【サーバー認証編】 RockyLinux8にてApache を使ってhttps通信できる環境を作る

[root@infrastudy ~]# yum -y install mod_ssl

[root@infrastudy ~]# openssl genrsa > server.key

Generating RSA private key, 2048 bit long modulus (2 primes)
..............+++++
.......+++++
e is 65537 (0x010001)

[root@infrastudy ~]# openssl req -new -key server.key > server.csr

Country Name (2 letter code) [XX]:JP
State or Province Name (full name) []:Osaka
Locality Name (eg, city) [Default City]:osaka
Organization Name (eg, company) [Default Company Ltd]:hoge
Organizational Unit Name (eg, section) []:hogehoge
Common Name (eg, your name or your server's hostname) []:www.example.com
Email Address []:hoge@gmail.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:hogehoge 
An optional company name []:hoge

[root@infrastudy ~]# openssl x509 -req -signkey server.key < server.csr > server.crt

Signature ok
subject=C = JP, ST = Osaka, L = osaka, O = hoge, OU = hogehoge, CN = www.example.com, emailAddress = hoge@gmail.com
Getting Private key

[root@infrastudy ~]# mkdir /etc/httpd/conf/keys
[root@infrastudy ~]# mkdir /etc/httpd/conf/crt
[root@infrastudy ~]# mv server.key /etc/httpd/conf/keys/
[root@infrastudy ~]# mv server.crt /etc/httpd/conf/crt/

#   pass phrase.  Note that restarting httpd will prompt again.  Keep
#   in mind that if you have both an RSA and a DSA certificate you
#   can configure both in parallel (to also allow the use of DSA
#   ciphers, etc.)
#   Some ECC cipher suites (http://www.ietf.org/rfc/rfc4492.txt)
#   require an ECC certificate which can also be configured in
#   parallel.
SSLCertificateFile /etc/httpd/conf/crt/server.crt 

#   Server Private Key:
#   If the key is not combined with the certificate, use this
#   directive to point at the key file.  Keep in mind that if
#   you've both a RSA and a DSA private key you can configure
#   both in parallel (to also allow the use of DSA ciphers, etc.)
#   ECC keys, when in use, can also be configured in parallel
SSLCertificateKeyFile /etc/httpd/conf/keys/server.key

SSLProtocol +TLSv1.1 +TLSv1.2

SSLProtocol -SSLv2 -SSLv3

SSLCipherSuite HIGH:!aNULL:!MD5

[root@infrastudy ~]# openssl ciphers -v

TLS_AES_256_GCM_SHA384  TLSv1.3 Kx=any      Au=any  Enc=AESGCM(256) Mac=AEAD
TLS_CHACHA20_POLY1305_SHA256 TLSv1.3 Kx=any      Au=any  Enc=CHACHA20/POLY1305(256) Mac=AEAD
TLS_AES_128_GCM_SHA256  TLSv1.3 Kx=any      Au=any  Enc=AESGCM(128) Mac=AEAD
TLS_AES_128_CCM_SHA256  TLSv1.3 Kx=any      Au=any  Enc=AESCCM(128) Mac=AEAD
ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESGCM(256) Mac=AEAD
ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AESGCM(256) Mac=AEAD
ECDHE-ECDSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=CHACHA20/POLY1305(256) Mac=AEAD