ラズパイでLighttpd(HTTPS編)
をテンプレートにして作成
[
トップ
] [
新規
|
一覧
|
検索
|
最終更新
|
ヘルプ
|
ログイン
]
開始行:
* ラズパイでLighttpd(HTTPS編) [#xb8b2134]
オレオレ認証のHTTPSをLighttpdで実行するのも簡単。
** SSLの有効化(事前確認) [#p455de01]
SSLの設定は下記の設定を利用する。
$ cat /etc/lighttpd/conf-available/10-ssl.conf
# /usr/share/doc/lighttpd/ssl.txt
server.modules += ( "mod_openssl" )
# ssl.* in global scope gets inherited by
# $SERVER["socket"] == "..." { ssl.engine = "enable" }
ssl.pemfile = "/etc/lighttpd/server.pem"
ssl.cipher-list = "HIGH"
$SERVER["socket"] == "0.0.0.0:443" {
ssl.engine = "enable"
}
include_shell "/usr/share/lighttpd/use-ipv6.pl 443"
** CSR [#pa0def0e]
今回はテスト用途なので中身は空。
$ openssl req -new -newkey rsa:4096 -nodes -keyout domai...
Generating a RSA private key
...........................................................
...........................................................
writing new private key to 'domain.local.key'
-----
You are about to be asked to enter information that will...
into your certificate request.
What you are about to enter is what is called a Distingu...
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:JP
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Lt...
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
** CRT [#o31c118f]
$ openssl x509 -req -days 365 -in domain.local.csr -sign...
Signature ok
subject=C = JP, ST = Some-State, O = Internet Widgits Pt...
Getting Private key
** /etc/lighttpd/server.pem の作成 [#e2ca20f5]
ついついやってしまいがちなミス。
$ sudo cat domain.local.key domain.local.crt > /etc/ligh...
-bash: /etc/lighttpd/server.pem: 許可がありません
スーパーユーザー権限でアクセスしたいが、リダイレクト先は...
$ sudo sh -c "cat domain.local.key domain.local.crt > /e...
または
$ sudo cat domain.local.key domain.local.crt | sudo tee ...
で回避。
** SSLの有効化 [#o60da9bd]
SSLを有効にしてHTTPS通信を可能にするためモジュールの追加。
$ sudo lighttpd-enable-mod ssl
再起動して有効化。
$ sudo service lighttpd force-reload
~
※Raspberry PiはRaspberry Pi財団の登録商標です。
#htmlinsert(rpi3b+.html);
終了行:
* ラズパイでLighttpd(HTTPS編) [#xb8b2134]
オレオレ認証のHTTPSをLighttpdで実行するのも簡単。
** SSLの有効化(事前確認) [#p455de01]
SSLの設定は下記の設定を利用する。
$ cat /etc/lighttpd/conf-available/10-ssl.conf
# /usr/share/doc/lighttpd/ssl.txt
server.modules += ( "mod_openssl" )
# ssl.* in global scope gets inherited by
# $SERVER["socket"] == "..." { ssl.engine = "enable" }
ssl.pemfile = "/etc/lighttpd/server.pem"
ssl.cipher-list = "HIGH"
$SERVER["socket"] == "0.0.0.0:443" {
ssl.engine = "enable"
}
include_shell "/usr/share/lighttpd/use-ipv6.pl 443"
** CSR [#pa0def0e]
今回はテスト用途なので中身は空。
$ openssl req -new -newkey rsa:4096 -nodes -keyout domai...
Generating a RSA private key
...........................................................
...........................................................
writing new private key to 'domain.local.key'
-----
You are about to be asked to enter information that will...
into your certificate request.
What you are about to enter is what is called a Distingu...
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:JP
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Lt...
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
** CRT [#o31c118f]
$ openssl x509 -req -days 365 -in domain.local.csr -sign...
Signature ok
subject=C = JP, ST = Some-State, O = Internet Widgits Pt...
Getting Private key
** /etc/lighttpd/server.pem の作成 [#e2ca20f5]
ついついやってしまいがちなミス。
$ sudo cat domain.local.key domain.local.crt > /etc/ligh...
-bash: /etc/lighttpd/server.pem: 許可がありません
スーパーユーザー権限でアクセスしたいが、リダイレクト先は...
$ sudo sh -c "cat domain.local.key domain.local.crt > /e...
または
$ sudo cat domain.local.key domain.local.crt | sudo tee ...
で回避。
** SSLの有効化 [#o60da9bd]
SSLを有効にしてHTTPS通信を可能にするためモジュールの追加。
$ sudo lighttpd-enable-mod ssl
再起動して有効化。
$ sudo service lighttpd force-reload
~
※Raspberry PiはRaspberry Pi財団の登録商標です。
#htmlinsert(rpi3b+.html);
ページ名:
![[PukiWiki]](image/gbook_orange_80x80.png "[PukiWiki]")
