opensslでwebサーバを起動して、証明書の確認

概要

証明書が使えるものかどうかをWebブラウザで確認するときに、 apacheの再起動とかをしなくても、opensslコマンド一つでできるので、そのメモ。

サーバ側

letsencrypt(certbot)で調達した証明書を利用します。 8443番ポートでサーバを起動します。

$ cd /etc/letsencrypt/live/blog.monophile.net/
$ openssl s_server -www -accept 8443 -key privkey.pem -cert cert.pem -CAfile chain.pem

クライアント側

クライアントは https://blog.monophile.net:8443/ を開くだけ。

$ curl -s -v https://blog.monophile.net:8443/ > /dev/null

↓がその出力。

*   Trying 49.212.208.99...
* TCP_NODELAY set
* Connected to blog.monophile.net (49.212.208.99) port 8443 (#0)
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /opt/local/share/curl/curl-ca-bundle.crt
  CApath: none
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
} [5 bytes data]
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
} [512 bytes data]
* TLSv1.2 (IN), TLS handshake, Server hello (2):
{ [94 bytes data]
* TLSv1.2 (IN), TLS handshake, Certificate (11):
{ [3328 bytes data]
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
{ [333 bytes data]
* TLSv1.2 (IN), TLS handshake, Server finished (14):
{ [4 bytes data]
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
} [70 bytes data]
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
} [1 bytes data]
* TLSv1.2 (OUT), TLS handshake, Finished (20):
} [16 bytes data]
* TLSv1.2 (IN), TLS change cipher, Client hello (1):
{ [1 bytes data]
* TLSv1.2 (IN), TLS handshake, Finished (20):
{ [16 bytes data]
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server did not agree to a protocol
* Server certificate:
*  subject: CN=blog.monophile.net
*  start date: Feb  4 08:31:00 2017 GMT
*  expire date: May  5 08:31:00 2017 GMT
*  subjectAltName: host "blog.monophile.net" matched cert's "blog.monophile.net"
*  issuer: C=US; O=Let's Encrypt; CN=Let's Encrypt Authority X3
*  SSL certificate verify ok.
} [5 bytes data]
> GET / HTTP/1.1
> Host: blog.monophile.net:8443
> User-Agent: curl/7.52.1
> Accept: */*
>
{ [5 bytes data]
* HTTP 1.0, assume close after body
< HTTP/1.0 200 ok
< Content-type: text/html
<
{ [7659 bytes data]
* Curl_http_done: called premature == 0
* Closing connection 0
} [5 bytes data]
* TLSv1.2 (OUT), TLS alert, Client hello (1):
} [2 bytes data]