Translated from 日本語 • View original Good morning. This is Infra Miyashita.
Recently, OpenSSL vulnerabilities have been frequently discussed. Therefore, this time I will introduce the setting to terminate SSL using KSSL.
- Environment
Server: Oracle Spark Enterprise T2000 OS: solaris10
It is a very old environment.
Configuration: In a container configuration, the WEB server is built in the local ZONE. It is the global ZONE that ends in KSSL. The local ZONE web server is configured to listen on port 8888.
- Prepare the certificate
Since only one file of certificate information can be passed in KSSL, place the file with the information pasted in the order of "certificate + intermediate certificate + private key" in a place where you can view it from the Global ZONE.
[shell]# vi /etc/httpd/keys/abc.net.key [/shell]
３． Registering KSSL Services with SMF
[shell]ksslcfg create -f pem -i /etc/httpd/keys/abc.net.key -x 8888 zone-web01 443 [/shell]
"zone-web01" is the server to which it is forwarded. This name must be DNS drawn or registered with hosts. 「-i」… Specify the certificate you have installed. Empirically, there are no restrictions on file permissions or anything like "-x"... Subordinate server and communication port number. This is the port on which the web server is listening to "zone-web01"... After terminate, the destination server name is "443"... The port that KSSL itself awaits
[shell]# svcs -a|grep ssl online 10:15:01 svc:/network/ssl/proxy:kssl-zone-web01-443 [/shell] If it becomes "online" like this in the Global Zone, the startup is successful.
- Check in the local ZONE
As far as I have done so far, even if I started KSSL, it did not bind on its own. So you need to restart the web service. (This time, we will use Apache as an example)
[shell]# svcs -a|grep apache online 15:33:22 svc:/network/http:apache2-web01 [/shell]
The web service is also registered with SMF, but restart the above service.
[shell]# svcadm restart apache2-web01 online 15:33:22 svc:/network/http:apache2-web01 # svcs -a|grep apache online 18:00:10 svc:/network/http:apache2-web01
○ Confirm # netstat -a|grep 443|grep LISTEN TCP: IPv4 Local Address Remote Address Swind Send-Q Rwind Recv-Q State -------------------- -------------------- ----- ------ ----- ------ ----------- zone-web01.443 *.* 0 0 49152 0 LISTEN [/shell]
This completes the construction of the web server using KSSL as an SSL proxy. The terminate process is fast because the resources are separated from the web server.
However, after all, I use the OpenSSL library, so it is up to Oracle to update it.