SSL 簽證的部份已經搞定了，剩下 DNS解析的部份。需要 Linux環境（cygwin或 原生 Linux）跟OpenSSL 套件。 在cygwin裡面建議安裝apt-cyg 工具，就可以利用類似Debian/Ubuntu/Cydia 裡 面的apt 指令直接安裝套件，不用再跳出來執行setup.exe 。以下指令中 $是提 示字元。 指令： $ wget http://apt-cyg.googlecode.com/svn/trunk/apt-cyg $ chmod +x apt-cyg $ mv apt-cyg /usr/bin 然後安裝OpenSSL 指令： $ apt-cyg install openssl 靜待執行結束 Step 1-1. 生出最高層認證中心 Root CA 指令：（以cygwin為例， Linux的路徑是/etc/ssl） $ cd /usr/ssl //進入 ssl程式工作目錄 $ openssl rand -out /usr/ssl/private/.rand 1024 //製作亂數檔 $ vi /usr/ssl/openssl.cnf //進入編輯器 //找到 dir = ./demoCA //改成 dir = /usr/ssl 不會用vi的人可以用其他編輯器，但請存成Unix換行格式 Step 1-2. 生出最高層認證中心的私鑰(rootca.key) 指令： $ openssl genrsa -des3 -out rootca.key 2048 //產生最高層的私鑰 Generating RSA private key, 2048 bit long modulus ............................................................................. ..............+++ ............................................................................. ...+++ e is 65537 (0x10001) Enter pass phrase for rootca.key: //設定密碼 Verifying - Enter pass phrase for rootca.key: //重新確認密碼 Step 1-3. 填寫憑證申請書(rootca.req) $ openssl req -new -key rootca.key -out rootca.req Enter pass phrase for rootca.key: //輸入剛剛設定的密碼 You are about to be asked to enter information that will be incorporated \\ into your certificate request. What you are about to enter is what is called a Distinguished Name or \\ a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:TW //輸入基本資料 State or Province Name (full name) [Some-State]:Taiwan R.O.C Locality Name (eg, city) []:Taipei Organization Name (eg, company) [Internet Widgits Pty Ltd]:NTU Organizational Unit Name (eg, section) []:ptt Common Name (eg, YOUR name) []:Modchip Email Address []:[email protected] Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: //直接按Enter 跳過 An optional company name []: //直接按Enter 跳過 Step 1-4. 把憑證(rootca.crt)簽出來 指令： $ openssl x509 -req -days 7305 -sha1 -extfile /usr/ssl/openssl.cnf \\ -extensions v3_ca -signkey rootca.key -in rootca.req -out rootca.crt Signature ok subject=/C=TW/ST=Taiwan R.O.C/L=Taipei/O=NTU/OU=ptt/CN=Modichip/ [email protected] Getting Private key Enter pass phrase for rootca.key: //輸入最高層密碼 Step 2-1.製作 PSN伺服器的私鑰(auth.np.ac.playstation.net.key) 指令： $ openssl genrsa -out auth.np.ac.playstation.net.key 2048 Generating RSA private key, 2048 bit long modulus ............................................................................. .......................+++ ........................................................................+++ e is 65537 (0x10001) Step 2-2. 填寫 PSN伺服器的憑證申請書(auth.np.ac.playstation.net.req) 指令： $ openssl req -new -key auth.np.ac.playstation.net.key -out \\ auth.np.ac.playstation.net.req You are about to be asked to enter information that will be \\ incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or \\ a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:TW State or Province Name (full name) [Some-State]:Taiwan R.O.C Locality Name (eg, city) []:Taipei Organization Name (eg, company) [Internet Widgits Pty Ltd]:NTU Organizational Unit Name (eg, section) []:ptt Common Name (eg, YOUR name) []:Modchip Email Address []:[email protected] Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: //直接按Enter跳過 An optional company name []: //一樣按Enter跳過 Step 2-3. 用最高層認證中心簽憑證給(auth.np.ac.playstation.net) $ openssl x509 -req -days 3650 -sha1 -extfile /usr/ssl/openssl.cnf \\ -extensions v3_req -CA rootca.crt -CAkey rootca.key -CAserial \\ rootca.srl -CAcreateserial -in auth.np.ac.playstation.net.req -out \\ auth.np.ac.playstation.net.crt Signature ok subject=/C=TW/ST=Taiwan R.O.C/L=Taipei/O=NTU/OU=ptt/CN=Modchip/\\ [email protected] Getting CA Private Key Enter pass phrase for rootca.key: //輸入最高層密碼 這樣就可以得到rootca.crt跟auth.np.ac.playstation.net.crt，應該就是原文 所提到，自己製作的CA SSL憑證。 ****** 參考資訊：http://www.tc.umn.edu/~brams006/selfsign.html -- ○ ____ _ _ _ _ ____ _ _ ____ _____ ____ 。 ★(_ _)( \( )( \/ )( ___)( \( )(_ _)( _ )( _ \ ｏ _)(_ ) ( \ / )__) ) ( )( )(_)( ) / ● ‧ (____)(_)\_) \/ (____)(_)\_) (__) (_____)(_)\_) ★ ｏ --

※ 發信站: 批踢踢實業坊(ptt.cc) ◆ From: 140.120.31.133 ※ 編輯: cassine 來自: 140.120.31.133 (02/12 13:59)