ラズパイでLighttpd(HTTPS編)†

オレオレ認証のHTTPSをLighttpdで実行するのも簡単。

↑

SSLの有効化(事前確認)†

SSLの設定は下記の設定を利用する。

$ cat /etc/lighttpd/conf-available/10-ssl.conf
# /usr/share/doc/lighttpd/ssl.txt

server.modules += ( "mod_openssl" )

# ssl.* in global scope gets inherited by
#   $SERVER["socket"] == "..." { ssl.engine = "enable" }
ssl.pemfile = "/etc/lighttpd/server.pem"
ssl.cipher-list = "HIGH"

$SERVER["socket"] == "0.0.0.0:443" {
        ssl.engine  = "enable"
}
include_shell "/usr/share/lighttpd/use-ipv6.pl 443"
↑

CSR†

今回はテスト用途なので中身は空。

$ openssl req -new -newkey rsa:4096 -nodes -keyout domain.local.key -out domain.local.csr
Generating a RSA private key
...................................................................................++++
..............................................................++++
writing new private key to 'domain.local.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:JP
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
↑

CRT†

$ openssl x509 -req -days 365 -in domain.local.csr -signkey domain.local.key -out domain.local.crt
Signature ok
subject=C = JP, ST = Some-State, O = Internet Widgits Pty Ltd
Getting Private key
↑

/etc/lighttpd/server.pem の作成†

ついついやってしまいがちなミス。

$ sudo cat domain.local.key domain.local.crt > /etc/lighttpd/server.pem
-bash: /etc/lighttpd/server.pem: 許可がありません

スーパーユーザー権限でアクセスしたいが、リダイレクト先は元のユーザーのアクセス権に戻ってしまうのが問題なので

$ sudo sh -c "cat domain.local.key domain.local.crt > /etc/lighttpd/server.pem"

または

$ sudo cat domain.local.key domain.local.crt | sudo tee /etc/lighttpd/server.pem > /dev/null

で回避。

↑

SSLの有効化†

SSLを有効にしてHTTPS通信を可能にするためモジュールの追加。

$ sudo lighttpd-enable-mod ssl

再起動して有効化。

$ sudo service lighttpd force-reload


※Raspberry PiはRaspberry Pi財団の登録商標です。

トップ   編集 凍結 差分 履歴 添付 複製 名前変更 リロード   新規 一覧 検索 最終更新   ヘルプ   最終更新のRSS
Last-modified: 2022-11-16 (水) 23:46:23