パスフレーズあり
$ /usr/bin/openssl genrsa -des3 1024 > ./ssl_server.key
パスフレーズなし
$ /usr/bin/openssl genrsa 1024 > ./ssl_server.key
$ /usr/bin/openssl req -new -key ./ssl_server.key -x509 -days 3650 -out ./ssl_server.crt
※ 有効期間は長めにね！
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:
State or Province Name (full name) [Berkshire]:
Locality Name (eg, city) [Newbury]:
Organization Name (eg, company) [My Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:my.domain.name
Email Address []:
Apacheの設定ファイル例
NameVirtualHost *:443
Listen 443
AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl .crl
SSLPassPhraseDialog builtin
SSLSessionCache "shmcb:/usr/local/apache2/logs/ssl_scache(512000)"
SSLSessionCacheTimeout 300
SSLMutex "file:/usr/local/apache2/logs/ssl_mutex"
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
SSLCertificateFile "/usr/local/apache2/conf/extra/httpd-vhosts/ssl_server.crt"
SSLCertificateKeyFile "/usr/local/apache2/conf/extra/httpd-vhosts/ssl_server.key"
<VirtualHost *:443>
ServerName my.domain.name:443
SSLEngine on
<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
BrowserMatch ".*MSIE.*" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
CustomLog "|/usr/local/apache2/bin/rotatelogs /home/httpd/vhost/my.domain.name/log/ssl_request_log.%Y%m%d 86400" "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
