ラズパイでLighttpd(HTTPS編) の変更点

• 追加された行はこの色です。
• 削除された行はこの色です。
• ラズパイでLighttpd(HTTPS編) へ行く。
• ラズパイでLighttpd(HTTPS編) の差分を削除

#author("2022-11-16T23:46:23+09:00","default:honma","honma")
* ラズパイでLighttpd(HTTPS編) [#xb8b2134]

オレオレ認証のHTTPSをLighttpdで実行するのも簡単。

** SSLの有効化(事前確認) [#p455de01]

SSLの設定は下記の設定を利用する。

 $ cat /etc/lighttpd/conf-available/10-ssl.conf
 # /usr/share/doc/lighttpd/ssl.txt
 
 server.modules += ( "mod_openssl" )
 
 # ssl.* in global scope gets inherited by
 #   $SERVER["socket"] == "..." { ssl.engine = "enable" }
 ssl.pemfile = "/etc/lighttpd/server.pem"
 ssl.cipher-list = "HIGH"
 
 $SERVER["socket"] == "0.0.0.0:443" {
         ssl.engine  = "enable"
 }
 include_shell "/usr/share/lighttpd/use-ipv6.pl 443"

** CSR [#pa0def0e]

今回はテスト用途なので中身は空。

 $ openssl req -new -newkey rsa:4096 -nodes -keyout domain.local.key -out domain.local.csr
 Generating a RSA private key
 ...................................................................................++++
 ..............................................................++++
 writing new private key to 'domain.local.key'
 -----
 You are about to be asked to enter information that will be incorporated
 into your certificate request.
 What you are about to enter is what is called a Distinguished Name or a DN.
 There are quite a few fields but you can leave some blank
 For some fields there will be a default value,
 If you enter '.', the field will be left blank.
 -----
 Country Name (2 letter code) [AU]:JP
 State or Province Name (full name) [Some-State]:
 Locality Name (eg, city) []:
 Organization Name (eg, company) [Internet Widgits Pty Ltd]:
 Organizational Unit Name (eg, section) []:
 Common Name (e.g. server FQDN or YOUR name) []:
 Email Address []:
 
 Please enter the following 'extra' attributes
 to be sent with your certificate request
 A challenge password []:
 An optional company name []:

** CRT [#o31c118f]

 $ openssl x509 -req -days 365 -in domain.local.csr -signkey domain.local.key -out domain.local.crt
 Signature ok
 subject=C = JP, ST = Some-State, O = Internet Widgits Pty Ltd
 Getting Private key

** /etc/lighttpd/server.pem の作成 [#e2ca20f5]

ついついやってしまいがちなミス。

 $ sudo cat domain.local.key domain.local.crt > /etc/lighttpd/server.pem
 -bash: /etc/lighttpd/server.pem: 許可がありません

スーパーユーザー権限でアクセスしたいが、リダイレクト先は元のユーザーのアクセス権に戻ってしまうのが問題なので

 $ sudo sh -c "cat domain.local.key domain.local.crt > /etc/lighttpd/server.pem"

または

 $ sudo cat domain.local.key domain.local.crt | sudo tee /etc/lighttpd/server.pem > /dev/null

で回避。

** SSLの有効化 [#o60da9bd]

SSLを有効にしてHTTPS通信を可能にするためモジュールの追加。

 $ sudo lighttpd-enable-mod ssl

再起動して有効化。

 $ sudo service lighttpd force-reload

~
※Raspberry PiはRaspberry Pi財団の登録商標です。
#htmlinsert(rpi3b+.html);