SSL証明書の設置(Apache+mod_ssl)

[root@test]# cd /etc/pki/tls/certs/←ディレクトリ移動
[root@test certs]# wget https://www.startssl.com/certs/ca.pem←StartSSLのルート証明書をダウンロード
[root@test certs]# wget https://www.startssl.com/certs/sub.class1.server.ca.pem←StartSSLの中間証明書をダウンロード
[root@test certs]# vi startssl.crt←公開鍵を作成
保存した公開鍵内容を貼り付けて保存
[root@test certs]# chmod 400 ca.pem←ルート証明書のパーミッション変更
[root@test certs]# chmod 400 sub.class1.server.ca.pem←中間証明書のパーミッション変更
[root@test certs]# chmod 400 startssl.crt←公開鍵のパーミッション変更
[root@test certs]# cd /etc/pki/tls/private/←ディレクトリ移動
[root@test private]# vi startssl.key←秘密鍵を作成
保存した秘密鍵内容を貼り付けて保存
[root@test private]# chmod 400 startssl.key←秘密鍵のパーミッション変更
[root@test private]# openssl rsa -in startssl.key -out startssl.key←秘密鍵からパスワードを外す
Enter pass phrase for startssl.key:　←　秘密鍵作成時に入力したパスワード応答
writing RSA key

[root@test]# vi /etc/httpd/conf.d/ssl.conf←SSL設定ファイル編集
#   Server Certificate:
# Point SSLCertificateFile at a PEM encoded certificate.  If
# the certificate is encrypted, then you will be prompted for a
# pass phrase.  Note that a kill -HUP will prompt again.  A new
# certificate can be generated using the genkey(1) command.
SSLCertificateFile /etc/pki/tls/certs/startssl.crt←　公開鍵指定

#   Server Private Key:
#   If the key is not combined with the certificate, use this
#   directive to point at the key file.  Keep in mind that if
#   you've both a RSA and a DSA private key you can configure
#   both in parallel (to also allow the use of DSA ciphers, etc.)
SSLCertificateKeyFile /etc/pki/tls/certs/startssl.key←　秘密鍵指定

#   Server Certificate Chain:
#   Point SSLCertificateChainFile at a file containing the
#   concatenation of PEM encoded CA certificates which form the
#   certificate chain for the server certificate. Alternatively
#   the referenced file can be the same as SSLCertificateFile
#   when the CA certificates are directly appended to the server
#   certificate for convinience.
SSLCertificateChainFile /etc/pki/tls/certs/sub.class1.server.ca.pem←　中間証明書指定

#   Certificate Authority (CA):
#   Set the CA certificate verification path where to find CA
#   certificates for client authentication or alternatively one
#   huge file containing all of them (file must be PEM encoded)
SSLCACertificateFile /etc/pki/tls/certs/ca.pem←　ルート証明書指定

#   SSL Protocol support:
# List the enable protocol levels with which clients will be able to
# connect.  Disable SSLv2 access by default:
SSLProtocol all -SSLv2 -SSLv3-SSLv3を追加してPOODLE対応

#SSLCipherSuite DEFAULT:!EXP:!SSLv2:!DES:!IDEA:!SEED:+3DES←コメントアウト
SSLCipherSuite AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:!RC4:HIGH:!EXP:!IDEA:!SEED:!EDH:!ULL:!eNULL←BEAST攻撃対応
SSLHonorCipherOrder on←BEAST攻撃対応
Header always set Strict-Transport-Security "max-age=315360000; includeSubDomains"←BEAST攻撃対応
[root@test]# service httpd restart←Apache再起動