- \n
- openxpki<\/a><\/li>\n
- OpenXPKI\/\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb<\/a><\/li>\n<\/ul>\n
Environment<\/h2>\n
Debian<\/p>\n
$ cat \/etc\/os-release\r\nPRETTY_NAME=\"Debian GNU\/Linux 10 (buster)\"\r\nNAME=\"Debian GNU\/Linux\"\r\nVERSION_ID=\"10\"\r\nVERSION=\"10 (buster)\"\r\nVERSION_CODENAME=buster\r\nID=debian\r\nHOME_URL=\"https:\/\/www.debian.org\/\"\r\nSUPPORT_URL=\"https:\/\/www.debian.org\/support\"\r\nBUG_REPORT_URL=\"https:\/\/bugs.debian.org\/\"\r\n$ uname -a\r\nLinux svr-xpki 4.19.0-17-amd64 #1 SMP Debian 4.19.194-3 (2021-07-18) x86_64 GNU\/Linux\r\n$ \r\n<\/pre>\n
OpenXPKI<\/p>\n
# openxpkiadm version \r\nVersion (core): 3.12.0 \r\n#\r\n<\/pre>\n
Installation<\/h2>\n
$ su -\r\nPassword: \r\n# \r\n# apt install gpg\r\n<\/pre>\n
# wget https:\/\/packages.openxpki.org\/v3\/debian\/Release.key -O - | apt-key add -\r\n--2021-08-08 11:11:51-- https:\/\/packages.openxpki.org\/v3\/debian\/Release.key\r\nResolving packages.openxpki.org (packages.openxpki.org)... 82.135.58.89\r\nConnecting to packages.openxpki.org (packages.openxpki.org)|82.135.58.89|:443... connected.\r\nHTTP request sent, awaiting response... 200 OK\r\nLength: 2493 (2.4K) [application\/pgp-keys]\r\nSaving to: \u2018STDOUT\u2019\r\n\r\n- 100%[==========================>] 2.43K --.-KB\/s in 0s \r\n\r\n2021-08-08 11:11:52 (251 MB\/s) - written to stdout [2493\/2493]\r\n\r\nOK\r\n# \r\n<\/pre>\n
# echo \"deb http:\/\/packages.openxpki.org\/v3\/debian\/ buster release\" > \/etc\/apt\/sources.list.d\/openxpki.list\r\n# apt update\r\nHit:1 http:\/\/security.debian.org\/debian-security buster\/updates InRelease\r\nHit:2 http:\/\/ftp.riken.jp\/Linux\/debian\/debian buster InRelease\r\nHit:3 http:\/\/ftp.riken.jp\/Linux\/debian\/debian buster-updates InRelease\r\nGet:4 http:\/\/packages.openxpki.org\/v3\/debian buster InRelease [1,708 B]\r\nGet:5 http:\/\/packages.openxpki.org\/v3\/debian buster\/release amd64 Packages [10.1 kB]\r\nFetched 11.8 kB in 1s (8,598 B\/s)\r\nReading package lists... Done\r\nBuilding dependency tree \r\nReading state information... Done\r\nAll packages are up to date.\r\n# \r\n<\/pre>\n
# apt install default-mysql-server libdbd-mysql-perl\r\n<\/pre>\n
# apt install apache2 libapache2-mod-fcgid\r\n<\/pre>\n
# a2enmod fcgid\r\nModule fcgid already enabled\r\n# \r\n# a2enmod rewrite\r\nEnabling module rewrite.\r\nTo activate the new configuration, you need to run:\r\n systemctl restart apache2\r\n#\r\n<\/pre>\n
# apt install libopenxpki-perl openxpki-cgi-session-driver openxpki-i18n\r\n<\/pre>\n
# openxpkiadm version\r\nVersion (core): 3.12.0\r\n# \r\n<\/pre>\n
# systemctl status apache2\r\n\u25cf apache2.service - The Apache HTTP Server\r\n Loaded: loaded (\/lib\/systemd\/system\/apache2.service; enabled; vendor preset: enabled)\r\n Active: active (running) since Sun 2021-08-08 12:19:18 JST; 2s ago\r\n Docs: https:\/\/httpd.apache.org\/docs\/2.4\/\r\n Process: 595 ExecStart=\/usr\/sbin\/apachectl start (code=exited, status=0\/SUCCESS)\r\n Main PID: 599 (apache2)\r\n Tasks: 56 (limit: 2359)\r\n Memory: 10.5M\r\n CGroup: \/system.slice\/apache2.service\r\n \u251c\u2500599 \/usr\/sbin\/apache2 -k start\r\n \u251c\u2500600 \/usr\/sbin\/apache2 -k start\r\n \u251c\u2500601 \/usr\/sbin\/apache2 -k start\r\n \u2514\u2500602 \/usr\/sbin\/apache2 -k start\r\n\r\nAug 08 12:19:18 svr-xpki systemd[1]: Starting The Apache HTTP Server...\r\nAug 08 12:19:18 svr-xpki systemd[1]: Started The Apache HTTP Server.\r\n# \r\n<\/pre>\n
# mysql -u root -p\r\nEnter password: \r\nWelcome to the MariaDB monitor. Commands end with ; or \\g.\r\nYour MariaDB connection id is 36\r\nServer version: 10.3.29-MariaDB-0+deb10u1 Debian 10\r\n\r\nCopyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.\r\n\r\nType 'help;' or '\\h' for help. Type '\\c' to clear the current input statement.\r\n\r\nMariaDB [(none)]> CREATE DATABASE openxpki CHARSET utf8;\r\nQuery OK, 1 row affected (0.000 sec)\r\n\r\nMariaDB [(none)]> CREATE USER 'openxpki'@'localhost' IDENTIFIED BY 'openxpki';\r\nQuery OK, 0 rows affected (0.023 sec)\r\n\r\nMariaDB [(none)]> GRANT ALL ON openxpki.* TO 'openxpki'@'localhost';\r\nQuery OK, 0 rows affected (0.001 sec)\r\n\r\nMariaDB [(none)]> flush privileges;\r\nQuery OK, 0 rows affected (0.001 sec)\r\n\r\nMariaDB [(none)]> quit\r\nBye\r\n# \r\n<\/pre>\n
# cat \/etc\/openxpki\/config.d\/system\/database.yaml\r\nmain:\r\ndebug: 0\r\ntype: MariaDB\r\nname: openxpki\r\nhost: localhost\r\nport: 3306\r\nuser: openxpki\r\npasswd: openxpki\r\n\r\n# extra options passed to the driver as parameter\r\n#driver:\r\n# LongReadLen: 10000000\r\n\r\n# How often to try to connect to the database on startup if not avail -\r\n# default is to fail immediately. This is mainly useful if database and\r\n# OpenXPKI are started by the same init process and the DB might take\r\n# some time to come up\r\n#wait_on_init:\r\n# retry_count: 10\r\n# retry_interval: 30\r\n\r\n# To log to a different database create a section \"log\" by copying and adjusting\r\n# the upper block, e.g.:\r\n#\r\n# log:\r\n# debug: 0\r\n# ...\r\n\r\n# Set environment values, e.g. locales for Oracle\r\n# this was inside the db section prior v2.2 which does not work as expected\r\n# environment:\r\n# key: value\r\n#\r\n<\/pre>\n
# zcat \/usr\/share\/doc\/libopenxpki-perl\/examples\/schema-mariadb.sql.gz | mysql -u root --password --database openxpki\r\nEnter password: \r\n# \r\n<\/pre>\n
# zcat \/usr\/share\/doc\/libopenxpki-perl\/examples\/sampleconfig.sh.gz | bash\r\nFully automated sample setup using tmpdir \/tmp\/tmp.vZfefwnrHM\r\ncreating configuration for openssl () .. done.\r\nCreating certificates .. \r\nDid not find a root ca certificate file.\r\nCreating an own self signed root ca .. done.\r\nDid not find existing issuing CA key file.\r\nCreating an issuing CA request .. done.\r\nSigning issuing certificate with own root CA .. done.\r\nDid not find existing DataVault certificate file.\r\nCreating a self signed DataVault certificate .. done.\r\nDid not find existing SCEP certificate file.\r\nCreating a SCEP request .. done.\r\nSigning SCEP certificate with Issuing CA .. done.\r\nDid not find existing WEB certificate file.\r\nCreating a Web request .. done.\r\nSigning Web certificate with Issuing CA .. done.\r\nStarting server before running import ... Starting OpenXPKI Community Edition v3.12.0\r\nOpenXPKI Server is running and accepting requests.\r\nDONE.\r\nSuccessfully imported certificate into database:\r\n Subject: CN=OpenXPKI Root CA 20210808\r\n Issuer: CN=OpenXPKI Root CA 20210808\r\n Identifier: P_rRjE1RFjWM1ynUNugx4fuubHc\r\n Realm: none\r\nSuccessfully wrote key to \/etc\/openxpki\/local\/keys\/vault-1.pem\r\nSuccessfully wrote alias:\r\n Alias : vault-1\r\n Identifier: TGo7gL63_SWki2XF5O51-NcZrtA\r\n NotBefore : 2021-08-08 04:52:32\r\n NotAfter : 2031-08-11 04:52:32\r\n\r\nSuccessfully wrote key to datapool with key 'ca-signer-1'\r\nSuccessfully wrote alias:\r\n Alias : ca-signer-1\r\n Identifier: E3MmGW2q8kY26H_UB99HePxocII\r\n NotBefore : 2021-08-08 04:52:32\r\n NotAfter : 2026-08-10 04:52:32\r\n\r\n\r\nToken is certsign, looking for root...\r\nCreating alias for root ca:\r\n Alias : root-1\r\n Identifier: P_rRjE1RFjWM1ynUNugx4fuubHc\r\n NotBefore : 2021-08-08 04:52:32\r\n NotAfter : 2031-08-11 04:52:32\r\n\r\nSuccessfully wrote key to datapool with key 'scep-1'\r\nSuccessfully wrote alias:\r\n Alias : scep-1\r\n Identifier: bkbjKysQc3iPJdTiL4U1yJ7TWzw\r\n NotBefore : 2021-08-08 04:52:33\r\n NotAfter : 2022-08-08 04:52:33\r\n\r\ndone.\r\n\r\nConsidering dependency setenvif for ssl:\r\nModule setenvif already enabled\r\nConsidering dependency mime for ssl:\r\nModule mime already enabled\r\nConsidering dependency socache_shmcb for ssl:\r\nEnabling module socache_shmcb.\r\nEnabling module ssl.\r\nSee \/usr\/share\/doc\/apache2\/README.Debian.gz on how to configure SSL and create self-signed certificates.\r\nModule rewrite already enabled\r\nModule headers already enabled\r\nTo activate the new configuration, you need to run:\r\n systemctl restart apache2\r\nSite openxpki already enabled\r\nSite 000-default disabled.\r\nSite default-ssl already disabled\r\nTo activate the new configuration, you need to run:\r\n systemctl reload apache2\r\nDoing \/etc\/openxpki\/tls\/chain\/\r\nDoing \/etc\/ssl\/certs\r\nOpenXPKI configuration should be and server should be running...\r\n\r\nThanks for using OpenXPKI - Have a nice day ;)\r\n\r\n# \r\n<\/pre>\n
Verify (Web Access)<\/h2>\n
https:\/\/FQDN or IP Address\/ \u3078\u30a2\u30af\u30bb\u30b9\u3059\u308b\u3002<\/p>\n
![\"\"](\"https:\/\/rlab.cavtime.net\/wp-content\/uploads\/2021\/08\/OpenXPKI.png\")
<\/p>\n","protected":false},"excerpt":{"rendered":"Overview Debian \u306b OpenXPKI \u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3059\u308b\u3002 Absolute Debian \u306b OpenXPKI \u306e Smaple \u30c7\u30fc\u30bf\u3092\u7528\u3044\u3066 Private PKI \u74b0\u5883\u3092\u69cb\u7bc9\u3059\u308b\u3002 \u72ec\u81ea\u306e Dom […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[44],"tags":[],"class_list":["post-807","post","type-post","status-publish","format-standard","hentry","category-ca"],"_links":{"self":[{"href":"https:\/\/rlab.cavtime.net\/index.php?rest_route=\/wp\/v2\/posts\/807","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rlab.cavtime.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rlab.cavtime.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rlab.cavtime.net\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/rlab.cavtime.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=807"}],"version-history":[{"count":10,"href":"https:\/\/rlab.cavtime.net\/index.php?rest_route=\/wp\/v2\/posts\/807\/revisions"}],"predecessor-version":[{"id":821,"href":"https:\/\/rlab.cavtime.net\/index.php?rest_route=\/wp\/v2\/posts\/807\/revisions\/821"}],"wp:attachment":[{"href":"https:\/\/rlab.cavtime.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=807"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rlab.cavtime.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=807"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rlab.cavtime.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=807"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
- OpenXPKI\/\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb<\/a><\/li>\n<\/ul>\n