doc-jp/README.SSL

   1 SSL ¥µ¥Ý¡¼¥È¤Ë¤Ä¤¤¤Æ
   2
   3                                                          (2000/11/07)  ²¬Éô¹îÌé
   4                                                         okabek@guitar.ocn.ne.jp
   5                                                          (2001/12/27)  ±»ôÊ¸ÉÒ
   6                                                               ukai@debian.or.jp
   7
   8  ¡¦ OpenSSL ¥é¥¤¥Ö¥é¥ê¤òÄÌ¤¸¤Æ, SSL ¤ò¥µ¥Ý¡¼¥È¤·¤Æ¤¤¤Þ¤¹.
   9     ¤¢¤é¤«¤¸¤á¥¤¥ó¥¹¥È¡¼¥ë¤·¤Æ¤ª¤¤¤Æ¤¯¤À¤µ¤¤.
  10
  11  ¡¦ OpenSSL ¥é¥¤¥Ö¥é¥ê¤¬¥¤¥ó¥¹¥È¡¼¥ë¤µ¤ì¤Æ¤¤¤ì¤Ð configure ¥¹¥¯¥ê¥×¥È¼Â¹Ô»þ¤Ë¼«
  12     Æ°Åª¤Ë¸¡½Ð¤µ¤ì¤ÆÍøÍÑ²ÄÇ½¤È¤Ê¤ê¤Þ¤¹.
  13     ¤â¤·¤¦¤Þ¤¯Æ°¤«¤Ê¤¤¤È¤¤Ï, config.h ¤ò¥Á¥§¥Ã¥¯¤·¤Æ¤ß¤Æ¤¯¤À¤µ¤¤. SSL ¤òÍøÍÑ¤¹
  14     ¤ë¤¿¤á¤Ë¤Ï, config.h ¤Ç, USE_SSL ¥Þ¥¯¥í¤¬ÄêµÁ¤µ¤ì¤Æ¤¤¤ëÉ¬Í×¤¬¤¢¤ê¤Þ¤¹.
  15     ¤µ¤é¤Ë, SSL Ç§¾Ú¥µ¥Ý¡¼¥È¤òÍøÍÑ¤¹¤ë¾ì¹ç¤Ï, USE_SSL_VERIFY ¥Þ¥¯¥í¤â¥Á¥§¥Ã¥¯¤·
  16     ¤Æ¤ß¤Æ¤¯¤À¤µ¤¤.
  17     ¥³¥ó¥Ñ¥¤¥ë¤Ç¥¨¥é¡¼¤¬½Ð¤ë¾ì¹ç¤Ï, ¥ê¥ó¥«¥Õ¥é¥°¤Ë `-lssl -lcrypto', ¥³¥ó¥Ñ¥¤¥é
  18     ¥Õ¥é¥°¤Ë '-I(SSLeay/OpenSSL ¤Î¥Ø¥Ã¥À¤¬¤¢¤ë¥Ç¥£¥ì¥¯¥È¥ê)' ¤¬¤¢¤ë¤«³ÎÇ§¤·¤Æ¤¯
  19     ¤À¤µ¤¤.
  20
  21     SSL ¥µ¥Ý¡¼¥È¤¬Í¸ú¤Ë¤Ê¤Ã¤Æ¤¤¤ë¤«¤É¤¦¤«¤Ï, Option Setting Panel ¤Ë¡ÖSSL¤ÎÀß
  22     Äê¡×¤¬´Þ¤Þ¤ì¤Æ¤¤¤ë¤«¤É¤¦¤«¤Ç³ÎÇ§¤Ç¤¤Þ¤¹.
  23
  24  ¡¦ SSL ¤Ë´Ø¤·¤Æ°Ê²¼¤ÎÀßÄê¤¬²ÄÇ½¤Ë¤Ê¤Ã¤Æ¤Þ¤¹:
  25
  26     ssl_forbid_method
  27         »È¤ï¤Ê¤¤SSL¥á¥½¥Ã¥É¤Î¥ê¥¹¥È(2: SSLv2, 3: SSLv3, t: TLSv1)
  28         (¥Ç¥Õ¥©¥ë¥È¤Ï<NULL>).
  29     ssl_verify_server ON/OFF
  30         SSL¤Î¥µ¡¼¥ÐÇ§¾Ú¤ò¹Ô¤¦(¥Ç¥Õ¥©¥ë¥È¤ÏOFF).
  31     ssl_cert_file ¥Õ¥¡¥¤¥ëÌ¾
  32         SSL¤Î¥¯¥é¥¤¥¢¥ó¥ÈÍÑPEM·Á¼°¾ÚÌÀ½ñ¥Õ¥¡¥¤¥ë(¥Ç¥Õ¥©¥ë¥È¤Ï<NULL>).
  33     ssl_key_file ¥Õ¥¡¥¤¥ëÌ¾
  34         SSL¤Î¥¯¥é¥¤¥¢¥ó¥ÈÍÑPEM·Á¼°ÈëÌ©¸°¥Õ¥¡¥¤¥ë(¥Ç¥Õ¥©¥ë¥È¤Ï<NULL>).
  35     ssl_ca_path ¥Ç¥£¥ì¥¯¥È¥êÌ¾
  36         SSL¤ÎÇ§¾Ú¶É¤ÎPEM·Á¼°¾ÚÌÀ½ñ·²¤Î¤¢¤ë¥Ç¥£¥ì¥¯¥È¥ê¤Ø¤Î¥Ñ¥¹
  37         (¥Ç¥Õ¥©¥ë¥È¤Ï<NULL>).
  38     ssl_ca_file ¥Õ¥¡¥¤¥ëÌ¾
  39         SSL¤ÎÇ§¾Ú¶É¤ÎPEM·Á¼°¾ÚÌÀ½ñ·²¤Î¥Õ¥¡¥¤¥ë(¥Ç¥Õ¥©¥ë¥È¤Ï<NULL>).
  40     ¤¿¤À¤·¡ÖSSLEAY_VERSION_NUMBER >= 0x0800¡×¤Ê´Ä¶¤Ç¤Ê¤¤¤ÈÌµÂÌ¤Ê¥³¡¼¥É¤¬Áý
  41     ¤¨¤ë¤À¤±¤Ê¤Î¤Ç, configure»þ¤Ëdisable¤·¤Æ¤ª¤¤¤¿¤Û¤¦¤¬¤è¤¤¤Ç¤·¤ç¤¦.
  42
  43     ¤Þ¤¿¼ÂºÝ¤ËÇ§¾Ú¤ò¹Ô¤¦¾ì¹ç, ssl_ca_path¤Þ¤¿¤Ïssl_ca_file¤Ç, ¥µ¡¼¥Ð¤Î¸°¤Ë
  44     ½ðÌ¾¤·¤Æ¤¤¤ëÇ§¾Ú¶É¤Î¾ÚÌÀ½ñ¤ò (ssl_verify_server¤ÎON/OFF¤Ë´Ø·¸Ìµ¤¯) »ØÄê
  45     ¤·¤Ê¤¤¤È¥µ¡¼¥ÐÇ§¾Ú¤ÏÀ®¸ù¤·¤Þ¤»¤ó¡£
  46
  47     ÄÌ¾ï»È¤ï¤ì¤Æ¤¤¤ëÇ§¾Ú¶É¤Î¾ÚÌÀ½ñ¤Ï°Ê²¼¤Î¤È¤³¤í¤Ê¤É¤«¤éÆþ¼ê¤Ç¤¤Þ¤¹¡£
  48
  49     * mozilla¤Î¥½¡¼¥¹¤Ë´Þ¤Þ¤ì¤Æ¤¤¤ë
  50        mozilla/security/nss/lib/ckfw/builtins/certdata.txt
  51       ¤«¤éÅºÉÕ¤Î ruby script ¤Ç *.pem¥Õ¥¡¥¤¥ë¤È¤·¤Æ¤È¤ê¤À¤·¤¿¤â¤Î
  52
  53         % ruby certdata2pem.rb < certdata.txt
  54
  55       ¤Ç¥«¥ì¥ó¥È¥Ç¥£¥ì¥¯¥È¥ê¤Ë *.pem¥Õ¥¡¥¤¥ë¤ò¤È¤ê¤À¤·
  56       openssl¤Î c_rehash ¥³¥Þ¥ó¥É¤Ç hash symlink ¤òºîÀ®¤·¤Þ¤¹¡£
  57       ¤³¤Î¥Ç¥£¥ì¥¯¥È¥ê¤ò ssl_ca_path ¤ËÀßÄê¤¹¤ë¤³¤È¤¬¤Ç¤¤Þ¤¹¡£
  58       ¤â¤·¤¯¤Ï¡¢*.pem ¤ò¤Þ¤È¤á¤¿°ì¤Ä¤Î¥Õ¥¡¥¤¥ë¤òºîÀ®¤·¤Æ¤ª¤±¤Ð
  59       ¤½¤ì¤ò ssl_ca_file ¤ËÀßÄê¤¹¤ë¤³¤È¤¬¤Ç¤¤Þ¤¹¡£
  60
  61    * mod_ssl¤Î¥½¡¼¥¹¤Ë´Þ¤Þ¤ì¤Æ¤¤¤ë pkg.sslcfg/ca-bundle.crt
  62       ¤³¤ì¤Ï PEM¤Ê¤Î¤Ç¡¢¤³¤Î¥Õ¥¡¥¤¥ë¤Î¥Õ¥ë¥Ñ¥¹Ì¾¤ò ssl_ca_file ¤Ë
  63       ÀßÄê¤¹¤ë¤³¤È¤¬¤Ç¤¤Þ¤¹¡£
  64
  65  ¡¦ ¥Ð¡¼¥¸¥ç¥ó 0.9.5 °Ê¹ß¤Î OpenSSL ¥é¥¤¥Ö¥é¥ê¤Ï, Íð¿ô¤ò½é´ü²½¤¹¤ë¤¿¤á¤Ë´ö¤Ä¤«
  66     ¤Î¥·¡¼¥É¤òÀßÄê¤¹¤ëÉ¬Í×¤¬¤¢¤ê¤Þ¤¹.
  67     ¥Ç¥Õ¥©¥ë¥È¤Ç¤Ï /dev/urandom ¤¬¤¢¤ì¤Ð¤½¤ì¤òÍøÍÑ¤·¤Þ¤¹¤¬, Ìµ¤±¤ì¤Ð w3m ÆâÉô
  68     ¤ÇÀ¸À®¤·¤Þ¤¹. ¤â¤·, EGD (Entropy Gathering Daemon) ¤Þ¤¿¤Ï PRNGD (Pseudo
  69     Random Number Generator Daemon) ¤¬ÍøÍÑ¤Ç¤¤ë´Ä¶¤Ç¤³¤ì¤ò»È¤¤¤¿¤¤¾ì¹ç¤Ï,
  70     USE_EGD ¥Þ¥¯¥í¤ò¥Á¥§¥Ã¥¯¤·¤Æ¤ß¤Æ¤¯¤À¤µ¤¤.
  71
  72  ¡¦ URL
  73
  74     OpenSSL - http://www.openssl.org/
  75     PRNGD - http://www.aet.tu-cottbus.de/personen/jaenicke/postfix_tls/prngd.html
  76
  77 ----------------------------------------------------------------
  78 #!/usr/bin/ruby
  79 # Copyright (c) 2001 Fumitoshi UKAI <ukai@debian.or.jp>
  80 #     All rights reserved.
  81 #     This is free software with ABSOLUTELY NO WARRANTY.
  82 #
  83 # You can redistribute it and/or modify it under the terms of
  84 # the Ruby's licence.
  85 #
  86 # certdata2pem.rb
  87
  88 while line = $stdin.gets
  89   next if line =~ /^#/
  90   next if line =~ /^\s*$/
  91   line.chomp!
  92   if line =~ /CKA_LABEL/
  93     label,type,val = line.split(' ',3)
  94     val.sub!(/^"/, "")
  95     val.sub!(/"$/, "")
  96     fname = val.gsub(/\//,"_").gsub(/\s+/, "_").gsub(/[()]/, "=") + ".pem"
  97     next
  98   end
  99   if line =~ /CKA_VALUE MULTILINE_OCTAL/
 100     data=''
 101     while line = $stdin.gets
 102       break if /^END/
 103       line.chomp!
 104       line.gsub(/\\([0-3][0-7][0-7])/) { data += $1.oct.chr }
 105     end
 106     open(fname, "w") do |fp|
 107       fp.puts "-----BEGIN CERTIFICATE-----"
 108       fp.puts [data].pack("m*")
 109       fp.puts "-----END CERTIFICATE-----"
 110     end
 111     puts "Created #{fname}"
 112   end
 113 end
 114 system("c_rehash", ".")