オレオレ認証のHTTPSをLighttpdで実行するのも簡単。
SSLの設定は下記の設定を利用する。
$ cat /etc/lighttpd/conf-available/10-ssl.conf # /usr/share/doc/lighttpd/ssl.txt server.modules += ( "mod_openssl" ) # ssl.* in global scope gets inherited by # $SERVER["socket"] == "..." { ssl.engine = "enable" } ssl.pemfile = "/etc/lighttpd/server.pem" ssl.cipher-list = "HIGH" $SERVER["socket"] == "0.0.0.0:443" { ssl.engine = "enable" } include_shell "/usr/share/lighttpd/use-ipv6.pl 443"
今回はテスト用途なので中身は空。
$ openssl req -new -newkey rsa:4096 -nodes -keyout domain.local.key -out domain.local.csr Generating a RSA private key ...................................................................................++++ ..............................................................++++ writing new private key to 'domain.local.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:JP State or Province Name (full name) [Some-State]: Locality Name (eg, city) []: Organization Name (eg, company) [Internet Widgits Pty Ltd]: Organizational Unit Name (eg, section) []: Common Name (e.g. server FQDN or YOUR name) []: Email Address []: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []:
$ openssl x509 -req -days 365 -in domain.local.csr -signkey domain.local.key -out domain.local.crt Signature ok subject=C = JP, ST = Some-State, O = Internet Widgits Pty Ltd Getting Private key
ついついやってしまいがちなミス。
$ sudo cat domain.local.key domain.local.crt > /etc/lighttpd/server.pem -bash: /etc/lighttpd/server.pem: 許可がありません
スーパーユーザー権限でアクセスしたいが、リダイレクト先は元のユーザーのアクセス権に戻ってしまうのが問題なので
$ sudo sh -c "cat domain.local.key domain.local.crt > /etc/lighttpd/server.pem"
または
$ sudo cat domain.local.key domain.local.crt | sudo tee /etc/lighttpd/server.pem > /dev/null
で回避。
SSLを有効にしてHTTPS通信を可能にするためモジュールの追加。
$ sudo lighttpd-enable-mod ssl
再起動して有効化。
$ sudo service lighttpd force-reload
※Raspberry PiはRaspberry Pi財団の登録商標です。