Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Acmesmith (http2study8)

Acmesmith (http2study8)

Sorah Fukumori

May 30, 2016
Tweet

More Decks by Sorah Fukumori

Other Decks in Technology

Transcript

  1. ACME protorol • Automated Certificate Management Environment • Let’s encrypt

    https://letsencrypt.org/ ͷͨΊʹ࡞ΒΕͨ API ࢓༷ • https://letsencrypt.org/how-it-works/
 https://github.com/letsencrypt/acme-spec • HTTP/DNS/TLS-SNIΛ௨ͨ͠ॴ༗֬ೝɺূ໌ॻͷൃߦΛࣗಈԽ
  2. ACME client • ࣮ࡍʹ ACME server ͱ΍ΓͱΓͯ͠ TLS ূ໌ॻΛऔಘͯ͘͠ΕΔΫ ϥΠΞϯτ

    • ެࣜ https://github.com/certbot/certbot (چ letsencrypt) • https://github.com/certbot/certbot/wiki/Links
  3. ৴༻Ͱ͖ͳ͍໰୊ • Manual installation ͷ৔߹ͩͱಥવ sudo apt-get install (΍ Gentoo

    ͳΒ sudo emerge) Λୟ͖ग़͢໰୊ • sudo -k ͠ͱ͚͹େৎ෉! • ͍ͯ͏͔ help ୟ͍͚ͨͩͳΜͰ͚͢Ͳ… • ϚδͰ…?
  4. ͓અհͳ໰୊ • Θͨ͠͸αʔόʔΛϓϩϏδϣχϯάπʔϧΛ࢖ͬͯ៉ྷʹͱͱͷ͑ ͍ͯΔ • ͦΕͳΓʹϚτϞͳ nginx ౳Ͱͷ TLS ͷઃఆ΋Ͱ͖Δ͠ɺπʔϧͭ

    ͔ͬͯ៉ྷʹ؅ཧͯ͠Δ • উखʹαʔόʔͷઃఆΛ࿔Βͳ͍Ͱ΄͍͠ɻ͓અհͰ͋Δɻ • ͦ͏͍͏Ϟʔυ΋͋Δ͚ͲɺͳΜ͔͜͏͍͏ڍಈͯ͠Δ࣌఺Ͱ৴ ༻͕ͳΒͳ͍
  5. sorah/acmesmith • ACME client designed to work on multiple servers

    • ACME registration, domain authorization, certificate requests • Tested against Let's encrypt • Storing keys in several ways (Currently AWS S3 is supported) • Challenge responses (Currently dns-01 with AWS Route 53 is supported)
  6. sorah/acmesmith • Ruby ੡ • ࣗಈߋ৽ (ࢦఆ೔਺ະຬͷূ໌ॻΛ୳͖ͯͯ͠ request ͠ͳ͓͢); Ͳ

    ͔͜1ՕॴͰcronͰճͤ͹ok • (ಉࠝͯ͠Δ S3 plugin) ͸γϯϓϧͳߏ଄Ͱূ໌ॻ΍ΩʔΛอଘ͢Δ ͷͰɺαʔόʔ্Ͱ͸ aws-cli ͳͲͰ伴ɾূ໌ॻΛऔಘ͢Ε͹ OK
  7. sorah/acmesmith • ϓϥΨϒϧͳػߏͰ challenge responder ΍ storage Λ௥ՃͰ͖Δ • ͓અհ͸͠ͳ͍

    • Θͨ͠ͷधཁʹ߹Θͤͯ࡞ͬͨͷͰݱঢ় AWS S3 + Route53 ͷΈ • (ݱঢ় OpenStack ͷ Designate (DNSaaS) ޲͚ͷ gem ͕͋Γ·͢)
  8. Acmesmith (S3+Route53) • acmesmith register CONTACT • acmesmith authorize test.example.org

    • acmesmith request test.example.org • acmesmith show-certificate test.example.org
  9. ิ଍: Identifier Validation Challenges • ACME ϓϩτίϧʹ͓͍ͯυϝΠϯͷॴ༗ऀ֬ೝΛ͢ΔͨΊͷϑϩʔ • http-01: ࢦఆ͞Εͨύεʹࢦఆ͞ΕͨจࣈྻΛ

    account key Ͱॺ໊ɺ഑ஔͯ͠ೝূ • tls-sni-02: SNI Ͱܨ͍ͩ࣌ʹฦ͢ূ໌ॻͷ SAN ʹ *.acme.invalid ͷܗͰࢦఆ͞Εͨจࣈྻʹ ॺ໊ͨ͠σʔλΛؚ·ͤͯೝূ • dns-01: ࢦఆ͞ΕͨจࣈྻΛॺ໊ͯ͠σʔλΛυϝΠϯͷԼʹTXTϨίʔυͱͯ͠ઃఆͯ͠ೝ ূ • oob-01: out of band, ࣗಈԽ͞Ε͍ͯͳ͍ೝূ༻ • Acmesmith ͸ݱঢ় out of the box Ͱ͸ Route 53 + dns-01 ʹରԠ
  10. sorah/acmesmith • ·ͩग़དྷ͍ͯͳ͍ࣄ • post issuance hook (ൃߦޙࣗಈͰαʔόʔʹ഑ஔ͍ͨ͠) • AWS

    S3, Route53 Ҏ֎΁ͷରԠ (୭͔΍ͬͯ͘Εʙ) • ϓϥάΠϯճΓͷυΩϡϝϯςʔγϣϯ