入門Let's Encrypt - Speaker Deck

Slide 1

Slide 1 text

ೖ໳Let's Encrypt 2016/01/15 feedforce Inc. / ਿ಺޿࿨

Slide 2

Slide 2 text

ࣗݾ঺հ

Slide 3

Slide 3 text

@critical-alert @critical_alert • ϑΟʔυϑΥʔεͰ͸ΠϯϑϥΤϯδχΞͱ͠ ͯಇ͍͍ͯ·͢ • ͸͡ΊͯLinuxʹ৮Εͯ8೥͘Β͍Ͱ͢ • SNSͷID͕΍΍͍͜͠Ͱ͢

Slide 4

Slide 4 text

Let's Encryptͱࢲ

Slide 5

Slide 5 text

Let’s Encryptͱ͸ͳΜͰ͔͢

Slide 6

Slide 6 text

SSL/TLSαʔόূ໌ॻΛແྉ Ͱൃߦͯ͘͠ΕΔCA(ೝূہ)

Slide 7

Slide 7 text

SSL

Slide 8

Slide 8 text

No content

Slide 9

Slide 9 text

SSL͋Δ͋Δ • झຯͰwebαʔϏε࡞͚ͬͨͲϩάΠϯػೳ ͚͔ͭͨΒSSLʹ͍ͨ͠ • Ͱ΋ূ໌ॻߴ͍ɻɻɻ • ͕͢͞ʹΦϨΦϨূ໌ॻ͸ແ͍Θʔ • ͱ͍͏͔ͦ΋ͦ΋औΓํΑ͘Θ͔ΒΜɻɻ

Slide 10

Slide 10 text

Let’s Encryptͱ͸ͳΜͰ͔͢ • SSLূ໌ॻΛແྉͰൃߦ͢Δͱͱ΋ʹɺূ໌ॻ ͷൃߦɺΠϯετʔϧɺߋ৽ΛࣗಈԽ͠ HTTPSͷීٴΛ໨తͱ͍ͯ͠Δ • ΞϝϦΧ߹ऺࠃେखೝূہʢCAʣͰ͋Δ IdenTrust ࣾͷϧʔτূ໌ॻ͔ΒνΣʔϯͰ͖ ΔΫϩεϧʔτূ໌ॻ

Slide 11

Slide 11 text

Let’s Encryptͱ͸ͳΜͰ͔͢ • ISRGʢInternet Security Research Groupʣɹ ͱ͍͏ඇӦརஂମ͕ӡӦ͍ͯ͠Δ • γείɺAkamaiɺMozillaͳͲ͕εϙϯαʔͰ ࢧԉ͍ͯ͠Δ

Slide 12

Slide 12 text

ൃߦɺΠϯετʔϧɺߋ৽Λ ࣗಈԽ͠

Slide 13

Slide 13 text

ࣗಈԽ͠

Slide 14

Slide 14 text

ࣗಈԽ!!!!!!

Slide 15

Slide 15 text

Let’s Encryptͷূ໌ॻ • DV(Domain Validation): υϝΠϯͷॴ༗Λ֬ೝͯ͠ൃߦ • OV(Organization Validation): ૊৫ͷ࣮ࡏͷ֬ೝΛͯ͠ൃߦ • EV(Extended Validation): OVΑΓݫີͳ࣮ࡏ֬ೝΛͯ͠ൃߦ • Let's Encrypt͸͜ͷ͏ͪυϝΠϯͷॴ༗Λ֬ೝͯ͠ൃߦ͢Δ  DV SSLΛൃߦ͢Δ

Slide 16

Slide 16 text

Slide 17

Slide 17 text

͖ͬࣗ͞ಈԽͬͯݴ͚ͬͨͲ ͳΜͰخ͍͠ͷ͔

Slide 18

Slide 18 text

طଘͷূ໌ॻͷൃߦ/ߋ৽ʹ͸ ࣗಈԽͮ͠Β͍ཧ༝͕͋Δ

Slide 19

Slide 19 text

ཧ༝ • ূ໌ॻ͸༗ྉͳͷͰࢧ෷͍ϓϩηε͕ඞཁ • ূ໌ॻ͸ൃߦػؔ(CA)͝ͱʹਃ੥ϓϩηε͕ҧ͏ • ূ໌ॻ͸खಈͰൃߦ͢Δ(ঝೝํ๏͕ϝʔϧͰདྷ Δ) • ূ໌ॻ͸αʔόʹઃఆͯ͠࠶ىಈ͕ඞཁ

Slide 20

Slide 20 text

εςοϓʹ͢Δͱ͜Μͳײ͡ • 1 ൿີ伴Λ࡞੒ • 2 ൿີ伴ΛݩʹɺCSRʢূ໌ॻΛൃߦ͢ΔͨΊͷॺ໊ཁٻʣΛੜ੒ • 3 ೝূہͷαΠτʹϩάΠϯͯ͠CSRΛϑΥʔϜ͔Βૹ৴ • 4 ূ໌ॻͷྉۚΛࢧ෷͏(ΫϨδοτΧʔυorۜߦৼࠐ) • 5 ೝূہ͔ΒυϝΠϯॴ༗ऀ΁֬ೝϝʔϧ͕ಧ͘ͷͰঝೝ͢Δ • 6 ೝূہ͔Βূ໌ॻ͕ϝʔϧͳͲͰಧ͘ • 7 ূ໌ॻΛαʔόʹઃఆ

Slide 21

Slide 21 text

No content

Slide 22

Slide 22 text

ख࡞ۀʹΑΔ෦෼͕ଟࣗ͘ಈ Խ΍ɺφ΢͍σϓϩΠϑϩʔ ʹऔΓࠐΈͮΒ͍

Slide 23

Slide 23 text

DVূ໌ॻͷൃߦʹඞཁͳ͜ͱ ͸͜Ε͚ͩ

Slide 24

Slide 24 text

ʮূ໌ॻΛൃߦ͍ͨ͠υϝΠϯ ͷॴ࣋ऀ͔Ͳ͏͔ʯ

Slide 25

Slide 25 text

ຊਓ֬ೝ • औಘ͠Α͏ͱ͍ͯ͠ΔυϝΠϯͷॴ࣋ऀ͔Ͳ ͏͔ΛνΣοΫͰ͖Ε͹ྑ͍ • υϝΠϯॴ࣋ऀ͔͠Ͱ͖ͳ͍Α͏ͳΞΫγϣ ϯΛཁٻ͞ΕΔ

Slide 26

Slide 26 text

ຊਓͰ͔͢ʁ • ॴ͍࣋ͯ͠ΔυϝΠϯʹHTTPܦ༝Ͱಛఆͷ৔ॴʹϑΝΠϧΛઃ ஔ͠Let’s Encrypt͔ΒΞΫηεͤ͞Δ • (ଞʹ΋ೝূํ๏͕͋Δ͚Ͳࠓճ͸औΓѻΘͳ͍) • GoogleAppsͱ͔ͰɺಛఆͷHTMLΛొ࿥͍ͨ͠υϝΠϯͷweb αʔόʹΞοϓϩʔυͯ֬͠ೝ͢ΔతͳΞϨͱಉ͡ • ͦΕΛletsencryptΫϥΠΞϯτ͕CUIϕʔεͰࣗಈԽͯ͘͠ΕΔ

Slide 27

Slide 27 text

ਤʹ͢Δͱ Ҿ༻ݩɿhttps://http2.try-and-test.net/letsencrypt.html

Slide 28

Slide 28 text

Ҿ༻ݩΑΓ • ᶃ·ͣ͸ɺൿີ伴ͱCSRΛੜ੒͠ɺൿີ伴͸ϩʔΧϧϑΝΠϧʹอଘ͠·͢ɻ • ͜Ε͸ɺΤʔδΣϯτʢΫϥΠΞϯτιϑτ)͕ੜ੒ͯ͠΋͍͍Ͱ͢͠ɺผ్OpenSSLͰ४උͯ͠΋͍Ͱ ͢ɻ • ᶄΤʔδΣϯτ(ΫϥΠΞϯτιϑτ)͸ɺLet'sEncryptͷACMEαʔόʹ઀ଓ͠CSRΛૹΓ·͢ɻ • ᶅACMEαʔό͸ɺnonceͱݺ͹ΕΔೝূ༻ͷ৘ใΛΤʔδΣϯτιϑτʹฦ͠·͢ɻ • ᶆΤʔδΣϯτ͸ɺnonce͔Βɺೝূ༻ͷϑΝΠϧΛੜ੒͠ɺhtdocs഑ԼͷಛఆͷσΟϨΫτʹ഑ஔ͠·͢ɻ • ᶇ४උ͕੔ͬͨͱ͜ΖͰɺΤʔδΣϯτ͸ɺACMEαʔόʹʹೝূνϟϨϯδΛཁٻ͠·͢ɻ • ᶈACMEαʔό͸ɺࢦఆͷυϝΠϯʹೝূ༻ͷϑΝΠϧ͕ઃஔ͞Ε͍ͯΔ͔ɺWebαʔό(HTTPD)ʹ֬ೝ͠ʹ ͍͖·͢ɻ • ᶉACMEαʔό͕ɺظ଴ͨ͠௨Γͷೝূ༻ϑΝΠϧΛμ΢ϯϩʔυͰ͖Ε͹ɺαʔόূ໌ॻΛൃߦ͠ɺᶊͰ ΤʔδΣϯτʹૹ෇͠·͢ɻ

Slide 29

Slide 29 text

ACMEϓϩτίϧ

Slide 30

Slide 30 text

ACME • ACMEͱ͸  Automated  Certiﬁcate  Management  Environment  ͷུ • ͖ͬ͞ͷೝূํ๏͕ϓϩτίϧԽ͞Ε͍ͯΔ

Slide 31

Slide 31 text

letsencryptΫϥΠΞϯτ • ACMEϓϩτίϧʹैͬͯূ໌ॻΛൃߦɺΠ ϯετʔϧɺߋ৽Λߦ͏ΫϥΠΞϯτ͕ެ։ ͞Ε͍ͯΔ • https://github.com/letsencrypt/letsencrypt

Slide 32

Slide 32 text

࢖ͬͯΈΔ

Slide 33

Slide 33 text

࢖ͬͯΈΔ $ git clone https://github.com/letsencrypt/letsencrypt cd letsencrypt $ ./letsencrypt-auto

Slide 34

Slide 34 text

letsencrypt-auto • letsencrypt-auto ͱ͍͏εΫϦϓτ͕༻ҙ͞Ε ͍ͯͯɺॳճ͸ΫϥΠΞϯτΛ࣮ߦ͢ΔͨΊ ͷϥΠϒϥϦͳͲΛΠϯετʔϧ͢Δ • OSΛࣗಈ൑ఆͯ͠pythonͷΠϯετʔϧ΍ gccɺopensslͷΠϯετʔϧͳͲΛ͍ͯ͠ Δɻpython͸virtualenvͰΠϯετʔϧ͞ΕΔ

Slide 35

Slide 35 text

ূ໌ॻऔಘίϚϯυ ./letsencrypt-auto certonly -t \ -d letsen.critical-alert.net \ --webroot —-webroot-path=/var/www/html/ \ --rsa-key-size 2048

Slide 36

Slide 36 text

Φϓγϣϯ͕௕͍ • certonly • ূ໌ॻͷऔಘͷΈΛߦ͏ • -d • ূ໌ॻΛऔಘ͢ΔυϝΠϯΛࢦఆ͢Δ

Slide 37

Slide 37 text

Φϓγϣϯ͕௕͍2 • --webroot • ApacheͳͲwebαʔόͷυΩϡϝϯτϧʔ τʹೝূ༻ͷϑΝΠϧΛੜ੒͢Δ • --webroot-path • υΩϡϝϯτϧʔτͷύεΛࢦఆ͢Δ

Slide 38

Slide 38 text

letsencrypt-auto • ͪΌΜͱऔಘͰ͖͍ͯΕ͹Լهʹ഑ஔ͞Ε·͢ • /etc/letsencrypt/live/{domain}/ • cert.pem -> ূ໌ॻ • chain.pem -> தؒূ໌ॻ • fullchain.pem -> ূ໌ॻͱதؒূ໌ॻΛͭͳ͛ͨ΋ͷ • privkey.pem -> ൿີ伴

Slide 39

Slide 39 text

͋ͱ͸ؾ߹ͱσϞͰ͕Μ͹Δ (࣌ؒʹ༨༟͕͋Ε͹)

Slide 40

Slide 40 text

ߋ৽͸ʁ • جຊతʹऔಘ࣌ͱಉ͡ίϚϯυΛ࣮ߦ͢Ε͹ ߋ৽ • --renew-by-default • ͜ͷΦϓγϣϯΛ͚ͭΔͱ্ॻ͖͢Δ͔ฉ ͔Εͳ͍ͷͰ͚ͭΔ

Slide 41

Slide 41 text

ߋ৽͸ʁ • --renew-by-defaultΛ͚ͭͯcronʹ࢓ࠐΉ • ౰વɺߋ৽͞ΕͨλΠϛϯάͰwebαʔόΛreloadͯ͠ূ໌ ॻಡΈ௚͞ͳ͍ͱ͍͚ͳ͍ͷͰ && systemctl reload httpd ͷΑ͏ʹ͢Δ • ূ໌ॻͷ༗ޮظؒ͸90೔ʹͳ͍ͬͯΔͷͰ(ηΩϡϦςΟత ͳҙຯ߹͍΍ɺࣗಈߋ৽͕લఏͷͨΊ)1ϲ݄ʹ1ճcronͰ࣮ ߦ͢ΔΑ͏ʹ͢Ε͹OK

Slide 42

Slide 42 text

·ͱΊ • ϕʔλͳ͕Β΋΄ͱΜͲͷϞμϯͳ؀ڥͰ༗ޮͳূ໌ॻ͕ແྉͰऔಘͰ͖Δ • ։ൃதͷΞϓϦέʔγϣϯ΍ɺݸਓͰ࡞੒ͨ͠ΞϓϦέʔγϣϯͷSSLԽʹ ༗ޮ • CUIͰ׬݁͢Δͷ͸ྑ͍ͱࢥ͏ • ELBͱ͔ͷ؀ڥͰ࢖͏ʹ͸…ʁ • ׬શͳΔࣗಈԽʹ͸·͔͔ͩΓͦ͏ • ߋ৽͸cronͩͬͨΓͶ

Slide 43

Slide 43 text

ࢀߟϦϯΫ • Let's Encrypt ૯߹ϙʔλϧ • https://letsencrypt.jp/ • Apache 2.4ܥͰHTTP/2αʔόΛߏஙͯ͠ΈΔςετɻ • https://http2.try-and-test.net/letsencrypt.html • GoݴޠͰLet's EncryptͷACMEΛཧղ͢Δ • http://deeeet.com/writing/2015/12/01/go-letsencrypt-acme/