2.2. ·çÆ® ÀÎÁõ ±â°ü ÀÎÁõ¼­(Root Certification Authority Certificate) ¸¸µé±â

CA.pl -newcert 
(openssl req -config /etc/openssl.cnf-new -x509 -keyout newreq.pem -out newreq.pem -days 365) 
  

ÀÚü ¼­¸íµÈ ·çÆ® ÀÎÁõ ±â°üÀÇ ÀÎÁõ¼­¸¦ ¸¸µç´Ù. ÀÎÁõ¼­¿Í Private Key´Â newreq.pem ¿¡ ÀúÀåµÈ´Ù. Common Name(CN)Àº "ACME root Certificate"¿Í °°Àº °ÍÀ» »ç¿ëÇÏ¸é µÈ´Ù. ÀÌ ÆÄÀÏ¿¡´Â ÀÎÁõ¼­¿Í Private Key°¡ ¼¯¿©Àֱ⠶§¹®¿¡ Âɰ³¾ß ÇÑ´Ù. ---CERTIFICATE--- ºÎºÐÀº ÀÎÁõ¼­ ºÎºÐÀ¸·Î cacert.pemÀ̶õ ÆÄÀÏ¿¡ ÀúÀåÇϰí, ---RSA PRIVATE KEY---ºÎºÐÀº Private Key·Î cakey.pem¿¡ ÀúÀåÇÑ´Ù. (¿ªÁÖ:ÀÌ ¶§ ¹Ýµå½Ã ---BEGIN...---ºÎºÐ°ú ---END...--- ºÎºÐÀÌ Æ÷ÇԵǵµ·Ï ÀúÀåÇØ¾ß ÇÑ´Ù.) ±× ´ÙÀ½¿¡ Ű ´©ÃâÀ» ¹æÁöÇϱâ À§ÇØ newreq.pemÀ» Áö¿ìÀÚ.

openssl.cnf¿¡ Æ÷ÇÔµÈ database°æ·Î¿¡ "index.txt"¶ó´Â ºó ÆÄÀÏÀ» ¸¸µé°í, serial°æ·Î¿¡ 1 À̶õ ¼ýÀÚ·Î µÈ "serial"ÆÄÀÏÀ» »ý¼ºÇÑ´Ù. (¿ªÁÖ:¾Æ·¡´Â ¿ªÀÚ°¡ »ý¼ºÇÑ ¹æ¹ýÀÌ´Ù.)

# touch /etc/index.txt
# echo "01" > /etc/serial
  

±âº»ÀûÀ¸·Î 365ÀÏ ³¯Â¥ Á¦ÇÑÀÌ µÇ¾î Àִµ¥, ÀÌ·¸°Ô Çϸé 1³âÀÌ Áö³ª°í ³ª¼­ ´õÀÌ»ó ·çÆ® ÀÎÁõ ±â°üÀÇ Å°¿Í ±×°Í¿¡ ÀÇÇØ ¼­¸íµÈ ۵éÀ» »ç¿ëÇÒ ¼ö ¾ø´Ù. ÀÌ·¸°Ô µÇ´Â °ÍÀ» ¹æÁöÇÏ·Á¸é ³¯Â¥ Á¦ÇÑÀ» Å©°Ô ÇØ¼­ »ý¼ºÇÏ¸é µÈ´Ù. ±â¾÷ Á¤µµÀÇ ·¹º§¿¡¼­´Â ¾à 5³â Á¤µµÀÇ ±â°£À» ±Ç°íÇÑ´Ù. (¿ªÁÖ:¾ÆÁ÷ SSL¿¡ ´ëÇØ ¿Ïº®È÷ ¾ËÁö ¸øÇÑ´Ù¸é ªÀº ±â°£¸¸ ¼³Á¤ÇÒ °ÍÀ» ±Ç°íÇÑ´Ù.)

openssl req -config /etc/openssl.cnf-new -x509 -keyout newreq.pem -out newreq.pem -days 1825
  

ÀÌ·¸°Ô »ý¼ºµÈ ·çÆ® ÀÎÁõ ±â°ü Ű´Â ¹Ýµå½Ã ´Ù¸¥ ÀÎÁõ¼­µéÀ» ¼­¸íÇÏ´Â °÷¿¡¸¸ »ç¿ëÇØ¾ß ÇÑ´Ù. Private Key´Â À§Çè¿¡ ³ëÃâµÇÁö ¾Êµµ·Ï ¹Ýµå½Ã ¾ÈÀüÇÑ °÷¿¡ º¸°üÇϰí, Àý´ë·Î ¾ÏÈ£¹®(Passphrase)À» Á¦°ÅÇØ¼­´Â ¾ÈµÈ´Ù.

ÀÚ. ÀÌÁ¦ ·çÆ® ÀÎÁõ ±â°üÀ» ¸¸µé¾ú´Ù. ´Ù¸¥ »ç¶÷µéÀÌ ´ç½ÅÀÇ ·çÆ® ÀÎÁõ ±â°ü ÀÎÁõ¼­°¡ ÇÊ¿äÇÒ ¼ö ÀÖ´Ù. ±×·¯¸é ±×µé¿¡°Ô ´Ù¿î·Îµå¹Þ¾Æ¼­ ±×µéÀÇ ºê¶ó¿ìÀú¿¡ ¼³Ä¡Ç϶ó°í ¾Ë·ÁÁÖ¸é µÈ´Ù.

´Ù¸¥ ÀÎÁõ¼­¸¦ ¼­¸íÇÒ ¶§¸¶´Ù ¾ÏÈ£¹®À» ÀÔ·ÂÇØ¾ß ÇÏ´Â ¹ø°Å·Î¿òÀÌ ÀÖÁö¸¸, Private Key°¡ ´©ÃâµÉ °ÍÀ» »ý°¢Çؼ­ ±ÍÂú°Ô ¿©±âÁö ¸»ÀÚ.