nginx 사설 ssl 적용

https://goldsony.tistory.com/223

SSL 사설 인증서 생성하기(feat, openssl)

/etc/nginx/ssl

# CA 관련 생성
sudo openssl genrsa -out rootCA.key 2048
sudo openssl req -new -key rootCA.key -out rootCA.csr
sudo openssl x509 -req -in rootCA.csr -signkey rootCA.key -out rootCA.crt

# 서버 관련 생성
sudo openssl genrsa -out server.key 2048
sudo openssl req -new -key server.key -out server.csr
sudo openssl x509 -in server.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -out server.crt

/etc/nginx/sites-available/default

server {
        listen 80 default_server;
        listen [::]:80 default_server;

        # SSL configuration
        #
        listen 443 ssl default_server;
        listen [::]:443 ssl default_server;
        
        root /var/www/html;

        # Add index.php to the list if you are using PHP
        index index.html index.htm index.nginx-debian.html;

        server_name {도메인};

        ssl_certificate "/etc/nginx/ssl/server.crt";
        ssl_certificate_key "/etc/nginx/ssl/server.key";

결과적으로 취소선은 지워지지 않음

추가적인 작업이 더 필요함

https://www.lesstif.com/system-admin/openssl-root-ca-ssl-6979614.html

OpenSSL 로 ROOT CA 생성 및 SSL 인증서 발급

# CA 관련 생성
sudo openssl genrsa -aes256 -out rootCA.key 2048
# config를 추가해 줘야 정상적으로 작동함
sudo openssl req -new -key rootCA.key -out rootCA.csr -config rootCA.conf
sudo openssl x509 -req -days 365 extentions ve_ca -set_serail 1 -in rootCA.csr -signkey rootCA.key -out rootCA.crt -extfile rootCA.conf
# 인증서 정보 확인
sudo openssl x509 -text -in rootCA.crt

# 서버 관련 생성
sudo openssl genrsa -aes256 -out server.key 2048
# 비밀번호 제거
sudo cp server.key server.key.enc
sudo openssl rsa -in server.key.enc -out server.key
# config를 추가해 줘야 정상적으로 작동함
sudo openssl req -new -key server.key -out server.csr -config server.config
sudo openssl x509 -req -days 365 -extensions v3_user -in server.csr -CA rootCA.crt -CAkey rootCA.key -out server.crt -extfile server.conf

rootCA.conf

[ req ]
default_bits            = 2048
default_md              = sha1
default_keyfile         = rootCA.key
distinguished_name      = req_distinguished_name
extensions             = v3_ca
req_extensions = v3_ca
 
[ v3_ca ]
basicConstraints       = critical, CA:TRUE, pathlen:0
subjectKeyIdentifier   = hash
##authorityKeyIdentifier = keyid:always, issuer:always
keyUsage               = keyCertSign, cRLSign
nsCertType             = sslCA, emailCA, objCA
[req_distinguished_name ]
countryName                     = Country Name (2 letter code)
countryName_default             = KR
countryName_min                 = 2
countryName_max                 = 2

# 회사명 입력
organizationName              = Organization Name (eg, company)
organizationName_default      = {입력}
 
# 부서 입력
#organizationalUnitName          = Organizational Unit Name (eg, section)
#organizationalUnitName_default  = Condor Project
 
# SSL 서비스할 domain 명 입력
commonName                      = Common Name (eg, your name or your server's hostname)
commonName_default             = {입력}
commonName_max                  = 64

server.conf

[ req ]
default_bits            = 2048
default_md              = sha1
default_keyfile         = rootCA.key
distinguished_name      = req_distinguished_name
extensions             = v3_user
## 인증서 요청시에도 extension 이 들어가면 authorityKeyIdentifier 를 찾지 못해 에러가 나므로 막아둔다.
## req_extensions = v3_user

[ v3_user ]
# Extensions to add to a certificate request
basicConstraints = CA:FALSE
authorityKeyIdentifier = keyid,issuer
subjectKeyIdentifier = hash
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
## SSL 용 확장키 필드
extendedKeyUsage = serverAuth,clientAuth
subjectAltName          = @alt_names
[ alt_names]
## Subject AltName의 DNSName field에 SSL Host 의 도메인 이름을 적어준다.
## 멀티 도메인일 경우 *.lesstif.com 처럼 쓸 수 있다.
DNS.1   = {입력} # 예: www.test.com
DNS.2   = {입력} # 예: test.com
DNS.3   = {입력] # 예: *.test.com

[req_distinguished_name ]
countryName                     = Country Name (2 letter code)
countryName_default             = KR
countryName_min                 = 2
countryName_max                 = 2

# 회사명 입력
organizationName              = Organization Name (eg, company)
organizationName_default      = {입력} # CA와 맞춰야 함
 
# 부서 입력
organizationalUnitName          = Organizational Unit Name (eg, section)
organizationalUnitName_default  = {입력} # CAd와 맞춰야 함
 
# SSL 서비스할 domain 명 입력
commonName                      = Common Name (eg, your name or your server's hostname)
commonName_default             = lesstif.com
commonName_max                  = 64