@[ÉÎµÄgíê
        éAÃ»/»Ìé§Ì®ÆÈèÜ·B

     ½¶
        Ã»³êÄ¢È¢eLXgB

     é§®
        öJ®ÃVXeÉ¨¯éé§Ì®ÅAÍ¢½bZ[WÌ»
        ÆAoÄ¢bZ[WÖÌ¼ÉgíêÜ·B

     öJ®
        öJ®ÃVXeãÉ¨¢ÄANÅàpÅ«é®ÅA»ÌLÒ¶
        ÄbZ[WÌÃ»ÆA»ÌLÒÉæé¼Ì»ÉgíêÜ
        ·B

     öJ®Ã
         é®ðÃ»AÊÌ®ð»Ég¤AñÎÌÈÃ»VXeÌ¤
        âAvP[VBÎ·é±êçÌ®Ìgª®yAð\¬µÜ
        ·BñÎÌÃÆàÄÎêÜ·B

     Secure Sockets Layer (SSL)
        êÊIÈÊMFØÆ TCP/IP lbg[NzµÌÃ»Ì½ßÉAlb
        gXP[vR~jP[VYÐÉæÁÄì¬³ê½vgRBÅ
        àL¼Èp@Í HTTPSA·Èí¿ HTTP over SSL Å·B

     ZbV
        SSL ÊMÉ¨¯éReLXgîñB

     SSLeay
        Eric A. Young <eay@aus.rsa.com> ªJµ½AÅÉ SSL/TLS ðÀ
        µ½CuBhttp://www.ssleay.org/
        <http://www.ssleay.org/> QÆB

     ÎÌÃ@
        Ã»Æ»Ì¼ûÉAPêÌé§®ðg¤A¤âAvP[V
        B

     gX|[gwZLeB (TLS)
        SSL ÌãpvgRÅAêÊIÈÊMFØÆ TCP/IP lbg[Nz
        µÌÃ»Ì½ßÉAC^[lbgZp]cï (IETF) ÉæÁÄì¬
        ³êÜµ½B TLS Ìo[W 1 ÍASSL Ìo[W 3 ÆÙÆñ
        Ç¯êÅ·B

     jtH[\[XP[^ (URL)
        World Wide Web ãÌlXÈ\[XÌÊuð¦·A³KÌ¯ÊqB
        àÁÆàL¼È URL ÌXL[ÍA http Å·BSSL Í https Æ¢¤
        XL[ðp¢Ü·B

     X.509
        ÛÊMA (ITU-T) ª§·éFØØ¾ÌXL[ÅA SSL/TLS Ì
        FØÉp¢çêÜ·B

     ITU-T
        X.509 [CCI88c] ©ÍAX.509 ÌØ¾L@¾¯ÅÈ X.500 fBN
        gÌFØT[rXðè`µÜ·BX.509 ÌfBNgFØÍAé§
        ®ÅàöJ®ÅàÀÂ\ÅAãÒÍöJ®Ø¾ÉîÃàÌÅ·B
        WÅÍAÁèÌÃ»ASYÍwè³êÄ¢Ü¹ñªAWÉ
        ®·éQl¶ÅÍA RSA ASYÉÂ¢Äà¾ªÈ³êÄ¢
        Ü·B