2.6. ÀÎÅÍ³Ý ÇÁ·ÎÅäÄÝ º¸¾È

2.6.1. Apache¿¡¼­ mod_sslÀ» ÀÌ¿ëÇÏ¿© ÀÎÁõ¼­ »ç¿ëÇϱâ

Àý´ë·Î ·çÆ® ÀÎÁõ ±â°ü ÀÎÁõ¼­¸¦ Apache¿¡¼­ »ç¿ëÇÏ¸é ¾ÈµÈ´Ù. ¿Ö³ÄÇϸé ApacheÀÇ Private Key´Â ¾ÏÈ£¹®(Passphrase)À» Á¦°ÅÇØ¾ß¸¸ »ç¿ëÇÒ ¼ö Àֱ⠶§¹®ÀÌ´Ù.

¿ì¼± ÀÎÁõ ¿ä±¸¼­¸¦ ¹ßÇàÇØ¾ß ÇÑ´Ù. ÀÌ ¶§ ¹Ýµå½Ã Common Name(CN)À» www.mysite.com°ú °°Àº À¥ µµ¸ÞÀÎÀ¸·Î ÇØ¾ß ÇÑ´Ù.

´ÙÀ½¿¡ Apache°¡ Á¤»óÀûÀ¸·Î ÀÛµ¿Çϱâ À§Çؼ­ ¾ÏÈ£¹®À» Á¦°ÅÇØ¾ß ÇÑ´Ù. ¾Æ·¡´Â Private Key¸¦ Æ÷ÇÔÇϰí ÀÖ´Â newreq.pemÆÄÀÏ¿¡¼­ ¾ÏÈ£¹®À» Á¦°ÅÇÏ´Â ¹æ¹ýÀÌ´Ù.

openssl rsa -in newreq.pem -out wwwkeyunsecure.pem
   

Private Key°¡ Á¦°ÅµÈ »óÅÂÀ̱⠶§¹®¿¡ ¹Ýµå½Ã ±ÇÇÑ(Permission)µîÀ» öÀúÇÏ°Ô Ã¼Å©ÇØ¾ß ÇÑ´Ù. ¸¸¾à ´Ù¸¥ »ç¶÷ÀÌ Private Key¸¦ ¾ò°Ô µÇ¸é ±× »çÀÌÆ®´Â º¸¾ÈÀÌ ¸Á°¡Áö°Ô µÇ¸ç, ±× »ç¶÷ÀÌ ¾ÇÀǷΠ۸¦ »ç¿ëÇÒ ¼ö ÀÖ´Ù. ÀÌ ÀÛ¾÷ÀÌ ³¡³ª¸é newcert¿Í wwwkeyunsecure.pemÀ» Apache¿¡¼­ »ç¿ëÇÏ¸é µÈ´Ù.

wwwkeyunsecure.pem°ú newcert.pemÀ» /etc/httpd/conf/ssl/¿¡ wwwkeyunsecure.pem °ú wwwcert.crt¶ó´Â À̸§À¸·Î º¹»çÇÑ´Ù. (¿ªÁÖ:ÀÌ ¶§ wwwkeyunsecure.pemÀÌ ¼­¹ö À¯Àú¿¡°Ô ³ëÃâµÇÁö ¾Êµµ·Ï ÆÛ¹Ì¼ÇÀ» Àß °ü¸®ÇÑ´Ù.)

/etc/httpd/conf/ssl/ssl.default-vhost.conf ÆÄÀÏÀ» ¼öÁ¤ÇÑ´Ù.

---- 
# Server Certificate: 
# Point SSLCertificateFile at a PEM encoded certificate. If 
# the certificate is encrypted, then you will be prompted for a 
# pass phrase. Note that a kill -HUP will prompt again. A test 
# certificate can be generated with `make certificate' under 
# built time. 
#SSLCertificateFile conf/ssl/ca.crt 
SSLCertificateFile wwwcert.crt
# Server Private Key: 
# If the key is not combined with the certificate, use this 
# directive to point at the key file. 
#SSLCertificateKeyFile conf/ssl/ca.key.unsecure
SSLCertificateKeyFile wwwkeyunsecure.pem 
----
   

httpd ÇÁ·Î¼¼½º¸¦ Á×À̰í(/etc/rc.d/init.d/httpd stop), ¸ðµç ÇÁ·Î¼¼½º°¡ Á×¾ú´ÂÁö È®ÀÎÇÑ ÈÄ(killall httpd), Àç½ÃÀÛÇÑ´Ù. (etc/rc.d/init.d/httpd start)

(¿ªÁÖ:Apache-SSLÀÇ °æ¿ì Apache¿Í º°µµÀÇ ÇÁ·Î¼¼½º¿¡¼­ µ¹¾Æ°¡¸ç, httpd.conf¿¡ SSL°ü·Ã ¼³Á¤ÀÌ ³»ÀåµÇ¾î ÀÖ´Ù.)

2.6.2. IMAPS¿¡¼­ ÀÎÁõ¼­ »ç¿ëÇϱâ

FIXME

2.6.3. POP¿¡¼­ ÀÎÁõ¼­ »ç¿ëÇϱâ

FIXME

2.6.4. Postfix¿¡¼­ ÀÎÁõ¼­ »ç¿ëÇϱâ

FIXME

2.6.5. Microsoft Key Manager·Î Ű »ý¼º°ú ¼­¸íÇϱâ

¸¶ÀÌÅ©·Î¼ÒÇÁÆ® Ű ¸Å´ÏÀú(Microsoft Key Manager)¿¡¼­ ۸¦ ¸¸µé±â À§Çؼ­´Â »ç¿ëÇÒ ¼­ºñ½º(¿¹ÄÁµ¥ IMAPÀ̳ª WWW)¸¦ ¼±ÅÃÇØ¾ß ÇÑ´Ù. »õ·Î¿î ۸¦ »ý¼ºÇÏ·Á¸é ¸¶¹ý»ç(Wizard)¸¦ »ç¿ëÇÏ¸é µÈ´Ù. ¾Õ¿¡¼­´Â Common Name(CN)À» »çÀÌÆ® ÁÖ¼Ò¿Í µ¿ÀÏÇÏ°Ô Àû¾úÀ¸³ª, ¿©±â¼­´Â Distinguished NameÀ» ´Ù¸£°Ô Àû¾îµµ µÈ´Ù. ¸¶¹ý»ç´Â C:\NewKeyRq.txt À̶õ ÆÄÀÏ¿¡ ÀÎÁõ ¿ä±¸¼­¸¦ ÀúÀåÇÏ°Ô µÈ´Ù. Ű ¸Å´ÏÀú´Â ±× ۰¡ ¼­¸íµÇÁö ¾Ê¾Ò´Ù°í °æ°íÇÒ °ÍÀÌ´Ù.

/var/ssl µð·ºÅ丮¿¡ ±× ÆÄÀÏÀ» ¹Þ¾Æ¿Í¼­ newreq.pemÀ¸·Î À̸§À» ¹Ù²Ù°í ¼­¸íÇÑ´Ù.

CA.pl -sign
   

´ÙÀ½¿¡ newcert.pemÀ» È®ÀÎÇØº¸¸é ---CERTIFICATE---ºÎºÐ°ú ´Ù¸¥ ÅØ½ºÆ®µéÀÌ ÀÖ´Â °ÍÀ» º¼ ¼ö ÀÖ´Ù. ---CERTIFICATE---ºÎºÐÀ» Á¦¿ÜÇÑ ÅØ½ºÆ®¸¦ Á¦°ÅÇØ¾ß ºñ·Î¼Ò Ű ¸Å´ÏÀú°¡ ÀνÄÇÒ ¼ö ÀÖ°Ô µÈ´Ù. ¾Æ·¡¿Í °°ÀÌ ½±°Ô Á¦°ÅÇÒ ¼ö ÀÖ´Ù.

openssl x509 -in newcert.pem -out newcertx509.pem
   

°£´ÜÇÏ°Ô ÅØ½ºÆ® ¿¡µðÅ͸¦ ÀÌ¿ëÇØ¼­ Áö¿öµµ µÈ´Ù. (ÀÌ ¶§ ---CERTIFICATE---ºÎºÐÀÌ Áö¿öÁöÁö ¾Êµµ·Ï ÁÖÀÇÇÏÀÚ)

ÀÌ·± ÀÛ¾÷À» °ÅÄ¡¸é newcertx509.pem¿¡´Â ---CERTIFICATE---ºÎºÐ¸¸ ³²°Ô µÈ´Ù.

newcertx509.pem ÆÄÀÏÀ» Ű ¸Å´ÏÀú°¡ µ¹¾Æ°¡°í ÀÖ´Â ÄÄÇ»ÅÍ·Î Àü¼ÛÇϰí, ¸¶¿ì½º ¿À¸¥ÂÊ ¹öưÀ» ´©¸£¸é ¼³Ä¡ÇÒ ¼ö ÀÖ´Ù. ´ÙÀ½¿¡ ¾ÏÈ£¹®À» ÀÔ·ÂÇÏ¸é ±× Å°´Â ¿Ïº®ÇÏ°Ô ÀÛµ¿ÇÏ°Ô µÈ´Ù.