AWS ELB에 사설인증서 등록

일반적인 인터넷 서비스라면 도메인 등록 후 기관에 인증서를 발급받아 설정해야겠지만 사전 테스트와 내부통신 등 AWS ELB에 사설인증서를 등록해야 할 경우 아래와 같은 방법으로 지원할수 있습니다.


설정 환경
- 대상:  Amazon Web Service ELB
- 작업:  Amazon Linux


참고
http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/ssl-server-cert.html#upload-cert

 
사설인증서 생성을 위해 OpenSSL 유틸리티 설치
# yum install openssl


개인키 생성
# openssl genrsa -des3 -out sample.pem 1024  <-- des3 암호화 사용하여 1024 비트 키 생성
Enter pass phrase for sample.pem:  <-- 적당한 패스워드 입력


CSR(Certificate Singing Request) 생성
# openssl req -new -key sample.pem -out sample.csr
Country Name (2 letter code) [XX]:US
State or Province Name (full name) []:California
Locality Name (eg, city) [Default City]:
Organization Name (eg, company) [Default Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:www.sample.com 
Email Address []:admin@sample.com
A challenge password []:
An optional company name []:


사설 인증서 생성
# openssl x509 -req -signkey sample.pem -in sample.csr -out sample.crt


ELB 등록을 위해 Passphrase 제거
# openssl rsa -in sample.pem -out temp.pem


Private Key 확인
# cat temp.pem
-----BEGIN RSA PRIVATE KEY-----
MIICXQIBAAKBgQDAJRdwc+oAoj4wYVTopo4iL32lbL6JnM3KS2U9zp+d3XhZqxB/
IDVKHtYq466bz/NCTCkbvHW2lxRZv9K5eLu4uU/uN5kG3QX2wZS81XdSdkfeUpNy
x3lgeefzcqWOTPbmLq69Khc94YLxUUiIlRGQLUUkVdjtIQSvZm4oqEYmgQIDAQAB
AoGBAKKrBDP8vh+5O0MEM7kewHfqksnIzWp9aK+ZsuVnlzQz+h6Xt0iYwOS2RIRc
60cX/w6ioa7Mly90qhLtVf4VW34n25ORPRT1WgUz2u/EYrXylUKoK9LaJ8sZkmpK
d/+XiOnDAtBOKPVux5OC/dQTvxDFVKfr9EZP4EC6CwxdDsQBAkEA8d7KMw54Al1M
zKWBXdnvIn/eBG2I07rXundCRD/yXRSsVEEblEKu8ObtL/bqsqVl1KSY+PU7oUBG
76oMBxanYQJBAMtepnwbKlEvHTJ/sc+XxD5X8aBFW70ceXzPsOCTTmCe12UXRgw4
ar+owQ2uEVHzvKjlNrmWwzF0ksqoySNqcyECQHQd+EbQsG66Kg+peVT8NqECcC0C
BQlZDw53CLpJVOq47Q65/yqLZP9EbiRzzzMa0qtmpgYHfawpdqTCp2mTx6ECQEQN
NhSNWom0BEcjp7JZjJd4AiipTNtpLdXwAbYEVNPMEzOGqC/qqP3dUExtlOohb13s
5XUQ19wyr/QUqsmpE0ECQQDhMC1qfmRbi/8TkesdZGuYyvH0yMxPhBrAi36bZ3CJ
M6o8LLujGxHDRKGnHhETN81QBlaDb4D36iPi7Ni7sP8m
-----END RSA PRIVATE KEY-----


Certificate Key 확인
# cat sample.crt
-----BEGIN CERTIFICATE-----
MIICmzCCAgQCCQCUgu8wzkwMMzANBgkqhkiG9w0BAQUFADCBkTELMAkGA1UEBhMC
VVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFTATBgNVBAcMDERlZmF1bHQgQ2l0eTEc
MBoGA1UECgwTRGVmYXVsdCBDb21wYW55IEx0ZDEXMBUGA1UEAwwOd3d3LnNhbXBs
ZS5jb20xHzAdBgkqhkiG9w0BCQEWEGFkbWluQHNhbXBsZS5jb20wHhcNMTQwNzA4
MDI0NzIwWhcNMTQwODA3MDI0NzIwWjCBkTELMAkGA1UEBhMCVVMxEzARBgNVBAgM
CkNhbGlmb3JuaWExFTATBgNVBAcMDERlZmF1bHQgQ2l0eTEcMBoGA1UECgwTRGVm
YXVsdCBDb21wYW55IEx0ZDEXMBUGA1UEAwwOd3d3LnNhbXBsZS5jb20xHzAdBgkq
hkiG9w0BCQEWEGFkbWluQHNhbXBsZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0A
MIGJAoGBAMAlF3Bz6gCiPjBhVOimjiIvfaVsvomczcpLZT3On53deFmrEH8gNUoe
1irjrpvP80JMKRu8dbaXFFm/0rl4u7i5T+43mQbdBfbBlLzVd1J2R95Sk3LHeWB5
5/NypY5M9uYurr0qFz3hgvFRSIiVEZAtRSRV2O0hBK9mbiioRiaBAgMBAAEwDQYJ
KoZIhvcNAQEFBQADgYEAGZLKdvCRZ6RE8zZP8wjjwgpk5Yv4Dyzrni5a6BSpefMk
+Z359FF3ef9jovw1my9QqwEE4TcXRe+4QdZXoZ0ULD6/kSmfSi8zlCLSz1+Op2Ur
MjhRVNTifO6DFnyaTcDndrGy+3qtCmtkZvLdAtqUXhVp4yZ59gmnxp/1rhsYds8=
-----END CERTIFICATE-----


ELB에 인증서 등록
 

위와 같이 Private Key에는 Passphrase를 제거한 temp.pem 내용을, Public Key Certificate에는 사설인증서인 sample.crt 파일의 내용을 등록합니다.