nexus

color

promise

axios

terminal

Let's Encrypt

sync

rename

keyboard

diff

merge

compare

sniffer

memory

fiddler

scan

cleaner

icon

mstsc

remote

chmod

shutdown

defender

cidr

javascript

datatable

spring

websocket

stomp

boot

ping

image

hotspot

sharpener

mail

linux

sftp

tomcat

service

systemctl

admin

root

firewall

regex

timezone

annotation

time

i18n

weekend

coroutine

static

autowired

procedure

azul

openjdk

maven

versioning

security

onload

test

debug

lucene

docker

backup

json

jackson

lombok

builder

logstash

kafka

redis

<p>출처1 :&nbsp;<a class="tx-link" href="http://sncap.tistory.com/508" target="_blank">http://sncap.tistory.com/508</a></p><p>출처2 :&nbsp;<a class="tx-link" href="https://namjackson.tistory.com/24" target="_blank">https://namjackson.tistory.com/24</a></p><p>출처3&nbsp;:&nbsp;<a class="tx-link" href="https://blog.hangadac.com/2017/07/31/%ED%99%88%EC%84%9C%EB%B2%84-%EA%B5%AC%EC%B6%95%EA%B8%B0-ssl-%EC%9D%B8%EC%A6%9D%EC%84%9C-%EB%A7%8C%EB%93%A4%EA%B8%B0-%EC%97%B0%EC%8A%B5/" target="_blank">https://blog.hangadac.com/2017/07/31/%ED%99%88%EC%84%9C%EB%B2%84-%EA%B5%AC%EC%B6%95%EA%B8%B0-ssl-%EC%9D%B8%EC%A6%9D%EC%84%9C-%EB%A7%8C%EB%93%A4%EA%B8%B0-%EC%97%B0%EC%8A%B5/</a></p><p>출처4&nbsp;:&nbsp;<a class="tx-link" href="https://www.lesstif.com/pages/viewpage.action?pageId=7635159" target="_blank">https://www.lesstif.com/pages/viewpage.action?pageId=7635159</a></p><p>출처5&nbsp;:&nbsp;<a class="tx-link" href="https://www.lesstif.com/pages/viewpage.action?pageId=6979614" target="_blank">https://www.lesstif.com/pages/viewpage.action?pageId=6979614</a></p><p>&nbsp;</p><p>&nbsp;</p><p><a class="file-link" href="/api/file/0JX8TQTD388HK" target="_blank"><span>rootCA인증서만들기.pdf</span></a></p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><div style="background-color:rgb(30, 30, 30);font-family:D2Coding, Consolas, &quot;Courier New&quot;, monospace, Consolas, &quot;Courier New&quot;, monospace;font-size:13px;line-height:18px;white-space:pre;"><div style="color:rgb(212, 212, 212);"><span style="color:#6a9955;"><span>####################################################################################################</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#6a9955;"><span># 사설 ROOT 인증서 만들기</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#6a9955;"><span>####################################################################################################</span></span></div><p><br>&nbsp;</p><div style="color:rgb(212, 212, 212);"><span style="color:#6a9955;"><span># 사설 rootCA.key 생성(pw:123456)</span></span></div><div style="color:rgb(212, 212, 212);">openssl genrsa -aes256 -out rootCA.key 2048</div><p><br><br>&nbsp;</p><div style="color:rgb(212, 212, 212);"><span style="color:#6a9955;"><span># rootCA 인증요청서 CSR 생성하기(conf 파일부터 생성)</span></span></div><div style="color:rgb(212, 212, 212);">cat &lt;&lt;<span style="color:#c586c0;"><span>EOF</span></span><span style="color:#ce9178;"><span> &gt; root-ca-openssl.conf</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>default_bits = 2048</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>default_md = sha1</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>default_keyfile = rootCA.key</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>distinguished_name = req_distinguished_name</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>extensions = v3_ca</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>req_extensions = v3_ca</span></span></div><div style="color:rgb(212, 212, 212);"><br>&nbsp;</div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>[ v3_ca ]</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>basicConstraints = critical, CA:TRUE, pathlen:0</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>subjectKeyIdentifier = hash</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>##authorityKeyIdentifier = keyid:always, issuer:always</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>keyUsage = keyCertSign, cRLSign</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>nsCertType = sslCA, emailCA, objCA</span></span></div><div style="color:rgb(212, 212, 212);"><br>&nbsp;</div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>[req_distinguished_name ]</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>countryName = Country Name (2 letter code)</span></span></div><div><span style="color:#ff0000;"><font>countryName_default = KR</font></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>countryName_min = 2</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>countryName_max = 2</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span># 회사명</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>organizationName = Organization Name (eg, company)</span></span></div><div><span style="color:#ff0000;"><font>organizationName_default = Motolies Inc.</font></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span># 부서명</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>#organizationalUnitName = Organizational Unit Name (eg, section)</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>#organizationalUnitName_default = Condor Project</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span># SSL domain</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>commonName = Common Name (eg, your name or your server's hostname)</span></span></div><div><span style="color:#ff0000;"><font>commonName_default = Motolies's Self Signed CA</font></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>commonName_max = 64</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#c586c0;"><span>EOF</span></span></div><p><br>&nbsp;</p><div style="color:rgb(212, 212, 212);"><span style="color:#6a9955;"><span># CSR 생성(pw:123456)</span></span></div><div style="color:rgb(212, 212, 212);">openssl req -new -key rootCA.key -out rootCA.csr -config root-ca-openssl.conf</div><p><br>&nbsp;</p><div style="color:rgb(212, 212, 212);"><span style="color:#6a9955;"><span># rootCA 인증 받은 인증서 생성(pw:123456)</span></span></div><div style="color:rgb(212, 212, 212);">openssl x509 -req -days 13650 -extensions v3_ca -set_serial 1 -in rootCA.csr -signkey rootCA.key -out rootCA.crt -extfile root-ca-openssl.conf</div><p><br>&nbsp;</p><div style="color:rgb(212, 212, 212);"><span style="color:#6a9955;"><span># rootCA 인증서 내용 확인</span></span></div><div style="color:rgb(212, 212, 212);">openssl x509 -text -in rootCA.crt</div><p><br><br>&nbsp;</p><div style="color:rgb(212, 212, 212);"><span style="color:#6a9955;"><span>####################################################################################################</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#6a9955;"><span># 사설 ROOT 사용한 SSL 인증서 만들기</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#6a9955;"><span>####################################################################################################</span></span></div><p><br>&nbsp;</p><div style="color:rgb(212, 212, 212);"><span style="color:#6a9955;"><span># SSL 용 key 파일 생성</span></span></div><div style="color:rgb(212, 212, 212);">openssl genrsa -out server.key 2048</div><p><br>&nbsp;</p><div style="color:rgb(212, 212, 212);"><span style="color:#6a9955;"><span># SSL 용 CSR 파일 생성(우선 conf 파일 생성)</span></span></div><div style="color:rgb(212, 212, 212);">cat &lt;&lt;<span style="color:#c586c0;"><span>EOF</span></span><span style="color:#ce9178;"><span> &gt; host_openssl.conf</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>[ req ]</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>default_bits &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;= 2048</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>default_md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;= sha1</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>default_keyfile &nbsp; &nbsp; &nbsp; &nbsp; = rootCA.key</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>distinguished_name &nbsp; &nbsp; &nbsp;= req_distinguished_name</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>extensions &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; = v3_user</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>## 인증서 요청시에도 extension 이 들어가면 authorityKeyIdentifier 를 찾지 못해 에러가 나므로 막아둔다.</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>## req_extensions = v3_user</span></span></div><p><br>&nbsp;</p><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>[ v3_user ]</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span># Extensions to add to a certificate request</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>basicConstraints = CA:FALSE</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>authorityKeyIdentifier = keyid,issuer</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>subjectKeyIdentifier = hash</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>keyUsage = nonRepudiation, digitalSignature, keyEncipherment</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>## SSL 용 확장키 필드</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>extendedKeyUsage = serverAuth,clientAuth</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>subjectAltName &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;= @alt_names</span></span></div><p><br>&nbsp;</p><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>[ alt_names ]</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>## Subject AltName의 DNSName field에 SSL Host 의 도메인 이름을 적어준다.</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>## 멀티 도메인일 경우 *.lesstif.com 처럼 쓸 수 있다.</span></span></div><div><span style="color:#ff0000;"><font>IP.1 &nbsp; &nbsp;= 10.0.0.1</font></span></div><div><span style="color:#ff0000;"><font>DNS.1 &nbsp; = www.motolies.tistory.com</font></span></div><div><span style="color:#ff0000;"><font>DNS.2 &nbsp; = motolies.tistory.com</font></span></div><div><span style="color:#ff0000;"><font>DNS.3 &nbsp; = *.motolies.tistory.com</font></span></div><p><br>&nbsp;</p><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>[req_distinguished_name ]</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>countryName &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; = Country Name (2 letter code)</span></span></div><div><span style="color:#ff0000;"><font>countryName_default &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; = KR</font></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>countryName_min &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; = 2</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>countryName_max &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; = 2</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span># 회사명 입력</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>organizationName &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;= Organization Name (eg, company)</span></span></div><div><span style="color:#ff0000;"><font>organizationName_default &nbsp; &nbsp; &nbsp;= Motolies Inc.</font></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span># 부서 입력</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>organizationalUnitName &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;= Organizational Unit Name (eg, section)</span></span></div><div><span style="color:#ff0000;"><font>organizationalUnitName_default &nbsp;= Motolies SSL Project</font></span></div><p><br>&nbsp;</p><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span># SSL 서비스할 domain 명 입력</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>commonName &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;= {Server IP OR Domain}</span></span></div><div><span style="color:#ff0000;"><font>commonName_default &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; = 10.0.0.1</font></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>commonName_max &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;= 64</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#c586c0;"><span>EOF</span></span></div><p><br>&nbsp;</p><div style="color:rgb(212, 212, 212);"><span style="color:#6a9955;"><span># CSR 생성</span></span></div><div style="color:rgb(212, 212, 212);">openssl req -new &nbsp;-key server.key -out server.csr -config host_openssl.conf</div><p><br>&nbsp;</p><div style="color:rgb(212, 212, 212);"><span style="color:#6a9955;"><span>#rootCA의 인증을 받아 인증서 생성(pw:rootCA의 pw 입력)</span></span></div><div style="color:rgb(212, 212, 212);">openssl x509 -req -days 13650 -extensions v3_user -in server.csr -CA rootCA.crt -CAcreateserial -CAkey rootCA.key -out server.crt -sha256 -extfile host_openssl.conf</div><p><br>&nbsp;</p><div style="color:rgb(212, 212, 212);"><span style="color:#6a9955;"><span># SSL 인증서 내용 확인</span></span></div><div style="color:rgb(212, 212, 212);">openssl x509 -text -in server.crt</div><p><br>&nbsp;</p><div style="color:rgb(212, 212, 212);"><span style="color:#6a9955;"><span>#crt 파일을 pkcs12 파일로(새로운 pw설정:1234)</span></span></div><div style="color:rgb(212, 212, 212);">openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -name tomcat</div><p><br>&nbsp;</p><div style="color:rgb(212, 212, 212);"><span style="color:#6a9955;"><span>#crt 파일을 pfx 파일로(새로운 pw설정:1234)</span></span></div><div style="color:rgb(212, 212, 212);">openssl pkcs12 -export -in server.crt -inkey server.key -out server.pfx</div></div><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><h3>스프링 부트에서는 다음과 같이 설정할 수 있다.</h3><p>ROOT CA 인증서는 신뢰할 수 있는 인증서로 등록해야 한다.</p><pre style="background-color:#2b2b2b;color:#a9b7c6;font-family:'D2Coding',monospace;font-size:10.5pt;"><span style="color:#cc7832;"><span>server</span></span>:<br>  <span style="color:#cc7832;"><span>port</span></span>: ${<span style="color:#cc7832;"><span>PORT</span></span>:8080}<br>  <span style="color:#cc7832;"><span>ssl</span></span>:<br>    <span style="color:#cc7832;"><span>enabled</span></span>: <span style="color:#cc7832;"><span>true</span></span><br><span style="color:#cc7832;"><span>    key-store</span></span>: classpath:keystore/server.pfx<br>    <span style="color:#cc7832;"><span>key-store-type</span></span>: <span style="color:#6a8759;"><span>"PKCS12"</span></span><br><span style="color:#6a8759;"><span>    </span></span><span style="color:#cc7832;"><span>key-store-password</span></span>: <span style="color:#6a8759;"><span>"1234"</span></span></pre><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p>

rootCA 인증서 만들기