<p>출처1 :&nbsp;<a class="tx-link" href="http://sncap.tistory.com/508" target="_blank">http://sncap.tistory.com/508</a></p><p>출처2 :&nbsp;<a class="tx-link" href="https://namjackson.tistory.com/24" target="_blank">https://namjackson.tistory.com/24</a></p><p>출처3&nbsp;:&nbsp;<a class="tx-link" href="https://blog.hangadac.com/2017/07/31/%ED%99%88%EC%84%9C%EB%B2%84-%EA%B5%AC%EC%B6%95%EA%B8%B0-ssl-%EC%9D%B8%EC%A6%9D%EC%84%9C-%EB%A7%8C%EB%93%A4%EA%B8%B0-%EC%97%B0%EC%8A%B5/" target="_blank">https://blog.hangadac.com/2017/07/31/%ED%99%88%EC%84%9C%EB%B2%84-%EA%B5%AC%EC%B6%95%EA%B8%B0-ssl-%EC%9D%B8%EC%A6%9D%EC%84%9C-%EB%A7%8C%EB%93%A4%EA%B8%B0-%EC%97%B0%EC%8A%B5/</a></p><p>출처4&nbsp;:&nbsp;<a class="tx-link" href="https://www.lesstif.com/pages/viewpage.action?pageId=7635159" target="_blank">https://www.lesstif.com/pages/viewpage.action?pageId=7635159</a></p><p>출처5&nbsp;:&nbsp;<a class="tx-link" href="https://www.lesstif.com/pages/viewpage.action?pageId=6979614" target="_blank">https://www.lesstif.com/pages/viewpage.action?pageId=6979614</a></p><p>&nbsp;</p><p>&nbsp;</p><p><a class="file-link" href="/api/file/0JX8TQTD388HK" target="_blank"><span>rootCA인증서만들기.pdf</span></a></p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><div style="background-color:rgb(30, 30, 30);font-family:D2Coding, Consolas, &quot;Courier New&quot;, monospace, Consolas, &quot;Courier New&quot;, monospace;font-size:13px;line-height:18px;white-space:pre;"><div style="color:rgb(212, 212, 212);"><span style="color:#6a9955;"><span>####################################################################################################</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#6a9955;"><span># 사설 ROOT 인증서 만들기</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#6a9955;"><span>####################################################################################################</span></span></div><p><br>&nbsp;</p><div style="color:rgb(212, 212, 212);"><span style="color:#6a9955;"><span># 사설 rootCA.key 생성(pw:123456)</span></span></div><div style="color:rgb(212, 212, 212);">openssl genrsa -aes256 -out rootCA.key 2048</div><p><br><br>&nbsp;</p><div style="color:rgb(212, 212, 212);"><span style="color:#6a9955;"><span># rootCA 인증요청서 CSR 생성하기(conf 파일부터 생성)</span></span></div><div style="color:rgb(212, 212, 212);">cat &lt;&lt;<span style="color:#c586c0;"><span>EOF</span></span><span style="color:#ce9178;"><span> &gt; root-ca-openssl.conf</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>default_bits = 2048</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>default_md = sha1</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>default_keyfile = rootCA.key</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>distinguished_name = req_distinguished_name</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>extensions = v3_ca</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>req_extensions = v3_ca</span></span></div><div style="color:rgb(212, 212, 212);"><br>&nbsp;</div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>[ v3_ca ]</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>basicConstraints = critical, CA:TRUE, pathlen:0</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>subjectKeyIdentifier = hash</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>##authorityKeyIdentifier = keyid:always, issuer:always</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>keyUsage = keyCertSign, cRLSign</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>nsCertType = sslCA, emailCA, objCA</span></span></div><div style="color:rgb(212, 212, 212);"><br>&nbsp;</div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>[req_distinguished_name ]</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>countryName = Country Name (2 letter code)</span></span></div><div><span style="color:#ff0000;"><font>countryName_default = KR</font></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>countryName_min = 2</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>countryName_max = 2</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span># 회사명</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>organizationName = Organization Name (eg, company)</span></span></div><div><span style="color:#ff0000;"><font>organizationName_default = Motolies Inc.</font></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span># 부서명</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>#organizationalUnitName = Organizational Unit Name (eg, section)</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>#organizationalUnitName_default = Condor Project</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span># SSL domain</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>commonName = Common Name (eg, your name or your server's hostname)</span></span></div><div><span style="color:#ff0000;"><font>commonName_default = Motolies's Self Signed CA</font></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>commonName_max = 64</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#c586c0;"><span>EOF</span></span></div><p><br>&nbsp;</p><div style="color:rgb(212, 212, 212);"><span style="color:#6a9955;"><span># CSR 생성(pw:123456)</span></span></div><div style="color:rgb(212, 212, 212);">openssl req -new -key rootCA.key -out rootCA.csr -config root-ca-openssl.conf</div><p><br>&nbsp;</p><div style="color:rgb(212, 212, 212);"><span style="color:#6a9955;"><span># rootCA 인증 받은 인증서 생성(pw:123456)</span></span></div><div style="color:rgb(212, 212, 212);">openssl x509 -req -days 13650 -extensions v3_ca -set_serial 1 -in rootCA.csr -signkey rootCA.key -out rootCA.crt -extfile root-ca-openssl.conf</div><p><br>&nbsp;</p><div style="color:rgb(212, 212, 212);"><span style="color:#6a9955;"><span># rootCA 인증서 내용 확인</span></span></div><div style="color:rgb(212, 212, 212);">openssl x509 -text -in rootCA.crt</div><p><br><br>&nbsp;</p><div style="color:rgb(212, 212, 212);"><span style="color:#6a9955;"><span>####################################################################################################</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#6a9955;"><span># 사설 ROOT 사용한 SSL 인증서 만들기</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#6a9955;"><span>####################################################################################################</span></span></div><p><br>&nbsp;</p><div style="color:rgb(212, 212, 212);"><span style="color:#6a9955;"><span># SSL 용 key 파일 생성</span></span></div><div style="color:rgb(212, 212, 212);">openssl genrsa -out server.key 2048</div><p><br>&nbsp;</p><div style="color:rgb(212, 212, 212);"><span style="color:#6a9955;"><span># SSL 용 CSR 파일 생성(우선 conf 파일 생성)</span></span></div><div style="color:rgb(212, 212, 212);">cat &lt;&lt;<span style="color:#c586c0;"><span>EOF</span></span><span style="color:#ce9178;"><span> &gt; host_openssl.conf</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>[ req ]</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>default_bits &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;= 2048</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>default_md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;= sha1</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>default_keyfile &nbsp; &nbsp; &nbsp; &nbsp; = rootCA.key</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>distinguished_name &nbsp; &nbsp; &nbsp;= req_distinguished_name</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>extensions &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; = v3_user</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>## 인증서 요청시에도 extension 이 들어가면 authorityKeyIdentifier 를 찾지 못해 에러가 나므로 막아둔다.</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>## req_extensions = v3_user</span></span></div><p><br>&nbsp;</p><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>[ v3_user ]</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span># Extensions to add to a certificate request</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>basicConstraints = CA:FALSE</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>authorityKeyIdentifier = keyid,issuer</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>subjectKeyIdentifier = hash</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>keyUsage = nonRepudiation, digitalSignature, keyEncipherment</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>## SSL 용 확장키 필드</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>extendedKeyUsage = serverAuth,clientAuth</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>subjectAltName &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;= @alt_names</span></span></div><p><br>&nbsp;</p><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>[ alt_names ]</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>## Subject AltName의 DNSName field에 SSL Host 의 도메인 이름을 적어준다.</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>## 멀티 도메인일 경우 *.lesstif.com 처럼 쓸 수 있다.</span></span></div><div><span style="color:#ff0000;"><font>IP.1 &nbsp; &nbsp;= 10.0.0.1</font></span></div><div><span style="color:#ff0000;"><font>DNS.1 &nbsp; = www.motolies.tistory.com</font></span></div><div><span style="color:#ff0000;"><font>DNS.2 &nbsp; = motolies.tistory.com</font></span></div><div><span style="color:#ff0000;"><font>DNS.3 &nbsp; = *.motolies.tistory.com</font></span></div><p><br>&nbsp;</p><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>[req_distinguished_name ]</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>countryName &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; = Country Name (2 letter code)</span></span></div><div><span style="color:#ff0000;"><font>countryName_default &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; = KR</font></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>countryName_min &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; = 2</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>countryName_max &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; = 2</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span># 회사명 입력</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>organizationName &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;= Organization Name (eg, company)</span></span></div><div><span style="color:#ff0000;"><font>organizationName_default &nbsp; &nbsp; &nbsp;= Motolies Inc.</font></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span># 부서 입력</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>organizationalUnitName &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;= Organizational Unit Name (eg, section)</span></span></div><div><span style="color:#ff0000;"><font>organizationalUnitName_default &nbsp;= Motolies SSL Project</font></span></div><p><br>&nbsp;</p><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span># SSL 서비스할 domain 명 입력</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>commonName &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;= {Server IP OR Domain}</span></span></div><div><span style="color:#ff0000;"><font>commonName_default &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; = 10.0.0.1</font></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#ce9178;"><span>commonName_max &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;= 64</span></span></div><div style="color:rgb(212, 212, 212);"><span style="color:#c586c0;"><span>EOF</span></span></div><p><br>&nbsp;</p><div style="color:rgb(212, 212, 212);"><span style="color:#6a9955;"><span># CSR 생성</span></span></div><div style="color:rgb(212, 212, 212);">openssl req -new &nbsp;-key server.key -out server.csr -config host_openssl.conf</div><p><br>&nbsp;</p><div style="color:rgb(212, 212, 212);"><span style="color:#6a9955;"><span>#rootCA의 인증을 받아 인증서 생성(pw:rootCA의 pw 입력)</span></span></div><div style="color:rgb(212, 212, 212);">openssl x509 -req -days 13650 -extensions v3_user -in server.csr -CA rootCA.crt -CAcreateserial -CAkey rootCA.key -out server.crt -sha256 -extfile host_openssl.conf</div><p><br>&nbsp;</p><div style="color:rgb(212, 212, 212);"><span style="color:#6a9955;"><span># SSL 인증서 내용 확인</span></span></div><div style="color:rgb(212, 212, 212);">openssl x509 -text -in server.crt</div><p><br>&nbsp;</p><div style="color:rgb(212, 212, 212);"><span style="color:#6a9955;"><span>#crt 파일을 pkcs12 파일로(새로운 pw설정:1234)</span></span></div><div style="color:rgb(212, 212, 212);">openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -name tomcat</div><p><br>&nbsp;</p><div style="color:rgb(212, 212, 212);"><span style="color:#6a9955;"><span>#crt 파일을 pfx 파일로(새로운 pw설정:1234)</span></span></div><div style="color:rgb(212, 212, 212);">openssl pkcs12 -export -in server.crt -inkey server.key -out server.pfx</div></div><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><h3>스프링 부트에서는 다음과 같이 설정할 수 있다.</h3><p>ROOT CA 인증서는 신뢰할 수 있는 인증서로 등록해야 한다.</p><pre style="background-color:#2b2b2b;color:#a9b7c6;font-family:'D2Coding',monospace;font-size:10.5pt;"><span style="color:#cc7832;"><span>server</span></span>:<br>  <span style="color:#cc7832;"><span>port</span></span>: ${<span style="color:#cc7832;"><span>PORT</span></span>:8080}<br>  <span style="color:#cc7832;"><span>ssl</span></span>:<br>    <span style="color:#cc7832;"><span>enabled</span></span>: <span style="color:#cc7832;"><span>true</span></span><br><span style="color:#cc7832;"><span>    key-store</span></span>: classpath:keystore/server.pfx<br>    <span style="color:#cc7832;"><span>key-store-type</span></span>: <span style="color:#6a8759;"><span>"PKCS12"</span></span><br><span style="color:#6a8759;"><span>    </span></span><span style="color:#cc7832;"><span>key-store-password</span></span>: <span style="color:#6a8759;"><span>"1234"</span></span></pre><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p>

rootCA 인증서 만들기