PFSを考慮したTLS終端とngx_mrubyによる大量ドメイン設定の効率化

nginxにおける大量ドメインの証明書を動的に処理する方法

Transcript

1. OHJOYʹ͓͚ΔେྔυϝΠϯͷূ໌ॻΛಈతʹॲཧ͢Δํ๏
   GMO Pepabo, Inc.
   ٕज़ج൫νʔϜ γχΞɾϓϦϯγύϧΤϯδχΞ
   MATSUMOTO, Ryosuke
   @matsumotory
   2016/01/29 ࣾ಺ٕज़ڞ༗ࢿྉ
   1'4Λߟྀͨ͠5-4ऴ୺ͱOHY@NSVCZ
   ʹΑΔେྔυϝΠϯઃఆͷޮ཰Խ
   

   View Slide

2. ໨࣍
   1FSGFDU'PSXBSE4FDSFDZʢ1'4ʣ
   1'4Λຬͨ͢伴ަ׵ํࣜ
   '4Λຬͨ͢5-4ηογϣϯΩϟογϡ
   OHY@NSVCZʹΑΔಈతূ໌ॻಡΈࠐΈ
   OHY@NSVCZʹΑΔಈతϦόʔεϓϩΩγ
   ·ͱΊ
   

   View Slide

3. લఏɿલ൒ͷ1'4Λߟྀͨ͠OHJOYͷઃఆͱɺ
   ޙ൒ͷυϝΠϯ਺͕େྔʹ͋Δ৔߹ͷ
   OHY@NSVCZΛར༻ͨ͠ূ໌ॻͱϦόʔεϓ
   ϩΩγͷઃఆ͸෼͚ͯ׆༻͢Δ͜ͱ͕ग़དྷ·͢ɻ
   

   View Slide

4. 1FSGFDU'PSXBSE4FDSFDZ
   

   View Slide

5. 1FSGFDU'PSXBSE4FDSFDZ
   ˞Ҏ߱1'4ͱলུ
   ˞5-4ηογϣϯͷ৔߹
   ൿີ伴͕࿙Ӯͯ͠΋աڈͷ௨৴͕ղಡͰ͖ͳ͍ঢ়ଶ
   શͯͷ5-4ηογϣϯͰҟͳΔൿີ伴Λ࢖͏
   ҉߸Խ͞Εͨ௨৴Λͻͨ͢ΒஷΊ͜ΜͰͲ͔͜Ͱൿີ
   伴ΛಘͨΒͦͷશͯͷ௨৴ΛղੳՄೳͱ͍͏ঢ়ଶ͸ඇ
   ৗʹ·͍ͣͱ͍͏໰୊΁ͷରࡦ
   

   View Slide

6. 5-4Ͱ1'4͋Δ͍͸'4Λຬͨ͢ʹ͸
   1'4ʹରԠͨ͠DJQIFSTVJUFTͷબ୒
   '4Λߟྀͨ͠5-4ηογϣϯΩϟογϡํࣜΛબ୒
   Ϋϥελߏ੒΍ΠϕϯτυϦϒϯʹΑΔ࣮૷ͷߟྀ
   8FCαʔϏεͰͪΌΜͱ΍Ζ͏ͱ͢Δͱҙ֎ͱେม
   

   View Slide

7. 1'4Λຬͨ͢伴ަ׵ํࣜ
   

   View Slide

8. 1'4Λຬͨ͢伴ަ׵
   &%)΍&$%)&伴ަ׵ํࣜΛ࢖͏
   ηογϣϯຖʹϥϯμϜͳ伴Λ࢖༻
   ΫϥΠΞϯτɾαʔόͦΕͧΕͰҟͳΔ伴Λ࢖༻
   OHJOYͰͷ伴ަ׵ઃఆ
   OHJOYͩͱTTM@EIQBSBNσΟϨΫςΟϒ
   DJQIFSTTVJUFTΛαʔόଆͰࢦఆ͢ΔͳͲ
   

   View Slide

9. OHJOYͷؔ࿈σΟϨΫςΟϒ
   SFGIUUQTXFBLEIPSHTZTBENJOIUNM
   

   View Slide

10. '4Λຬͨ͢
    5-4ηογϣϯΩϟογϡ
    

    View Slide

11. 5-4ηογϣϯΩϟογϡͷछྨ
    4FTTJPOSFTVNQUJPO
    αʔόɾΫϥΠΞϯτͰڞ௨伴ΛΩϟογϡ
    4FTTJPOUJDLFU
    ΫϥΠΞϯτͰڞ௨伴Λνέοτͱͯ͠อଘ
    αʔόଆͰΩϟογϡΛ࣋ͭඞཁͳ͠
    Ϋϥελߏ੒࣌ʹศར
    

    View Slide

12. 4FTTJPOSFTVNQUJPO
    Ϋϥελ࣌ʹ͸ΩϟογϡΛαʔόؒͰڞ༗
    OHJOYͰ͸αʔόؒڞ༗ʹରԠ͍ͯ͠ͳ͍
    ΠϕϯτυϦϒϯαʔόͰ͸࣮૷͕೉͍͠
    ΫϥελؒΩϟογϡΛఘΊΔ
    )0͸ͦΕΛͰ͖ΔΑ͏ʹ͍ͯ͠ΔͷͰ͍͢͝
    ͦΕ͔4FTTJPOUJDLFUΛ࢖͏
    ΠϕϯτυϦϒϯ͔ͭΫϥελߏ੒Ͱ΋࢖͑Δ
    ͔͠͠4FTTJPOUJDLFU͸'4ͷ؍఺Ͱ໰୊༗Γ
    

    View Slide

13. 4FTTJPOUJDLFU
    ϚελʔΩʔ͕࿙ΕΔͱશ௨৴͕ղಡՄೳ
    1'4ͷ֓೦Λຬ͍ͨͤͯͳ͍
    αʔόଆͰϚελʔΩʔΛอଘ͢Δͷ͕௨ৗ
    ΫϥελؒͰϚελʔΩʔΛڞ༗
    Ϋϥελ಺ͷͲͷαʔόʹৼΓ෼͚ऽΒΕͯ΋Ωϟογϡར༻Մೳ
    OHJOYͷ৔߹
    '4Λຬͨͨ͢ΊʹϚελʔΩʔΛఆظతʹαʔΨଆͰߋ৽
    ͜Ε·ͨ)0͸ࣗಈతߋ৽ʹରԠࡁΈͰ͍͢͝
    

    View Slide

14. ͜͜·Ͱͷ·ͱΊ
    

    View Slide

15. Ϋϥελߏ੒ͷOHJOYͷ৔߹
    1'4ʹରԠͨ͠DJQIFSTVJUFTΛઃఆ
    '4Λຬͨ͢Α͏ʹTFTTJPOUJDLFUͷϚελʔΩʔΛఆظߋ৽
    )0͸σϑΥϧτͰ෼Ͱߋ৽
    Ϋϥελར༻ʹ͓͍ͯ͸ϚελʔΩʔΛαʔόؒͰڞ༗
    TFTTJPOSFTVNQUJPOͷ৔߹͸αʔόؒΩϟογϡڞ༗Λఘ
    ΊΔ
    

    View Slide

16. ಈతূ໌ॻಡΈࠐΈ
    

    View Slide

17. υϝΠϯ਺͕ଟ͍৔߹
    υϝΠϯ਺͕ઍɾສͷΦʔμʔͷ৔߹
    OHJOYͷ৔߹ূ໌ॻಡΈࠐΈͷઃఆ਺
    ΍υϝΠϯ୯Ґͷઃఆ͕๲େʹͳΔ
    OHJOYͷϓϩηεͷϝϞϦ΋େ͖͘ͳΔ
    ສͷূ໌ॻಡΈࠐΈͰ໿.#ͱ͔
    

    View Slide

18. OHY@NSVCZͰղܾ
    ಈతূ໌ॻಡΈࠐΈ
    ηογϣϯ୯ҐͰূ໌ॻಡΈࠐΉ࣌ʹNSVCZΛϑοΫ
    PQFOTTMҎ্͕ඞཁ
    4/*ͷTFSWFSOBNFʹ߹கͨ͠ূ໌ॻϑΝΠϧΛಡΈࠐΉ
    ઃఆ͕ҰͭͰࡁΉ͠ϝϞϦ΋ݮΔ
    ੑೳ͸OHY@NSVCZͷIFMMPXPSMEϕϯνͰݮఔ౓
    

    View Slide

19. View Slide

20. ಈతϦόʔεϓϩΩγ
    

    View Slide

21. ಈతϦόʔεϓϩΩγ
    5-4ͰΞΫηεͷ͋ͬͨυϝΠϯΛద੾ͳόοΫΤϯ
    υʹϦόʔεϓϩΩγ͢Δඞཁ༗Γ
    ඥ෇͚Λ֎෦σʔλετΞͳͲ͔Βऔಘ
    ඥ෇͚Λ΋ͱʹOHY@NSVCZͰಈతϦόʔεϓϩΩγ
    

    View Slide

22. ͜Εͱ1'4ͷઃఆͱಈతূ໌ॻಡΈࠐΈΛ߹ମͤ͞Δ
    

    View Slide

23. ·ͱΊ
    

    View Slide

24. 1'4ͷߟྀͱಈతઃఆ
    1'4Λߟྀͨ͠DJQIFSTVJUFTͷઃఆ
    '4Λߟྀͨ͠ηογϣϯΩϟογϡͷબ୒
    ΠϕϯτυϦϒϯΛߟྀͨ͠ηογϣϯΩϟογϡͷબ୒
    ಈతূ໌ॻಡΈࠐΈΛOHY@NSVCZͰ࣮ݱ
    ಈతϦόʔεϓϩΩγΛOHY@NSVCZͰ࣮ݱ
    

    View Slide