/
OpenSSL & https

OpenSSL & https

SSL 생성

RootCA 생성

개인 key 생성

[root@node1 ~]# mkdir -p /tmp/ssl [root@node1 ~]# cd /tmp/ssl [root@node1 ssl]# openssl genrsa -aes256 -out lavence-ca.key 2048 Enter PEM pass phrase: # 회사 기본 비밀번호를 사용 [root@node1 ssl]# chmod 600 -R lavence-ca.key [root@node1 ssl]# ls -ld lavence-ca.key -rw-------. 1 root root 1886 Apr 14 10:35 lavence-ca.key # 600으로 권한 맞춰주기. 기본값으로 600이기는 하나 가끔 아닌 경우도 있다고 함

conf 생성

[root@node1 ssl]# cat lavence-ca.conf [ req ] default_bits = 2048 default_md = sha256 # sha1로 하면 에러발생 default_keyfile = lavence-ca.key distinguished_name = req_distinguished_name extensions = v3_ca req_extensions = v3_ca [ v3_ca ] basicConstraints = critical, CA:TRUE, pathlen:0 subjectKeyIdentifier = hash ##authorityKeyIdentifier = keyid:always, issuer:always keyUsage = keyCertSign, cRLSign nsCertType = sslCA, emailCA, objCA [req_distinguished_name ] countryName = Country Name (2 letter code) countryName_default = KR countryName_min = 2 countryName_max = 2 # 회사명 입력 organizationName = Dmove CO. organizationName_default = Dmove CO. # 부서 입력 #organizationalUnitName = Organizational Unit Name (eg, section) #organizationalUnitName_default = Condor Project # SSL 서비스할 domain 명 입력 commonName = lavence commonName_default = www.lavence-test.com commonName_max = 64

csr 생성 및 확인

[root@node1 ssl]# openssl req -new -key lavence-ca.key \ -out lavence-ca.csr -config lavence-ca.conf You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [KR]:KR Dmove CO. [Dmove CO.]:Dmove CO. lavence [www.lavence-test.com]:lavence [root@node1 ssl]# ls lavence-ca.conf lavence-ca.csr lavence-ca.key [root@node1 ssl]# openssl req -text -in lavence-ca.csr Certificate Request: Data: Version: 1 (0x0) Subject: C=KR, O=Dmove CO., CN=lavence Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) ...

self signed(공개키용) 인증서 생성

[root@node1 ssl]# openssl x509 -req -days 365 -extensions v3_ca \ -set_serial 1 -in lavence-ca.csr -signkey lavence-ca.key \ -out lavence-ca.crt -extfile lavence-ca.conf Enter pass phrase for lavence-ca.key: Certificate request self-signature ok subject=C=KR, O=Dmove CO., CN=lavence

SSL 인증서 발급

SSL 인증에 쓸 개인 key 발급

[root@node1 ssl]# openssl genrsa -aes256 -out lavence-test.com.key 2048 Enter PEM pass phrase: Verifying - Enter PEM pass phrase: # 회사 기본 비밀번호 사용

conf 파일 생성

[root@node1 ssl]# cat lavence-test.openssl.conf [ req ] default_bits = 2048 default_md = sha256 default_keyfile = lavence-ca.key distinguished_name = req_distinguished_name extensions = v3_user #req_extensions = v3_user [ v3_user ] basicConstraints = CA:FALSE authorityKeyIdentifier = keyid,issuer subjectKeyIdentifier = hash keyUsage = nonRepudiation, digitalSignature, keyEncipherment ## SSL 용 확장키 필드 extendedKeyUsage = serverAuth,clientAuth subjectAltName = @alt_names [ alt_names] DNS.1 = www.lavence-test.com DNS.2 = lavence-test.com [req_distinguished_name ] countryName = Country Name (2 letter code) countryName_default = KR countryName_min = 2 countryName_max = 2 # 회사명 입력 organizationName = Dmove CO. organizationName_default = Dmove CO. # 부서 입력 #organizationalUnitName = Organizational Unit Name (eg, section) #organizationalUnitName_default = Condor Project # SSL 서비스할 domain 명 입력 commonName = lavence commonName_default = lavence-test.com commonName_max = 64

csr 생성 및 확인

[root@node1 ssl]# openssl req -new -key lavence-test.com.key -out lavence-test.com.csr \ -config lavence-test.openssl.conf You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [KR]: Dmove CO. [Dmove CO.]: lavence [lavence-test.com]: [root@node1 ssl]# openssl req -text -in lavence-test.com.csr Certificate Request: Data: Version: 1 (0x0) Subject: C=KR, O=Dmove CO., CN=lavence-test.com Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit)

self signed(공개키용) 인증서 생성

[root@node1 ssl]# openssl x509 -req -days 365 -extensions v3_user -in lavence-test.com.csr \ -CA lavence-ca.crt -CAcreateserial -CAkey lavence-ca.key -out lavence-test.com.crt \ -extfile lavence-test.openssl.conf Certificate request self-signature ok subject=C=KR, O=Dmove CO., CN=lavence-test.com Enter pass phrase for lavence-ca.key:

 

Httpd

ssl 모듈 설치

[root@node1 ssl]# dnf install -y mod_ssl # /etc/httpd/conf.d에 ssl.conf 생기는데 따로 빼기. # 재시작 할 때, ssl 설정값 때문에 서비스가 올라오지 않는 경우가 있음 [root@node1 ssl]# mv /etc/httpd/conf.d/ssl.conf /etc/httpd/conf.d/ssl.conf.bak

Bundle로 묶기

https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslcertificatefile

SSLCertificateChainFile는 권장되지 않는다고 나와있으며 bundle로 인증서를 묶어서 쓸 것을 권장

# 순서 반드시 지킬 것. 도메인 인증서 rootca 인증서 순으로 할 것. # 첫번째 인증서를 통해서 TLS 핸드셰이크 함. # 순서 안 지킬 시, httpd 구동 때 키값이 맞지 않아 서비스가 작동하지 않음 [root@node1 ssl]# cat lavence-test.com.crt lavence-ca.crt > lavence-bundle.crt # 인증서를 기본 경로에 복사 # key [root@node1 ssl]# cp lavence-test.key /etc/pki/tls/private/ # cert [root@node1 ssl]# cp lavence-bundle.crt /etc/pki/tls/certs/

conf 설정

[root@node1 ssl]# cat /etc/httpd/conf.d/lavence-test.com.ssl.conf <VirtualHost *:443> ServerName lavence-test.com SSLEngine on SSLCertificateFile /etc/pki/tls/certs/lavence-bundle.crt SSLCertificateKeyFile /etc/pki/tls/private/lavence-test.com.key ProxyPreserveHost On RequestHeader set X-Forwarded-Proto "https" ############################################## # Jira Balancer 설정 ############################################## <Proxy "balancer://jira_cluster"> BalancerMember "http://10.220.0.60:8080/jira" route=node1 BalancerMember "http://10.220.0.61:8080/jira" route=node2 ProxySet lbmethod=byrequests stickysession=JSESSIONID|jsessionid </Proxy> ProxyPass "/jira" "balancer://jira_cluster" ProxyPassReverse "/jira" "balancer://jira_cluster" <Location "/jira"> Require all granted </Location> ############################################## # Confluence Balancer 설정 ############################################## <Proxy "balancer://confluence_cluster"> BalancerMember "http://10.220.0.60:8090/confluence" route=node1 BalancerMember "http://10.220.0.61:8090/confluence" route=node2 ProxySet lbmethod=byrequests stickysession=JSESSIONID|jsessionid </Proxy> ProxyPass "/confluence" "balancer://confluence_cluster" ProxyPassReverse "/confluence" "balancer://confluence_cluster" <Location "/confluence"> Require all granted </Location> ############################################## # Crowd Balancer 설정 ############################################## <Proxy "balancer://crowd_cluster"> BalancerMember "http://10.220.0.60:8095/crowd" route=node1 BalancerMember "http://10.220.0.61:8095/crowd" route=node2 ProxySet lbmethod=byrequests stickysession=JSESSIONID|jsessionid </Proxy> ProxyPass "/crowd" "balancer://crowd_cluster" ProxyPassReverse "/crowd" "balancer://crowd_cluster" <Location "/crowd"> Require all granted </Location> ErrorLog logs/lavence_ssl_error.log CustomLog logs/lavence_ssl_access.log combined </VirtualHost>

서비스 리로드

[root@node1 ssl]# systemctl reload httpd

개념 굳히기

RootCA와 SSL 서버인증서의 개념과 차이

[ RootCA ] └── lavence-ca.key ← 루트 CA의 개인 키 ❗ 절대 외부 노출 금지 └── lavence-ca.crt ← 루트 CA의 인증서 (self-signed) ⬇️ 이걸로 서명해서... [ SSL 서버 인증서 ] └── lavence-test.com.key ← 서버 도메인의 개인 키 └── lavence-test.com.csr ← 도메인 인증요청서 (이건 임시 생성물) └── lavence-test.com.crt ← 루트 CA가 서명한 서버 인증서

 

트러블슈팅

간혹…이 아니라 여러 번이라 필수적으로 설정해야 할 듯 합니다.

proxy 구성 완료 후 올바르게 로그인 했는데 로그인 후 화면이 넘어가지 않는 경우

# home directory에서 conf의 server.xml에서 Engine 부분에 jvmRoute로 클러스터링에서 구성한 노드명 적어주기 # confluence vi /opt/confluence/conf/server.xml <Engine name="Standalone" defaultHost="localhost" jvmRoute="node1"> # jira vi /opt/jira/conf/server.xml <Engine name="Catalina" defaultHost="localhost" jvmRoute="node1">
Looking for labels? They can now be found in the details panel on the floating action bar.

Related content