#---------------------------------------
# LOCATION リバースプロキシ
#---------------------------------------
# vi /etc/httpd/conf.d/wsgi.conf
<Proxy *>
Require all granted
#Order Deny,Allow
#Deny from all
#Allow from 192.168.25.146
</Proxy>
ProxyRequests Off
ProxyPreserveHost On
<Location /office>
proxyPass http://192.168.25.146:80/office/ keepalive=On
ProxyPassReverse http://192.168.25.146:80/office/
</Location>
#----------------------------------
# VirtualHost ( 仮想ホスト )
#----------------------------------
インターフェースに複数IPを割り当てる
VLAN=global_network
VLAN_IP_1=192.168.1.241/24
VLAN_IP_1=192.168.1.242/24
VLAN_IP_1=192.168.1.243/24
VLAN_IP_1=192.168.1.244/24
VLAN_GW=192.168.1.1
nmcli c delete $VLAN
nmcli c add type ethernet ifname $DEVICE con-name "$VLAN"
nmcli c mod $VLAN ipv4.addresses $VLAN_IP_1
nmcli c mod $VLAN +ipv4.addresses $VLAN_IP_2
nmcli c mod $VLAN +ipv4.addresses $VLAN_IP_3
nmcli c mod $VLAN +ipv4.addresses $VLAN_IP_4
nmcli c mod $VLAN ipv4.method manual
nmcli c mod $VLAN connection.autoconnect yes
nmcli c mod $VLAN ipv4.gateway $VLAN_GW
nmcli c up $VLAN
# dnf install httpd mod_ssl
# vi /etc/httpd/conf.d/httpd-vhost.conf
#-------------------------------------------
# Link Server
#-------------------------------------------
<VirtualHost *:80>
ServerName link.mydomain.example
RewriteEngine on
RewriteRule (.*)?$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</VirtualHost>
<VirtualHost *:443>
ServerName link.mydomain.example
<Proxy *>
Require all granted
</Proxy>
ProxyRequests Off
ProxyPreserveHost On
# LogLevel warn
# TransferLog logs/ssl_access_log
ProxyPass / http://10.0.1.101:80/ keepalive=On
ProxyPassReverse / http://10.0.1.101:80/
RequestHeader set X-Forwarded-Proto "https"
SSLEngine on
# SSLv2、SSLv3, TLS1.0 TLS1.1を無効化する
SSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite ECDSA+AESGCM
# SSLCipherSuite PROFILE=SYSTEM
SSLHonorCipherOrder Off
SSLCertificateFile /etc/ssl/certs/ssl-cert-link.crt
SSLCertificateKeyFile /etc/ssl/private/ssl-cert-link.key
</VirtualHost>
# cd /etc/ssl
# ln -s ../pki/tls/private private
# apachectl configtest
# firewall-cmd --add-service=https --permanent
# firewall-cmd --reload
※ 下記は、httpdを起動すると勝手につくられる。
/etc/pki/tls/certs/localhost.crt
/etc/pki/tls/private/localhost.key
※ ssl.conf内の<VirtualHost _default_:443>は、マッチしなかった場合のデフォルト
【自己証明書】
# cd ~/Cert
# openssl version
OpenSSL 1.1.1k FIPS 25 Mar 2021
# openssl genrsa -out ssl-cert-link.key 2048
# openssl req -new -key ssl-cert-link.key -out ssl-cert-link.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:JP
State or Province Name (full name) []:Tokyo
Locality Name (eg, city) [Default City]:
Organization Name (eg, company) [Default Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:link.mydomain.example
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
# openssl x509 -days 3650 -req -signkey ssl-cert-link.key -in ssl-cert-link.csr -out ssl-cert-link.crt
# cp ssl-cert-link.crt /etc/ssl/certs/
# cp ssl-cert-link.key /etc/ssl/private/
※確認方法
# openssl req -noout -text -in ssl-cert-link.csr
# openssl x509 -text -fingerprint -noout -in ssl-cert-service.crt
URL: https://link.mydomain.example/test
URL: https://service.mydomain.example/test
URL: https://office.mydomain.example/test
※ key : RSA PRIVATE KEY(鍵）
csr: CERTIFICATE REQUES(証明書の署名リクエスト)
crt: CERTIFICATE( サーバ証明書）
pem: BEGIN/END行で挟んだ書式(入れ物）
