CentOS8のApacheで自己署名証明書を使いSSL化する方法

# 仮想マシンのhttps://www.example.comにアクセスさせる
192.168.56.116          www.example.com

・認証局用のファイル、フォルダを作成
# mkdir -p /etc/pki/CA/certs
# mkdir /etc/pki/CA/private
# touch /etc/pki/CA/index.txt
# touch /etc/pki/CA/serial && echo 00 > /etc/pki/CA/serial

# vi /etc/pki/tls/openssl.cnf

■openssl.cnf
--------------------------------------------------
[ CA_default ]

#new_certs_dir  = $dir/newcerts
new_certs_dir   = $dir/certs

#certificate    = $dir/cacert.pem
certificate     = $dir/certs/ca.crt

#private_key    = $dir/private/cakey.pem
private_key     = $dir/private/ca.key

[ req ]

#req_extensions = v3_req # The extensions to add to a certificate request 
req_extensions = v3_req # The extensions to add to a certificate request

[ usr_cert ]
# subjectAltName=email:copy
subjectAltName = @alt_names

[ v3_req ]
subjectAltName = @alt_names

[ alt_names ]
DNS.1 = www.example.com
DNS.2 = *.example.com
--------------------------------------------------

・認証局の秘密鍵および証明書を同時に作成
# openssl req -new -x509 -sha256 -days 3650 -newkey rsa:4096 -out /etc/pki/CA/certs/ca.crt -keyout /etc/pki/CA/private/ca.key 

・秘密鍵のパスワードを聞かれるため、パスワードを設定する
writing new private key to '/etc/pki/CA/private/ca.key'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:

・認証局の各種情報を設定する
You are about to be asked to enter information that will be incorporated
into your certificate request. 
What you are about to enter is what is called a Distinguished Name or a DN. 
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:JP       # 国の名前
State or Province Name (full name) []:Tokyo      # 州の名前、日本だと都道府県あたり
Locality Name (eg, city) [Default City]:Shinjuku-ku      # 都市の名前
Organization Name (eg, company) [Default Company Ltd]:Example Co.    # 会社名
Organizational Unit Name (eg, section) []:Example Department    # 会社の部署名
Common Name (eg, your name or your server's hostname) []:www.example.com  # ドメイン名やサーバのホスト名
Email Address []:root@example.com    # 認証局のメールアドレス

・認証局の秘密鍵のパスワードを削除
# openssl rsa -in /etc/pki/CA/private/ca.key -out /etc/pki/CA/private/ca.key 
Enter pass phrase for /etc/pki/CA/private/ca.key:
writing RSA key

・認証局用のファイル、フォルダを作成
# openssl req -new -sha256 -days 3650 -newkey rsa:4096 -out /etc/pki/tls/server.csr -keyout /etc/pki/tls/private/server.key 

・秘密鍵のパスワードを聞かれるため、パスワードを設定する
writing new private key to '/etc/pki/tls/private/server.key'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:

・サーバの各種情報を設定する
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:JP       # 国の名前
State or Province Name (full name) []:Tokyo      # 州の名前、日本だと都道府県あたり
Locality Name (eg, city) [Default City]:Shinjuku-ku      # 都市の名前
Organization Name (eg, company) [Default Company Ltd]:Example Co.    # 会社名
Organizational Unit Name (eg, section) []:Example Department    # 会社の部署名
Common Name (eg, your name or your server's hostname) []:www.example.com  # ドメイン名やサーバのホスト名
Email Address []:root@example.com    # サーバ管理者のメールアドレス

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

・サーバの秘密鍵のパスワードを削除
# openssl rsa -in /etc/pki/tls/private/server.key -out /etc/pki/tls/private/server.key 
Enter pass phrase for /etc/pki/tls/private/server.key:
writing RSA key

・認証局をの秘密鍵で署名を行いサーバ証明書を作成
# openssl ca -days 3650 -keyfile /etc/pki/CA/private/ca.key -cert /etc/pki/CA/certs/ca.crt -in /etc/pki/tls/server.csr -out /etc/pki/tls/certs/server.crt 

Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 0 (0x0)
        Validity
            Not Before: May 17 11:34:42 2020 GMT
            Not After : May 15 11:34:42 2030 GMT
        Subject:
            countryName               = JP
            stateOrProvinceName       = Tokyo
            organizationName          = Example Co.
            organizationalUnitName    = Example Department
            commonName                = www.example.com
            emailAddress              = root@example.com
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            Netscape Comment:
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier:
                FE:90:4A:D4:FD:47:79:14:A4:F0:CF:88:EF:53:43:F6:A3:4F:92:C0
            X509v3 Authority Key Identifier:
                keyid:87:14:9E:0E:25:DC:04:5C:17:DD:D8:60:7D:B0:86:47:68:F3:C6:24 

            X509v3 Subject Alternative Name:
                DNS:www.example.com, DNS:*.example.com
Certificate is to be certified until May 15 11:34:42 2030 GMT (3650 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

・Apacheの設定ファイルを編集する
# vi /usr/local/apache2/conf/httpd.conf

■httpd.conf
--------------------------------------------------
# HTTPSの443ポートを待ち受ける
Listen 443

# mod_sslを読み込む
#LoadModule ssl_module modules/mod_ssl.so
LoadModule ssl_module modules/mod_ssl.so

# VirtualHostにSSLの有効化、サーバの秘密鍵、証明書等を設定
<virtualhost *:443="">
    SSLEngine on
    SSLCertificateFile /etc/pki/tls/certs/server.crt
    SSLCertificateKeyFile /etc/pki/tls/private/server.key
    DocumentRoot "/usr/local/apache2/htdocs"
    ServerName www.example.com
</virtualhost>
--------------------------------------------------

・firewallでhttpsを許可する
# firewall-cmd --add-service=https --zone=public --permanent
# firewall-cmd --reload

・Apacheを再起動する
# systemctl restart httpd