[B! SSL] junichi_yã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

junichi_y id:junichi_y

SSLã«é–¢ã™ã‚‹junichi_yã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (9)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

IDCFã‚¯ãƒ©ã‚¦ãƒ‰ã‚’ç”¨ã„ã¦ã–ã£ãã‚Šã¨SSLã«å¯¾å¿œã•ã›ã‚‹ - Qiita
ã“ã®è¨˜äº‹ã¯ã€IDCFã‚¯ãƒ©ã‚¦ãƒ‰ Advent Calendar 19æ—¥ç›®ã®å†…å®¹ã§ã™ã€‚æ™®é€šã«2æ—¥å‰ã«å‡ºã¦ãã¾ã—ãŸãŒã€ã“ã£ã¡ãŒæœ¬æ¥è¨˜è¿°ã™ã‚‹äºˆå®šæ—¥ã§ã—ãŸãŒã€æ°—ã«ã—ãªã„ã“ã¨ã«ã—ã¾ã—ã‚‡ã†ã€‚ å…ˆæ—¥æ§‹ç¯‰ã—ãŸã€IDCFã‚¯ãƒ©ã‚¦ãƒ‰ã§ã–ã£ãã‚Šã¨a-blog cmsã‚’æ§‹ç¯‰ã™ã‚‹è¨˜äº‹ã®ç’°å¢ƒã‚’ãƒ™ãƒ¼ã‚¹ã«ã—ã¾ã™ã€‚ï¼ˆLAMPï¼‰ å…¨é¢SSLã®ãƒ¡ãƒªãƒƒãƒˆ å…¨é¢SSLã‚’ã™ã‚‹ã“ã¨ã«ã‚ˆã‚‹ãƒ¡ãƒªãƒƒãƒˆã‚’è¨˜è¼‰ã™ã‚‹ã¨ã€ä»¥ä¸‹ã®ç‚¹ã§ã™ã€‚ Googleã‹ã‚‰ã®SEOè©•ä¾¡ãŒã‚ãŒã‚‹ã‹ã‚‚ã—ã‚Œãªã„ ã©ã†ã›ãŠé‡‘ã‹ã‘ã‚‹ã®ã§ã‚ã‚Œã°ã€å…¨éƒ¨å¯¾å¿œã•ã›ãŸã»ã†ãŒãƒªãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆå‡¦ç†ãŒæ¥½ ã‚µã‚¤ãƒˆã®æ”¹ã–ã‚“ãŒé›£ã—ããªã‚‹ å…¨ä½“ãŒæš—å·åŒ–ã•ã‚Œã‚‹ã“ã¨ã«ã‚ˆã£ã¦ã€ãƒ—ãƒ©ã‚¤ãƒã‚·ãƒ¼ãŒé«˜ã¾ã‚‹ã€‚ ã—ã‹ã—ã€SSLè¨¼æ˜Žæ›¸ã‚’å°Žå…¥ã™ã‚‹æ™‚ã«è¿·ã†ç‚¹ãŒâ€œ ãŠé‡‘ãŒäºˆæƒ³ä»¥ä¸Šã«ã‹ã‹ã‚‹ â€ã¨ã„ã†ç‚¹ã§ã‚ã‚‹ã¨æ€ã„ã¾ã™ã€‚ã•ãã‚‰ã®SSLã§ã¯å¹´é¡1,500å††ï¼ˆç¨ŽæŠœ, RapidSSLï¼‰ãƒãƒƒãƒˆã‚ªã‚¦ãƒ«ãŒæä¾›ã™ã‚‹SSL BOXã§ã‚ã£ã¦ã‚‚ã€å¹´é¡990
junichi_y 2016/01/11
Let's Encrypt

TLS

ssl

letsencrypt
ãƒªãƒ³ã‚¯
Let's Encrypt ã‚µãƒ¼ãƒãƒ¼è¨¼æ˜Žæ›¸ã®å–å¾—ã¨è‡ªå‹•æ›´æ–°è¨å®šãƒ¡ãƒ¢
ç”¨é€”ã«ã‚‚ã‚ˆã‚Šã¾ã™ãŒã€é€šä¿¡ã®æš—å·åŒ–ã‚’ç›®çš„ã¨ã™ã‚‹ã®ã§ã‚ã‚Œã°ã€ãƒ‰ãƒ¡ã‚¤ãƒ³èªè¨¼åž‹ã§ååˆ†ã§ã™ã€‚ä¾‹ãˆã° HTTP/2 ã§WEBã‚µãƒ¼ãƒã‚’å‹•ã‹ã™ã«ã¯ã€äº‹å®Ÿä¸ŠSSL/TLSãŒå¿…é ˆã«ãªã‚Šã¾ã™ã®ã§ã€ãã†ã„ã£ãŸç”¨é€”ã§ã‚‚æ™®åŠã—ãã†ã§ã™ãã€‚ Let's Encrypt ã®è¨¼æ˜Žæ›¸å–å¾—æ–¹æ³• Let's Encrypt ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã‚½ãƒ•ãƒˆ(ã‚³ãƒžãƒ³ãƒ‰)ã‚’ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã—ã¦ã€è¨¼æ˜Žæ›¸å–å¾—ç”¨ã®ã‚³ãƒžãƒ³ãƒ‰ã‚’æ‰“ã¤ã ã‘ã§ã™ã€‚ å†’é ã«ã‚‚æ›¸ãã¾ã—ãŸãŒã€Let's Encrypt ã§ã®è¨¼æ˜Žæ›¸å–å¾—ã®æ‰‹ç¶šãã¯ã€ä»–ã®èªè¨¼å±€ã®ã‚‚ã®ã¨å¤§ããç•°ãªã‚Šã¾ã™ã€‚Let's Encrypt ã®ã‚µã‚¤ãƒˆã«è¡Œã£ã¦ã€ŒCSRã‚’é€ä¿¡ã™ã‚‹ç”³è«‹ãƒ•ã‚©ãƒ¼ãƒ ã¯ã©ã“ã ã‚ã†ï¼Ÿã€ã¨æŽ¢ã—ãŸã®ã¯ã€ç§ã ã‘ã§ã¯ãªã„ã¯ãšã§ã™(^^;) å‚è€ƒã¾ã§ã«ã€ä¸€èˆ¬çš„ãªãƒ‰ãƒ¡ã‚¤ãƒ³èªè¨¼åž‹ã®è¨¼æ˜Žæ›¸ç™ºè¡Œã®æµã‚Œã¯ã€ä»¥ä¸‹ã®é€šã‚Šã§ã™ã€‚ (1) ç§˜å¯†éµã‚’ä½œæˆ (2) ç§˜å¯†éµã‚’å…ƒã«ã€CSRï¼ˆè¨¼æ˜Žæ›¸ã‚’ç™ºè¡Œã™ã‚‹ãŸã‚ã®ç½²åè¦æ±‚ï¼‰ã‚’ç”Ÿæˆ (3)
junichi_y 2016/01/11
Let's Encrypt

TLS

ssl

letsencrypt
ãƒªãƒ³ã‚¯
ç†è§£ã—ã¦ã‚‹ã¤ã‚‚ã‚Šã® SSL/TLS ã§ã‚‚ã€ã‚‚ã£ã¨ç†è§£ã—ãŸã‚‰é¢ç™½ã‹ã£ãŸè©± Â· ã‘ã‚“ã”ã®ãŠå±‹æ•·
apache ã‚„ nginx ã®è¨å®šã‚’ã—ãŸã“ã¨ãŒã‚ã‚Œã°ä»¥ä¸‹ã®æ§˜ãªè¡Œã‚’è¦‹ãŸã“ã¨ãŒã‚ã‚‹äººã‚‚å¤šã„ã®ã§ã¯ãªã„ã§ã—ã‚‡ã†ã‹ã€‚(â€» ä¸‹è¨˜ã¯ nginx ã®è¨å®šã€‚apache ã®å ´åˆã¯ SSLCipherSuite ã§ã™ã€‚) ssl_ciphers AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5; ã“ã‚ŒãŒæš—å·ã‚¹ã‚¤ãƒ¼ãƒˆã‚’æŒ‡å®šã—ã¦ã„ã‚‹ç®‡æ‰€ã§ã™ã€‚ãã—ã¦ã“ã®éƒ¨åˆ†ã€ã‚ã‘ã®ã‚ã‹ã‚‰ãªã„æ–‡å—åˆ—ã®ç¾…åˆ—ãªã®ã§ã™ã”ãå–ã£ã¤ãã«ããã¦ä½•ã‚’æŒ‡å®šã—ãŸã‚‰ã„ã„ã‹ã‚ã‹ã‚‰ãªã„ã®ã§ã€ã‚³ãƒ”ãƒšã—ã¦ã—ã¾ã†äººã‚‚å¤šã„ã‚“ã˜ã‚ƒãªã„ã§ã—ã‚‡ã†ã‹ã€‚ã‹ãã„ã†ç§ã‚‚æ•°å¹´å‰ã«è¶£å‘³ã§ TLS å¯¾å¿œã® Web ã‚µãƒ¼ãƒ“ã‚¹ã‚’ä½œã£ãŸæ™‚ã¯ã‚³ãƒ”ãƒšã§æ¸ˆã¾ã›ã¦ã„ã¾ã—ãŸã€‚ã“ã®æš—å·ã‚¹ã‚¤ãƒ¼ãƒˆã¯ã€ä»¥ä¸‹ã®ã‚ˆã†ãª OpenSSL ã®ã‚³ãƒžãƒ³ãƒ‰ã‚’ä½¿ã£ã¦å¯¾å¿œã—ã¦ã„ã‚‹ä¸€è¦§ã‚’è¦‹ã‚‹ã“ã¨ãŒã§ãã¾ã™ã€‚ $ openssl ciphers -v AES128-SH
junichi_y 2015/12/03
ç†è§£ã—ã¦ã‚‹ã¤ã‚‚ã‚Šã® SSL/TLS ã§ã‚‚ã€ã‚‚ã£ã¨ç†è§£ã—ãŸã‚‰é¢ç™½ã‹ã£ãŸè©± #web #security #ssl #tls #OpenSSL #RSA

web

security

ssl

tls

OpenSSL

RSA
ãƒªãƒ³ã‚¯
Nginxã§SSLã®è©•ä¾¡ã‚’A+ã«ã™ã‚‹æ‰‹é †
æ˜¨æ—¥ HTTPS åŒ–ã—ãŸ ã‚·ãƒ£ãƒ³ãƒ—ãƒ¼è©•ä¾¡ã‚µã‚¤ãƒˆ ã®SSLè©•ä¾¡ã‚’A+ã«ã—ã¾ã—ãŸã€‚ å‚è€ƒã«ã—ãŸã®ã¯ä¸‹ã®è¨˜äº‹ HTTPS on Nginx: From Zero to A+ (Part 2) - Configuration, Ciphersuites, and Performance - Julian Simioni ã“ã®è¨˜äº‹ã®Nginxè¨¼æ˜Žæ›¸è¨å®šã‚’POSTDã•ã‚“ãŒç¿»è¨³ã—ã¦ã„ã‚‹ã®ã§ã€è¿‘ã„ã†ã¡ã«è©³ã—ã„è¨³ã¯æ—¥æœ¬èªžã§èªã‚ã‚‹ã‹ã‚‚ã€‚ã“ã“ã§ã¯é©å½“ã«ã‹ã„ã¤ã¾ã‚“ã æ‰‹é †ã‚’æ›¸ã„ã¦ãŠãã€‚ä¸€éƒ¨æ™‚é–“ã®ã‹ã‹ã‚‹ã‚³ãƒžãƒ³ãƒ‰ã‚‚ã‚ã‚‹ã‘ã©ã€åŸºæœ¬çš„ã«æ±ºã¾ã£ãŸè¨å®šæ›¸ãã ã‘ãªã®ã§æ™‚é–“ã¯ã‹ã‹ã‚Šã¾ã›ã‚“ã€‚ï¼ˆã‚‚ã¡ã‚ã‚“ã©ã†ã„ã†æ„å‘³ãªã®ã‹çŸ¥ã£ã¦ãŠãã«è¶Šã—ãŸã“ã¨ã¯ãªã„ï¼‰ SSLã®è©•ä¾¡è¨ˆæ¸¬ã«ã¤ã„ã¦ SSLã‚µãƒ¼ãƒãƒ¼ã®ãƒ†ã‚¹ãƒˆã¯Qualys SSL Reportã§ç¢ºèªã—ã¾ã™ã€‚ Nginxãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã®è¨å®šã§è¨ˆæ¸¬ã—ãŸã‚‰Cã ã£ãŸã€‚ SSLv3 ã‚’ç„¡åŠ¹ã«ã™ã‚‹ SSLv3
junichi_y 2015/08/13
nginx

HTTPS

ssl

TLS

security
ãƒªãƒ³ã‚¯
Redirecting to ssl-config.mozilla.org...
Mozilla SSL Configuration Generator Redirecting to the updated SSL Configuration Generatorâ€¦
junichi_y 2015/04/06
#configuration #Apache #Nginx #ssl #security #https #TLS #OpenSSL

configuration

Apache

Nginx

ssl

security

https

TLS

OpenSSL
ãƒªãƒ³ã‚¯
Let's Encrypt
Encryption for Everybody A nonprofit providing free TLS certificates to more than 700M700M websites. Explore our work to improve security and privacy Our 2025 Annual Report highlights the progress we've made toward a better Internet.
junichi_y 2014/11/20
èªè¨¼å±€ã¨ã—ã¦ãƒ‰ãƒ¡ã‚¤ãƒ³æ‰€æœ‰è€…ã«ç„¡æ–™ã®ã‚µãƒ¼ãƒãƒ¼è¨¼æ˜Žæ›¸ã‚’ç™ºè¡Œã€‚ç°¡å˜ã«ã‚µãƒ¼ãƒãƒ¼è¨¼æ˜Žæ›¸ã‚’å°Žå…¥ã§ãã‚‹ä»•çµ„ã¿ã‚’æä¾›ã—ã€HTTPSã®æ™®åŠã‚’ä¿ƒé€²ã™ã‚‹ã€‚ #ssl #security

ssl

security
ãƒªãƒ³ã‚¯
OpenSSL ã® Man-in-the-middle æ”»æ’ƒå¯èƒ½ãªè„†å¼±æ€§ã®å½±éŸ¿ â€“ IIJ Security Diary
OpenSSL ã« Man-in-the-middle (MITM) æ”»æ’ƒãŒå¯èƒ½ãªè„†å¼±æ€§ CVE-2014-0224 ãŒç™ºè¦‹ã•ã‚Œã€æ—¥æœ¬æ™‚é–“2014å¹´6æœˆ5æ—¥ã®å¤œã«å…¬é–‹ã•ã‚Œã¾ã—ãŸã€‚ãã®ã‚¢ãƒ‰ãƒã‚¤ã‚¶ãƒªã§ã¯åˆã‚ã›ã¦7ä»¶ã®è„†å¼±æ€§ãŒå ±å‘Šã•ã‚Œã¦ã„ã¾ã™ãŒã€æœ¬è¨˜äº‹ã§ã¯è„†å¼±æ€§ CVE-2014-0224 ã‚’å–ã‚Šä¸Šã’ã¾ã™ã€‚IIJ ã§ã‚‚æœ¬è„†å¼±æ€§ã‚’èª¿æŸ»ã—ãŸçµæžœã€MITM æ”»æ’ƒãŒå¯èƒ½ã«ãªã‚‹ã«ã¯æ¡ä»¶ãŒã‚ã‚Šã¾ã™ã€‚ã—ãŸãŒã£ã¦ã€ä¾‹ãˆã°ä½¿ç”¨ã—ã¦ã„ã‚‹ OpenSSL ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã‚„ SSL/TLS é€šä¿¡ã®åˆ©ç”¨ã®ä»•æ–¹ã«å¿œã˜ã¦ã€ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆã®ç·Šæ€¥æ€§ã‚’å€‹åˆ¥ã«æ¤œè¨Žã™ã‚‹ä½™åœ°ãŒã‚ã‚Šã¾ã™ã€‚ æ¦‚è¦ æœ¬è„†å¼±æ€§ã«ã‚ˆã‚‹ MITM æ”»æ’ƒ[1]MITM æ”»æ’ƒã¨ã¯ã€ã‚µãƒ¼ãƒã¨ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã®é–“ã«æ”»æ’ƒè€…ãŒå‰²ã‚Šè¾¼ã¿ã€é€šä¿¡å†…å®¹ã®ç›—è´ã‚„æ”¹ã–ã‚“ã‚’è¡Œã†æ”»æ’ƒã§ã™ã€‚ã§ã¯ã€ã‚µãƒ¼ãƒã¨ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã®ä¸¡æ–¹ãŒ OpenSSL ã‚’ä½¿ã£ã¦ã„ã‚‹å ´åˆã«ã€ãã®é–“ã«ã„ã‚‹æ”»æ’ƒè€…ãŒ SSL/TLS ãƒ
junichi_y 2014/06/09
OpenSSL ã® Man-in-the-middle æ”»æ’ƒå¯èƒ½ãªè„†å¼±æ€§ã®å½±éŸ¿ #OpenSSL #security #SSL #Server

OpenSSL

security

SSL

Server
ãƒªãƒ³ã‚¯
æˆ‘ã€…ã¯ã©ã®ã‚ˆã†ã«ã—ã¦å®‰å…¨ãªHTTPSé€šä¿¡ã‚’æä¾›ã™ã‚Œã°è‰¯ã„ã‹ - Qiita
Modern Ciphersuite: ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES1
junichi_y 2014/05/21
#nginx #HTTPS #SSL #web #WebServer #webservice #Server #security #OpenSSL #Apache #TLS #FS #PFS #CRL #OCSP #HSTS #AWS ELB #SPDY #BEAST #BREACH

nginx

HTTPS

SSL

web

WebServer

webservice

Server

security

OpenSSL

Apache
ãƒªãƒ³ã‚¯
ç‰¹å®šã®ã‚«ãƒ†ã‚´ãƒªã®ã¿ã«ç‰¹å®šãƒ—ãƒ©ã‚°ã‚¤ãƒ³ã‚’ä½¿ç”¨ã—ãŸã„ã€‚
é€†ã«sslã®ãƒšãƒ¼ã‚¸ã ã‘é•ã†headerã‚’èªã‚€ã¨ã‹ã˜ã‚ƒã ã‚ã£ã™ã‹ãï¼Ÿget_header(2)ã¨ã‹ï¼Ÿ sslã§è¡¨ç¤ºã—ã¦ã„ã‚‹ãƒšãƒ¼ã‚¸ã ã‘ãƒšãƒ¼ã‚¸ãƒ†ãƒ³ãƒ—ãƒ¬ãƒ¼ãƒˆã‚’èªã¾ã›ã‚Œã°å¯èƒ½ã ã¨æ€ã„ã¾ã™ã‘ã©ã€‚ ã‚ã¨ã¯ã€æ™®é€šã«IDãªã©ã§åˆ†å²ã‚’è¨ã‘ã‚‹æ–¹æ³•ã§ã™ãŒã€ã‚½ãƒ¼ã‚¹ãŒæ±šããªã‚‹ã®ã§å€‹äººçš„ã«ã¯ï½¥ï½¥ï½¥ shokun0803ã•ã‚“ã€ã‚ã‚ŠãŒã¨ã†ã”ã–ã„ã¾ã™ï¼ ã¯ã˜ã‚ã¯ãã‚Œã§ä½•ã¨ã‹ãªã‚‹ã‹ãªã¨æ€ã£ãŸã®ã§ã™ãŒâ€¦ ã¡ã‚‡ã£ã¨è£œè¶³ãŒè¶³ã‚Šãªã‹ã£ãŸã®ã§ã¤ã‘ãŸã—ã¦ãŠãã¾ã™ã€‚ æœ€åˆã«æ›¸ã„ãŸï½¢ã‚µã‚¤ãƒˆå…¨ä½“ã§ä½¿ç”¨ã—ã¦ã„ã‚‹ã©ã†ã—ã¦ã‚‚å¤–ã›ãªã„ãƒ—ãƒ©ã‚°ã‚¤ãƒ³ï½£ã¨ã„ã†ã®ãŒWordPressã‚’ECã‚µã‚¤ãƒˆã«å¤‰ãˆã‚‹Welcartã¨ã„ã†ãƒ—ãƒ©ã‚°ã‚¤ãƒ³ã§ã™ã€‚ ã“ã®ãƒ—ãƒ©ã‚°ã‚¤ãƒ³ã«ã‚ˆã£ã¦ã‚µã‚¤ãƒˆå…¨ä½“ã®ç”»åƒã‚„æƒ…å ±ã‚’å‡ºåŠ›ã—ã¦ã„ã‚‹ã‚‚ã®ãŒå¤šã„ãŸã‚ã€ã“ã®ãƒ—ãƒ©ã‚°ã‚¤ãƒ³ã¯ç§ã®ã‚µã‚¤ãƒˆã§ã¯å¿…é ˆã§ã™ã€‚ é€†ã«éžSSLã§ãƒ—ãƒ©ã‚°ã‚¤ãƒ³ã‚’ä½¿ã„ãŸã„ã‚«ãƒ†ã‚´ãƒªãƒ¼ãŒãƒ–ãƒã‚°ã¨ã„ã†ã‚«ãƒ†ã‚´ãƒªãƒ¼ã§ã€SSLã‚’é€šã•ãªã„ã®ã§ã„ã„ã®ã§è‰²ã€…ãªãƒ—ãƒ©
junichi_y 2012/05/24
ssl æŽ¥ç¶šã•ã‚ŒãŸå ´åˆ wp_head, wp_footer ã§å‡ºåŠ›ã™ã‚‹ js ã‚„ css ã®ãƒªãƒ³ã‚¯ã‚’å…¨ã¦ https ã«æ›¸ãæ›ãˆã‚‹

wordpress

functions.php

ssl

css

javascript

wp_head

wp_footer
ãƒªãƒ³ã‚¯
1