Sun ONE logo      �W�@��      �ؿ�      �d�      �U�@��     

Sun ONE Web Server 6.1 �޲z���n

�� 6 ��
�ϥ��ҮѩM���_

�����y�z�F�p��ϥ��ҮѩM���_�{�ҨӫO�@ Sun ONE Web Server 6.1 ���w���C�ٴy�z�F�p��ҰʥΩ�O�@�z����ơB�ڵ��J�I�̦s��M���\�z�n���ϥΪ̦s��U�ئw���\��CSun ONE Web Server 6.1 ���X�F�Ҧ� Sun ONE ��A�����w���[�c�G���إߦb�~�ɼзǩM���@��w����¦���W�A�H��o�̤j���ۤ��i�ާ@�ʩM�@�P�ʡC

�\Ū�������e�A�z3���A�Ѥ��}���_�[�K���򥻷��!C�o�Ƿ��%]�A�[�K�M�ѱK�B���}���_�M�p�K���_�B�Ʀ��ҮѥH�Υ[�K��w�C�p�ݧ�h��T�A�аѾ\ �uIntroduction to SSL�v�C

�H�U�U�`�ԲӸ��$F�O�@ Web ��A���w�����{�ǡG


����ҮѪ��{��

�{�ҬO�T�{����{�ǡC�b������Ҥ��A�{�ҬO�@���t�@�誺�T�H�ѧO�C�ҮѬO�䴩�{�Ҫ��@�ؤ覡�C

�ϥ��ҮѶi��{��

�ҮѤ��]�t��w�ӤH�B���q�Ψ�L����W�١A���ҩ��ҮѤ��ҥ]�t�����}���_�ݩ�W�z���骺�Ʀ��ơC�Τ�ݩM��A�����i�H�֦��ҮѡC

�Үѥѻ{�Ҿ�c (�Y CA) �ֵo�öi��Ʀ�ñ�W�CCA �i�H�O�z�L��ں��X���ҮѪ����q�A�]�i�H�O�t�d����~���Υ�~�����ֵo�ҮѪ�����C�z�i�H�M�w�N�R�+H�� CA �@�����Ҩ�L�ϥΪ̨����c�C

���F���}���_�M���Ү��ѧO������W�٤��~�A�Ү��٥]�A�L�d�aB�ֵo���ҮѪ� CA �W�٩M�ֵo���ҮѪ� CA ���u�Ʀ�ñ�W�v�C�p�ݦ����ҮѤ��e�M�榡����h��T�A�аѾ\�uIntroduction to SSL�v�C


�Ƶ�

��������w�˦�A���ҮѡA�M��~��Ұʥ[�K�C


��A���{��

��A���{�ҫ�Τ�ݹ��A���i�檺�T�H�ѧO�F�Y�ﰲ�]�t�d�S�w����}�W��A������´�i���ѧO�C

�Τ�ݻ{��

�Τ�ݻ{�ҫ��A����Τ�ݶi�檺�T�H�ѧO�F�Y�ﰲ�]�ϥΥΤ�ݳn�骺�ϥΪ̶i���ѧO�C�Τ�ݥi�H�֦��h���ҮѡA�N���ϥΪ̥i�H�㦳�ƭӤ��P���ѧO���$@�ˡC

���&�A���Ү�

�C�ӵ��&�A���i�H�֦����P���ҮѸ�Ʈw�C�C�ӵ��&�A����Ʈw�i�H�]�t�h���ҮѡC���&�A�����C�ӹ�Ҥ]�i�H�֦����P���ҮѡC


�إߥi�H���Ʈw

�ӽЦ�A���ҮѤ��e�A�����إߤ@�ӥi�H���Ʈw�C�b Sun ONE Web Server ���AAdministration Server �M�C�Ӧ�A����ҳ��i�H�֦��ۤv���i�H���Ʈw�C�i�H���Ʈw�u��b�����W�إߡC

�إߥi�H���Ʈw�ɡA�z�ݭn��w�N�Ω���_���ɮת��K�X�C�z�ٻݭn���K�X�ӱҰʨϥΥ[�K�q�T����A���C�p�ݦ����ܧ�K�X���`�N�ƶ��M��A�аѾ\�u�ܧ�K�X�� PIN�v

�b�i�H���Ʈw���A�i�H�إߩM�x�s���}���_�M�p�K���_ (�٬����_���ɮ�)�C���_���ɮץΩ� SSL �[�K�C�ӽЩM�w�˦�A���ҮѮɱN�Ψ�Ӫ��_���ɮסC�w���ҮѤ���A�|�N�Ү��x�s�b�i�H���Ʈw���C���_���ɮץH�[�K���Φ��x�s�b�H�U�ؿ�G

Administration Server �u�঳�@�ӥi�H���Ʈw�C�C�Ӧ�A����ҳ��i�H�֦��ۤv�i�H���Ʈw�C���&�A���N�ĥά����A����ҫإߪ��i�H���Ʈw�C

�إߥi�H���Ʈw

�Y�n�إߥi�H���Ʈw�A�а��U�C�B�J�G

  1. �s�� [Administration Server] �� [Server Manager]�A�M���� [Security] ���ҡC
  2. ��� [Server Manager]�A�z������q�U�Ԧ��M�椤����A����ҡC

  3. ��@�U [Create Database] �s���C
  4. ��J��Ʈw���K�X�C
  5. ���ƥH�W�B�J�C
  6. ��@�U [OK]�C
  7. ��� [Server Manager]�A��@�U [Apply]�A�M���@�U [Restart] �H���ܧ�ͮġC

�ϥ� password.conf

�̹w�]�AWeb ��A���|�b�Ұʫe���ܺ޲z��Ѫ��_��Ʈw�K�X�C�p�G�z�Ʊ���s�ҰʵL�H�ݺު� Web ��A���A�h�ݭn�N�ӱK�X�x�s�b password.conf �ɮפ��C�ȷ�z���t�Ψ��A��O�@�ɤ~��o�˰��A�H�K���|���ɮשM���_��Ʈw�C

���`���p�U�A�L�k�Ұʱa�� /etc/rc.local �� /etc/inittab �ɮץB�w�ҥ� SSL �� UNIX ��A���A�]���Ӧ�A���|�b�Ұʤ��e�n�D��J�K�X�C���ޥi�H�z�L�N�K�X�H�@���r�榡�x�s�b�Y���ɮפ��Ӧ۰ʱҰʤw�ҥ� SSL ����A���A���ij���n�ϥγo�ؤ�k�C��A���� password.conf �ɮ�3���W�ŨϥΪ̩Φw�˦�A�����ϥΪ̩Ҿ֦��A�åB�u���Ҧ��̹��㦳Ū��M�g�J�\�i�v���C

�b UNIX �W�A�N�ҥΤF SSL ����A�����K�X�O�d�b password.conf �ɮפ��|�a�ӫܤj���w���ʭ��I�C�i�H�s����ɮת����ϥΪ̳��i�H�s��w�ҥ� SSL ����A�����K�X�C�N�ҥΤF SSL ����A���K�X�O�d�b password.conf �ɮפ����e�A�ЦҶq�i��a�Ӫ��w���ʭ��I�C

�b Windows �W�A�p�G�w�ˤF NTFS �ɮרt�ΡA�h3�ӭ��w�� password.conf �ɮת��s���v�� (�Y�Ϥ��ϥθ��ɮ�)�A�q�ӫO�@�]�t���ɮת��ؿ�C�޲z��A���ϥΪ̩M Web ��A���ϥΪ�3�Ө㦳��ӥؿ�Ū��M�g�J�\�i�v�C�O�@�ӥؿ�i�H�����L�ϥΪ̫إ߰� password.conf �ɮסC�z�L�k�z�L���w�� FAT �ɮרt�ΤW���ؿ���ɮת��s��ӫO�@���̡C

�۰ʱҰʤw�ҥ� SSL ����A��

�p�G�z���Ҷq�w���ʭ��I�A�а��U�C�B�J�Ӧ۰ʱҰʤw�ҥ� SSL ����A���G

  1. �T�w�w�ҥ� SSL�C
  2. �b��A����Ҫ� config �l�ؿ�إ߷s�� password.conf �ɮסC
    • �p�G�ϥΪ��O��A���H�������� PKCS#11 �n��[�K�ҲաA�п�J�H�U��T�G
    • internal:your_password

    • �p�G�ϥΪ��O��L PKCS#11 �Ҳ� (�Ω�w��[�K�εw��[�t��)�A�Ы�w�᭱�H���K�X�� PKCS#11 �ҲզW�١C�Ҧp�J
    • nFast:your_password

  3. ����í��s�Ұʦ�A���A�H�Ϸs�]�w�ͮġC

�Y�ϫإߤF password.conf �ɮסA�z�]�|�b�Ұ� Web ��A���ɩl�צ���n�D���ѱK�X�����ܡC


�ӽЩM�w�� VeriSign �Ү�

VeriSign �O Sun ONE Web Server ������{�Ҿ�c�CVeriSign �� VICE ��w�i�H²���Үѥӽе{�ǡCVeriSign ���u�զb������N�ҮѶǦ^��A���C

����A���إߥi�H���ҮѸ�Ʈw��A�z�K�i�H�ӽФ@���ҮѨñN�䴣�浹�{�Ҿ�c (CA)�C�p�G���q���ۤv������ CA�A�h�i�H�V��ӽ��ҮѡC�p�G�p���q�ӷ~ CA �B�ʶR�ҮѡA�п�ܤ@�� CA �ïmn�һݪ��S�w�榡��T�C�i�H�q [Request a Certificate] ��������o�i�λ{�Ҿ�c�M��A�ӲM�椤�]�A��V�����s���C�p�ݦ��� CA �һݤ��e����h��T�A�аѾ\�ǥѦ�A���޲z��M [Request a Certificate] �U�� [Server Manager Security Pages] �Ҩ�o���{�Ҿ�c�M��C

Administration Server �u�঳�@�Ӧ�A���ҮѡC�C�Ӧ�A����ҳ��i�H�֦��ۤv����A���ҮѡC�z�i�H���C�ӵ��&�A�����@�Ӧ�A������ҮѡC

�ӽ� VeriSign �Ү�

�Y�n�ӽ� VeriSign �ҮѡA�а��U�C�B�J�G

  1. �s�� [Administration Server] �� [Server Manager]�A�M���� [Security] ���ҡC
  2. ��� [Server Manager]�A�z������q�U�Ԧ��M�椤����A����ҡC

  3. ��@�U [Request VeriSign Certificate] �s���C
  4. �Ƭd�һݪ��B�J�C
  5. ��@�U [OK]�C
  6. �̴` VeriSign �����{�Ƕi��@�~�C

�w�� VeriSign �Ү�

�p�G�ӽФF VeriSign �ҮѨ���o��ǡA���Ү�3�b�@��T�Ѫ��ɶ�����ܦb [Install VeriSign Certificate] �������U�Ԧ��M�椤�C�Y�n�w�� VeriSign �ҮѡA�а��U�C�B�J�G

  1. �s�� [Administration Server] �� [Server Manager]�A�M���� [Security] ���ҡC
  2. ��� [Server Manager]�A�z������q�U�Ԧ��M�椤����A����ҡC

  3. ��@�U [Install VeriSign Certificate] �s���C
  4. ���D�z�n�ϥΥ~���[�K�ҲաA�_�h�бq�[�K�Ҳժ��U�Ԧ��M�椤��ܤ��� (�n��) �ҲաC
  5. ��J���_���ɮױK�X�� PIN�C
  6. �q�U�Ԧ��M����n�^���� ID�C
  7. �q�`���̫�@�ӡC

  8. ��@�U [OK]�C
  9. ��� [Server Manager]�A��@�U [Apply]�A�M���@�U [Restart] �H���ܧ�ͮġC


�ӽЩM�w�˨�L��A���Ү�

���F VeriSign�A�٥i�H�q��L�{�Ҿ�c�ӽЩM�w���ҮѡC�i�H�ǥѦ�A���޲z��M [Request a Certificate] �U�� [Server Manager Security Pages] ��o CA �M��C�z�����q�β�´�i��|���Ѧۤv�������ҮѡC���`�y�z�F�p��ӽЩM�w�˳o�Ǩ�L��������A���ҮѡC

CA �һݪ���T

�}�l�ӽе{�Ǥ��e�A�нT�w�z�A�� CA �һݪ���T�C�L�ױq�ӷ~ CA �B�٬O���� CA �B�ӽЦ�A���ҮѡA���ݭn���ѥH�U��T�G

�Ҧ��o�Ǹ�T���X���@�t�C�ݩʭȹ� (�٬��ϧO�W�� [DN])�A�Ω�ߤ@�ѧO�ҮѪ��D�D�C

�p�G�q�ӷ~ CA �B�ʶR�ҮѡA�h�����b CA �ֵo�ҮѤ��e�P���p���A�H�d��L�̩һݪ���L��T�C�h�� CA ���n�D�z���Ѩ����ҩ�C�Ҧp�ACA �ݭn���ұz�����q�W�٩M���q���v�޲z��A�����ϥΪ̡A�åB�i��|�߰ݱz�O�_�㦳�ϥΩҴ��Ѹ�T���X�k�v���C

�Y�ǰӷ~ CA �V�X���ԲӨ����ҩ��´�έӤH���Ѥ��e�󬰸ԲӡB�ǽT���ҮѡC�Ҧp�A�z�i�H�ʶR�@���ҮѡA�ŧi CA �������ҤF�z�O www.sun.com �q�����X�k�޲z��A�ӥB���ҤF�z�����q�O�w�q�ƤT�~�ӷ~���ʥB�L���j�Ȥ�D�^�ץ󪺤��q�C

�ӽШ�L��A���Ү�

�Y�n�ӽ��ҮѡA�а��U�C�B�J�G

  1. �s�� [Administration Server] �� [Server Manager]�A�M���� [Security] ���ҡC
  2. ��� [Server Manager]�A�z������q�U�Ԧ��M�椤����A����ҡC

  3. ��@�U [Request a Certificate] �s���C
  4. ���o�O�@�ӷs�ҮѡA�٬O�@�ӧ�s���ҮѡC
  5. �\�h�ҮѦb�@�q�ɶ� (�Ҧp���Ӥ�Τ@�~) ��|�L�aC�Y�� CA �|�۰ʵ��z�ǰe�@�ӧ�s���ҮѡC

  6. �Y�n��w�����ҮѥӽЪ��覡�A�а��U�C�B�J�G
    • �p�G CA �q�H�q�l�l��T�����Φ������ӽСA�Ю֨� [CA Email] �ÿ�J�� CA ���q�l�l���}�C�p�� CA ���M��A�Ы�@�U [List of available certificate authorities]�C
    • �p�G�n�q�ϥ� Netscape �ҮѦ�A�������� CA �B�ӽ��ҮѡA�Ы�@�U [CA URL] �ÿ�J���ҮѦ�A���� URL�C�� URL 3��V�Ω�B�z�ҮѥӽЪ��ҮѦ�A���{���C�d�� URL �p�U�ҥܡGhttps://CA.mozilla.com:444/cms�C
  7. �q�U�Ԧ��M����ӽ��ҮѮɻݭn�ϥΪ����_���ɮת��[�K�ҲաC
  8. ��J���_���ɮת��K�X�C
  9. �ӱK�X�K�O�z�إߥi�H���Ʈw�ɩҫ�w���K�X�A���D�z����ҲեH�~���[�K�ҲաC��A���N�ϥθӱK�X��o�p�K���_�ù�ǰe�� CA ���T���i��[�K�C�M��A�N�z�����}���_�M�[�K�T���ǰe�� CA�CCA �|�ϥΤ��}���_�ӸѱK�z���T���C

  10. ��J�z�������ѧO��T�C
  11. ����T���榡�] CA �Ӳ��C�p�ݦ���o����쪺�@��y�z�A�аѾ\�ǥѦ�A���޲z��M [Request a Certificate] �U�� [Server Manager Security Pages] �Ҩ�o���{�Ҿ�c�M��C�е�N�A��s���Үѳq�`���ݭn����T�����j���$��e�C

  12. �J���ˬd�o�Ǥ��e�H�T�w��ǽT�ʡC
  13. ��T�V�ǽT�A����ҮѪ��t�ץi��N�V�֡C�p�G�n�N�ӽжǰe���ҮѦ�A���A�K�|�b����ӽФ��e���ܱz���Ҫ���T�C

  14. ��@�U [OK]�C
  15. ��� [Server Manager]�A��@�U [Apply]�A�M���@�U [Restart] �H���ܧ�ͮġC

��A���|���ͥ]�t�z����T���ҮѥӽСC�ӥӽХ]�t�z�L�p�K���_�إߪ��Ʀ�ñ�W�CCA �ϥμƦ�ñ�W�����ҸӥӽХ��b�q��A����V CA ����ѹL�{���Q«��C�u���ּƱ��p�U�ӽФ~�|�Q«��A�o�ɡACA �q�`�|�z�L�q�ܻP�z�p���C

�p�G��ܳz�L�q�l�l��ǰe�ӽСA��A���N���g���t�ӽЪ��q�l�l��T���ñN��ǰe�� CA�C�q�`�A�Үѷ|�z�L�q�l�l��Ǧ^�C�p�G�z��w�F��V�ҮѦ�A���� URL�A��A���K�|�ϥ� URL �V�ҮѦ�A������ӽСC�z�i�H�z�L�q�l�l��Ψ�L�覡��o�^3�A�o��M�� CA�C

�p�G CA �P�N�V�z�ֵo�ҮѡA�K�|�q���z�C�h�Ʊ��p�U�ACA �|�z�L�q�l�l��V�z�ǰe�ҮѡC�p�G�z����´���b�ϥ��ҮѦ�A���A�h�i�H�ϥ��ҮѦ�A�������j�M�ҮѡC


�Ƶ�

�ëD�C�ӱq�ӷ~ CA �B�ӽ��ҮѪ��ϥΪ̳��|��o�ҮѡC�ܦh CA �b�V�z�ֵo�ҮѤ��e���ݭn�z���Ѩ����ҩ�C�ӥB�A�n��o��ǥi��n��O�@�Ѩ��Ӥ몺�ɶ��C�z�t�d�ήɦV CA ���ѩҦ����n��T�C


�����Үѫ�A�K�i�H�i��w�ˡC�b���v��A�z���M�i�H�ϥΥ��w�� SSL ����A���C

�w�˨�L��A���Ү�

��z����q CA �o�^���ҮѮɡA���ҮѱN�z�L���}���_�[�K�A�H�K�u���z�~�i�H�N��ѱK�C�u����J���T�B�i�H���Ʈw�K�X�A�~��ѱK�M�w���ҮѡC

���T���������ҮѡG

�Ү���O�ѦU�ӻ{�Ҿ�c�̦�ñ�W���@�t�C���h���ҮѡCCA �ҮѥΩ��ѧO�{�Ҿ�c (CA) �M���Ӿ�c�ֵo���Ү�ñ�W�C�ϹL�ӡACA �ҮѤS�i�H�Ѥ� CA �� CA �Ү�ñ�W�A�p�����!A����� CA�C


�Ƶ�

�p�G CA ���V�z�۰ʶǰe���ҮѡA�h�ݭn�ӽ��ҮѡC�ܦh CA �|�b�q�l�l�󤤩�J�L�̪��ҮѩM�z���ҮѡA�z����A���N�P�ɦw�˳o����ҮѡC


��z�q CA �����ҮѮɡA���ҮѤw�z�L���}���_�[�K�A�H�K�u���z�i�H�N��ѱK�C�w�˸��ҮѮɡA��A���N�ϥαz��w�����_���ɮױK�X�N��ѱK�C�p�U�ҭz�A�z�i�H�N�q�l�l���x�s�b��A���i�H�s���m���A�]�i�H�ƻs�q�l�l�󪺤�r�÷dzƱN��K�� [Install Certificate] ��椤�C

�w���Ү�

�Y�n�w���ҮѡA�а��U�C�B�J�G

  1. �s�� [Administration Server] �� [Server Manager]�A�M���� [Security] ���ҡC
  2. ��� [Server Manager]�A�z������q�U�Ԧ��M�椤����A����ҡC

  3. ��@�U [Install Certificate] �s���C
  4. �֨�n�w�˪��Ү������G
    • �u����A���v�A�A�Ω�ȻP�z����A�����p����@�ҮѡC
    • �u��A���Ү���v�A�Ω�n�]�t�b�Ү��줤�� CA �ҮѡC
    • �u�i�H��{�Ҿ�c (CA)�v�A�Ω�Y�i�H�� CA ���ҮѡA�� CA �N�@���Τ�ݻ{�Ҫ��i�H�� CA �i��ϥΡC
  5. �q�U�Ԧ��M����[�K�ҲաC
  6. ��J���_���ɮױK�X�C
  7. �p�G���ҮѪ��W�٬O����A����Ҥ��ϥΪ��ߤ@�W�١A�бN�ҮѦW�����O�d���ťաA���D�X�{�H�U���p�G
    • �h���ҮѱN�Ω���&�A��
    • ��J��A����Ҥ��ߤ@���ҮѦW��

    • �ϥΤF�����ҲեH�~���[�K�Ҳ�
    • �b��@�[�K�Ҳդ���J�Ҧ���A����Ҥ��ߤ@���ҮѦW��

      �p�G��J�F�W�١A�ӦW�ٷ|��ܦb [Manage Certificates] �M�椤�A�åB3���y�z�ʦW�١C�Ҧp�A�uUnited States Postal Service CA�v�O�Y�� CA ���W�١A�ӡuVeriSign Class 2 Primary CA�v�h�P�ɴy�z�F CA �M�ҮѪ������C�p�G����J�ҮѦW�١A�h3�M�ιw�]�ȡC

  8. ���H�U��@�ﶵ�G
    • [Message is in this file]�A�ÿ�J�w�x�s���q�l�l�󪺧����|�W��
    • [Message text] (�a���Y)�A�öK�W�q�l�l���r
    • �p�G�ƻs�öK�W��r�A�нT�w�]�A���t�_�l�M�פ�s�r�Ÿ������Y�uBegin Certificate�v�M�uEnd Certificate�v�C

  9. ��@�U [OK]�C
  10. ���H�U��@�ﶵ�G
    • [Add Certificate]�A�p�G�n�w�˷s�ҮѡC
    • [Replace Certificate]�A�p�G�n�w�˧�s���ҮѡC
  11. ��� [Server Manager]�A��@�U [Apply]�A�M���@�U [Restart] �H���ܧ�ͮġC

�ҮѱN�x�s�b��A�����ҮѸ�Ʈw���C�ɦW�� <alias>-cert8.db�C�Ҧp�G


�ɯŮɲ����Ү�

�p�G�n�q iPlanet Web Server 4.1 �� 6.0 �i��E���A�z���ɮ� (�]�A�i�H���Ʈw�M�ҮѸ�Ʈw) �|�Q�۰ʧ�s�C

���_���ɮשM�Үѥu���b��A���ҥΤF�w���ʮɤ~��Q�E���C�]�i�H�ϥ� [Administration Server] �����M [Server Manager] �������� [Security] ���Ҧۦ�E�����_�M�ҮѡC

�b��e�������A�ҮѩM���_���ɮר̧O�W�i��ѦҡA�ӧO�W�i�H�Ѧh�Ӧ�A����ҨϥΡCAdministration Server �޲z�������O�W�Ψ�e���ҮѡC�b Sun ONE Web Server 6.1 ���AAdministration Server �M�C�Ӧ�A����ҳ����ۤv���ҮѩM���_���ɮסA�٬��i�H���Ʈw�A�ӫD�O�W�C

�z�i�H�ǥ� Administration Server (����ۨ�) �� Server Manager (����A�����) �޲z�i�H���Ʈw�Ψ�e���ҮѡA��̥]�A��A���ҮѩM�]�t�������ҮѾ�c�C�ҮѩM���_���Ʈw�ɮײ{�b�̾ڨϥΥ��̪���A����ҩR�W�C�p�G�O�b��e�������A�h�Ӧ�A����Ҧ@�ΦP�@�ӧO�W�A�E���ɱN���s��A����ҭ��s�R�W�ҮѩM���_���ɮסC

�N�E���P��A��������p����ӥi�H���Ʈw�C�H�e����Ʈw���C�X�������{�Ҿ�c���N�E���� Sun ONE Web Server 6.1 ��Ʈw���C�p�G�X�{���ƪ� CA�A�ШϥΥH�e�� CA�A���쥦�L�aC�ФŹxէR�����ƪ� CA�C

�ϥΤ��خ��ҮѼҲ�

Sun ONE Web Server 6.1 �H�����i�ʺA��J�����ҮѼҲե]�A�F�\�h CA (�䤤�]�A VeriSign) �����ҮѡC���ҮѼҲդ��\�z�N���ҮѤɯŨ�󰪪������A�B��k��H�e�e��h�C�H�e�A�z�ݭn�v�ӧR���ª����ҮѡA�M��A�v�Ӧw�˷s�����ҮѡC�{�b�Y�n�w�˱`�Ϊ� CA �ҮѡA�h�i�H�u�N���ҮѼҲ��ɮק�s��󰪪������A�]�����b�H�᪩���� Sun ONE Web Server �� Service Packs �����i�ΡC

�]�����ҮѬO�@�� PKCS#11 �[�K�Ҳհ�檺�A�ҥH������R���ӼҲե]�t�����ҮѡA�åB�b�޲z�o���ҮѮɤ]���|���ѧR���ҮѪ��ﶵ�C�Y�n�q��A����Ҥ��������ҮѡA�i�H�z�L�R����A�� alias �ɮפ����H�U���e�Ӱ��ή��ҮѼҲաG

�p�G���n�_����ҮѼҲաA�h�i�H�N bin/https/lib (UNIX �M HP) �� bin\https\bin (Windows) �����ɦW�ƻs�^ alias �l�ؿ�C

�i�H�ק���ҮѪ��H���T�C�H���T�N�g�J���b�s�誺��A����Ҫ��ҮѸ�Ʈw���A�ӫD��^�ܮ��ҮѼҲե����C


�޲z�Ү�

�z�i�H�˵�B�R���νs��w�˦b��A���W���U���ҮѪ��H��]�w�C�䤤�]�A�z�ۤv���ҮѩM�Ӧ� CA ���ҮѡC

�Y�n�޲z�ҮѲM��A�а��U�C�B�J�G

  1. �s�� [Administration Server] �� [Server Manager]�A�M���� [Security] ���ҡC
  2. ��� [Server Manager]�A�z������q�U�Ԧ��M�椤����A����ҡC

  3. ��@�U [Manage Certificates] �s���C
    • �p�G�n�ϥΤ����[�K�Ҳպ޲z�w��t�m���ҮѡA�N�|��ܩҦ��w�w���ҮѪ��M��A�䤤�]�A�ҮѪ������M���Ĥ�aC�Ҧ��Үѳ��x�s�b server_root/alias �ؿ�C
    • �p�G�n�ϥΥ~���[�K�Ҳ� (�Ҧp�w��[�t��)�A�h�ݭn��C�ӯS�w�Ҳտ�J�K�X�A�M���@�U [OK]�C�ҮѲM��N�|��s�A�H�K�b�Ҳդ��]�t�o���ҮѡC
  4. ��@�U�n�޲z�� [Certificate Name]�C
  5. �ù�W�|��� [Edit Server Certificate] �����A�䤤�]�t���Ү��������޲z�ﶵ�C�u�� CA �ҮѤ~���\�z�]�w�Ψ��]�w�Τ�ݫH��C�Y�ǥ~���[�K�ҲձN�����\�R���ҮѡC

    Edit Server Certificate
    ��� [Edit Server Certificate] ���ϡC

  6. �b [Edit Server Certificate] ���A�z�i�H���H�U�ﶵ�G
    • [Delete Certificate] �� [Quit]�A�A�Ω󤺳���o���Ү�
    • [Set client trust]�B[Unset server trust] �� [Quit]�A�A�Ω� CA �Ү�
  7. ��@�U [OK]�C
  8. ��� [Server Manager]�A��@�U [Apply]�A�M���@�U [Restart] �H���ܧ�ͮġC

�ҮѸ�T���]�t�֦��̩M�ֵo�ҮѪ���c�C

�H��]�w���\�z�]�w�Τ�ݫH��Ψ��]�w��A���H��C��� LDAP ��A���ҮѡA��A�������Q�H��C


�w�˩M�޲z CRL �M CKL

�ҮѺM�P�M�� (CRL) �M���|�����_�M�� (CKL) ���M���a�C�X�Τ�ݩΦ�A���ϥΪ̤�3�A�H��Ҧ��ҮѩM���_�C�p�G�ҮѤ�����Ƶo���ܧ� (�Ҧp�A�Y��ϥΪ̦b�ҮѹL�d��e�ܧ�F�줽�ǩ���}�F��´)�A�h���ҮѱN�Q�o��A���ƱN��ܦb CRL ���C�p�G���_�Q«��γQ���|�A�h�Ӫ��_�Ψ��ƱN��ܦb CKL ���CCRL �M CKL ���� CA ���ͨéw�g�s�C

�w�� CRL �� CKL

�Y�n�q CA �B��o CRL �� CKL�A��U�C�B�J�G

  1. ��o CA �� URL �H�U�� CRL �� CKL�C
  2. �b�s���J URL �H�s��Ӻ�C
  3. �̾� CA ������N CRL �� CKL �U��쥻�ݥؿ�C
  4. �s�� [Administration Server] �� [Server Manager]�A�M���� [Security] ���ҡC
  5. ��� [Server Manager]�A�z������q�U�Ԧ��M�椤����A����ҡC

  6. ��@�U [Install CRL/CKLs] �s���C
  7. ���H�U��@�ﶵ�G
    • Certificate Revocation List
    • Compromised Key List
  8. ��J���p�ɮת������|�W�١C
  9. ��@�U [OK]�C
    • �p�G���F [Certificate Revocation List]�A�ù�W�|��� [Add Certificate Revocation List] �����A�䤤�C�X�F CRL ��T�C
    • �p�G���F [Compromised Key List]�A�ù�W�|��� [Add Compromised Key List] �����A�䤤�C�X�F CKL ��T�C

      �Ƶ�

      �p�G��Ʈw���w�s�b CRL �� CKL �M��A�ù�W�|��� [Replace Certificate Revocation List] �� [Replace Compromised Key List] �����C


  10. ��@�U [Add]�C
  11. ��@�U [OK]�C
  12. ��� [Server Manager]�A��@�U [Apply]�A�M���@�U [Restart] �H���ܧ�ͮġC

�޲z CRL �M CKL

�Y�n�޲z CRL �M CKL�A�а��U�C�B�J�G

  1. �s�� [Administration Server] �� [Server Manager]�A�M���� [Security] ���ҡC
  2. ��� [Server Manager]�A�z������q�U�Ԧ��M�椤����A����ҡC

  3. ��@�U [Manage CRL/CKLs] �s���C
  4. �ù�W�|��� [Manage Certificate Revocation Lists /Compromised Key Lists] �����A�䤤�C�X�F�Ҧ��w�w�˪���A�� CRL �M CKL �Ψ䦳�Ĥ�aC

  5. �q [Server CRLs] �� [Server CKLs] �M�椤��� [Certificate Name]�C
  6. ��ܥH�U�ﶵ�G
    • Delete CRL
    • Delete CKL
  7. ��� [Server Manager]�A��@�U [Apply]�A�M���@�U [Restart] �H���ܧ�ͮġC


�]�w�w���ʳߦn�]�w

��o�Үѫ�A�K�i�H�}�l�O�@�z����A���CSun ONE Web Server ���ѤF�ƭӦw���ʤ��!C

�[�K�O�@���ഫ��T�A�ϱo�Ȧ��w�w����̤~��z�ѥ����L�{�C�ѱK�O�ഫ�[�K��T�H�Ϩ䭫�s�ܱo�i�H�z�Ѫ��L�{�CSun ONE Web Server 6.1 �䴩 SSL �M TLS �[�K��w�C

�K�X�O�@�إΩ�[�K�θѱK���[�K�t��k (�@�ؼƾǨ禡)�CSSL �M TLS ��w�]�t�j�q�K�X�աC�Y�DZK�X�|���L�K�X��j�j�B��w���C�@��Ө��A�K�X�ϥΪ��줸�V�h�A�K�V��N��ƸѱK�C

�b�����V�[�K�L�{���A��賣�����ϥάۦP���K�X�C�ѩ󦳤j�q�K�X�i�ѨϥΡA�]���ݭn���A���ϥγ̱`�Ϊ��K�X�C

�b�w���s�u�L�{���A�Τ�ݩM��A�����P�N�ϥΥi�Ω�q�T���̱j�K�X�C�z�i�H�z�L SSL2�BSSL3 �M TLS ��w��ܱK�X�C


�Ƶ�

�ѩ�b SSL 2.0 ��������� SSL ���w���ʩM�į�i��F�U�ا�i�A�]�����D�Τ�ݵL�k�ϥ� SSL 3�A�_�h���n�ϥ� SSL 2�C�ϥ� SSL 2 �K�X�L�k���Τ���ҮѴ��Ѧw���O�ҡC


��W���[�K�L�{�ä����H�O�@��A����K��T���w���C�����t�X�ϥΪ��_�P�[�K�K�X�A�H�K���ͯu�����[�K���G�A�θѱK�H�e�[�K����T�C�[�K�{�ǨϥΥH�U��ت��_�Ө�o�����G�G���}���_�M�p�K���_�C�ϥΤ��}���_�[�K����T�u��ϥ����p���p�K���_�i��ѱK�C���}���_�@���ҮѪ��@���6i��o�G�A�]���A�u�����p���p�K���_���O�@�C

�p�ݦ���U�رK�X�ժ��y�z�H�Ϊ��_�M�ҮѪ���h��T�A�аѾ\�uIntroduction to SSL�v�C

�Y�n��w��A���i�H�ϥΪ��K�X�A�Цb�M�椤�֨�o�DZK�X�C���D�����ϥίS�w�K�X���R�2z�ѡA�_�h3�ӥ����֨�C���L�A�z�i�ण�Ʊ�ҥΫD�̨Τƥ[�K���K�X�C


ĵ�i

�Фſ�� [No Encryption, only MD5 message authentication]�C�p�G�Τ�ݨS����L�i�Ϊ��K�X�A��A���|�w�]���ϥΦ��]�w�B���i��[�K�C


SSL �M TLS ��w

Sun ONE Web Server 6.1 �䴩�Ω�[�K�q�T���w���M���h (SSL) ��w�M�ǿ�h�w���� (TLS) ��w�CSSL �M TLS �O�W�ߪ�3�ε{���A�åB�i�H�b��W�z��a�

SSL �M TLS ��w�䴩�U�إΩ��A���M�Τ�ݪ��ۤ��{�ҡB�ǿ��ҮѩM�إ߶��q�@�~���_���K�X�C�Τ�ݩM��A���i�H�䴩�U�رK�X�թαK�X���A�o��M��U�ئ]�!A�Ҧp�Ҥ䴩����w�B���q����[�K�j�ת������H�άF����[�K�n�骺�X�f���w�C�b��L�禡���ASSL �M TLS �洫��w�N�M�w��A���M�Τ�ݦp���ӥH�T�w�N�Ω�q�T���K�X�աC

�ϥ� SSL �P LDAP �q�T

�z3�ӭn�D Administration Server �ϥ� SSL �P LDAP �i��q�T�C�Y�n�ҥ� Administration Server �W�� SSL�A�а��U�C�B�J�G

  1. �s�� [Administration Server] �ÿ�� [Global Settings] ���ҡC
  2. ��@�U [Configure Directory Service] �s���C
  3. ��� [Yes] �H�ϥΦw���M���r�h (SSL) �i��s�u�C
  4. ��@�U [Save Changes]�C
  5. ��@�U [OK] �H�N�z���s�����ܧ󬰨ϥ� SSL �� LDAP �зdzs����C

����ť�M���r�ҥΦw����

�z�i�H�z�L�H�U�覡�ӫO�@��A����ť�M���r���w���G

�}�Ҧw����

�z�����}�Ҧw���ʡA�M��~�ର��ť�M���r�t�m��L�w���ʳ]�w�C�z�i�H�b�إ߷s����ť�M���r�νs��{����ť�M���r�ɶ}�Ҧw���ʡC

�إ߰�ť�M���r�ɶ}�Ҧw����

�Y�n�b�إ߷s��ť�M���r�ɶ}�Ҧw���ʡA�а��U�C�B�J�G

  1. �s�� [Server Manager] �ñq�U�Ԧ��M�椤���n�b�䤤�إ߰�ť�M���r����A����ҡC
  2. ��� [Preferences] ���� (�p�G�|�����)�C
  3. ��� [Edit Listen Sockets] �s���C
  4. �ù�W�|��� [Edit Listen Sockets] �����C

  5. ��@�U [New] ��s�C
  6. �ù�W�|��� [Add Listen Socket] �����C

  7. ��J�һݸ�T�ÿ��w�]�����&�A���C
  8. �Y�n�}�Ҧw���ʡA�бq [Security] �U�Ԧ��M���� [Enabled]�C
  9. ��@�U [OK]�C
  10. ��@�U [Apply]�A�M���@�U [Restart] �H���ܧ�ͮġC

    �Ƶ�

    �z�ݭn�b�إ߰�ť�M���r��A�ϥ� [Edit Listen Sockets] �s���Ӱt�m�w���ʳ]�w�C


�s�谻ť�M���r�ɶ}�Ҧw����

�z�]�i�H�b�g�� Administration Server �� Server Manager �s�谻ť�M���r�ɶ}�Ҧw���ʡC�Y�n�b�s�谻ť�M���r�ɶ}�Ҧw���ʡA�а��U�C�B�J�G

  1. �s�� [Administration Server] �� [Server Manager]�A�M���� [Security] ���ҡC
  2. ��� [Server Manager]�A�z������q�U�Ԧ��M�椤����A����ҡC

  3. ��� [Preferences] ���� (�p�G�|�����)�C
  4. ��� [Edit Listen Sockets] �s���C
  5. �ù�W�|��� [Edit Listen Sockets] �����C

  6. �Y�n�s�谻ť�M���r�A�Ы�@�U�n�s�誺��ť�M���r�� [Listen Socket ID]�C
  7. �ù�W�|��� [Edit Listen Socket] �����C

  8. �Y�n����ť�M���r�}�Ҧw���ʡA�бq [Security] �U�Ԧ��M���� [Enabled]�C
  9. ��@�U [OK]�C
  10. ��� [Server Manager]�A��@�U [Apply]�A�M���@�U [Restart] �H���ܧ�ͮġC

����ť�M���r����A���Ү�

�z�i�H�b Administration Server �� Server Manager ���t�m��ť�M���r�A�H�K�ϥαz�w�ӽШæw�˪���A���ҮѡC


�Ƶ�

�����ܤ֦w�ˤ@���ҮѡC


�Y�n����ť�M���r����A���ҮѥH�i��ϥΡA�а��U�C�B�J�G

  1. �s�� [Administration Server] �� [Server Manager]�A�M���� [Preferences] ���ҡC
  2. ��� [Server Manager]�A�z������q�U�Ԧ��M�����A����ҡC

  3. ��� [Edit Listen Sockets] �s���C
  4. �ù�W�|��� [Edit Listen Sockets] �����C

  5. �Y�n�s�谻ť�M���r�A�Ы�@�U�n�s�誺��ť�M���r�� [Listen Socket ID]�C
  6. �ù�W�|��� [Edit Listen Socket] �����C

  7. �Y�n����ť�M���r�}�Ҧw���ʡA�бq [Security] �U�Ԧ��M���� [Enabled]�C

  8. �Ƶ�

    �p�G�w�ˤF�~���ҲաA�ù�W�|��� [Manage Server Certificates] �����A�ín�D�b�~��ʧ@���e��J�~���Ҳժ��K�X�C


  9. �q [Server Certificate Name] �U�Ԧ��M�椤����ť�M���r����A���ҮѡC
  10. �ӲM��]�t�Ҧ��w�w�˪������M�~���ҮѡC


    �Ƶ�

    �p�G���w�˥���A���ҮѡA�N���ĵ�i�T���ӫD [Server Certificate Name] �U�Ԧ��M��C


  11. ��@�U [OK]�C
  12. ��� [Server Manager]�A��@�U [Apply]�A�M���@�U [Restart] �H���ܧ�ͮġC

���K�X

���F�O�@ Web ��A�����w���A3�ӱҥ� SSL�C�z�i�H�ҥ� SSL 2.0�BSSL 3.0 �M TLS �[�K��w�M���U�رK�X�աC�i�H�b Administration Server ��ť�M���r�W�ҥ� SSL �M TLS�C�b Server Manager ����ť�M���r�W�ҥ� SSL �M TLS �N���P�Ӱ�ť�M���r���p���Ҧ����&�A���]�w�w���ʳߦn�]�w�C

�p�G�Ʊ�ϥΫD�[�K�����&�A���A�h�����N��t�m���ϥάۦP����ť�M���r�A�åB��w���ʡC

�w�]�]�w���\�ϥγ̱`�Ϊ��K�X�C���D���R�2z�Ѥ��ϥίS�w�K�X�աA�_�h3�ӥ����ϥΡC�p�ݦ���S�w�K�X����h��T�A�аѾ\�uIntroduction to SSL�v�C


�Ƶ�

�����ܤ֦w�ˤ@���ҮѡC


tlsrollback �Ѽƪ��w�]�M��ij�]�w�� true�C�o�|���A���i��t�m�H����I�����^���;���xաC���F�P�Y�ǥ����T��� TLS �W�d���Τ�ݹ�{�ۤ��i�ާ@�ʡA�i��ݭn�N���ȳ]�w�� false�C

�Ъ`�N�A�N tlsrollback �]�w�� false �|���C�s�u�睊���^���;�����@��O�C�����^���;�O�@�ؾ��A�ĤT��i�H�z�L�o�ؾ��j��Τ�ݩM��A���ϥΦw���ʸ�C�����h�w (�Ҧp SSLv2) �i��q�T�C�ѩ� SSLv2 ��w���s�b���Ҷg�����ʳ��A�]���L�k����쪩���^���;�A�o�N�ϲĤT���e��I��M�ѱK�[�K���s�u�C

�Y�n�ҥ� SSL �M TLS�A�а��U�C�B�J�G

  1. �s�� [Administration Server] �� [Server Manager]�A�M���� [Preferences] ���ҡC
  2. ��� [Server Manager]�A�z������q�U�Ԧ��M�椤����A����ҡC

  3. ��@�U [Edit Listen Sockets] �s���C
  4. �ù�W�|��� [Edit Listen Sockets] �����C���w����ť�M���r�A[Edit Listen Socket] ��������ܥi�Ϊ��K�X�]�w�C


    �Ƶ�

    �p�G���b��ť�M���r�W�ҥ� [Security]�A�h���|�C�X��� SSL �M TLS ��T�C�Y�n�ϥαK�X�A�нT�w�w�b���ť�M���r�W�ҥΤF�Ӧw���ʡC�p�ݧ�h��T�A�аѾ\�u����ť�M���r�ҥΦw�����v�C


  5. �֨��3��һݥ[�K�]�w���֨���C

    �Ƶ�

    ��� Netscape Navigator 6.0�A�ЦP�ɮ֨� [TLS] �M [SSL3]�C��� TLS �^��A�]�n�֨� TLS�A�ýT�w�w���� SSL3 �M SSL2�C


  6. ��@�U [OK]�C
  7. ��� [Server Manager]�A��@�U [Apply]�A�M���@�U [Restart] �H���ܧ�ͮġC

    �Ƶ�

    ��z�b�}�Ұ�ť�M���r���w���ʤ���M���ܧ�ɡA�t�αN�۰ʭק� magnus.conf �ɮץH��ܦw���ʤw�}�ҡA�åB�۰ʫ�w�P�Ӱ�ť�M���r���p���Ҧ����&�A�����w�]�w���ʰѼơC


�b��A���W�ҥ� SSL ��A���� URL �N�ϥ� https�A�ӫD http�C��V�ҥΤF SSL ����A���W��� URL �榡�p�U�G

�Ҧp�Ahttps://admin.sun.com:443�C

�p�G�ϥιw�]���w�� http �s���� (443)�A�h�L���b URL ����J�s���𸹡C

����t�m�w����

�w�˱ҥΤF SSL ����A���N�b magnus.conf �ɮ� (��A�����D�t�m�ɮ�) ��������w���ʰѼƫإ߫�O���ءC�����N�w���ʳ]�w���uon�v�A���&�A�����w���ʳ]�w�~�|���ġC���&�A���� SSL �S�ʥi�H�H��A�������b server.xml �ɮת� SSLPARAMS ���$����C

�Y�n�]�w SSL �t�m�ɮ׫�O���ȡA�а��U�C�B�J�G

  1. �s�� [Server Manager] �ñq�U�Ԧ��M�椤�����&�A������A����ҡC
  2. �T�w���n�t�m����ť�M���r�ҥΤF�w���ʡC�Y�n�i�榹�ʧ@�A�а��U�C�B�J�G
    1. ��@�U [Edit Listen Sockets] �s���C
    2. ��@�U�n�ҥΨ�w���ʪ���ť�M���r�ҹ�3�� [Listen Socket ID]�C
    3. �N��� [Edit Listen Socket] �����C

    4. �q [Security] �U�Ԧ��M���� [Enabled]�C
    5. ��@�U [OK]�C
  3. ��@�U [Magnus Editor] �s���C
  4. �q�U�Ԧ��M���� [SSL Settings] �ë�@�U [Manage]�C
  5. ��J�H�U�U�Ѽƪ��ȡG
    • SSLSessionTimeout
    • SSLCacheEntries
    • SSL3SessionTimeout
  6. ��@�U [OK]�C
  7. ��@�U [Apply]�A�M���@�U [Restart] �H���ܧ�ͮġC

�o�� SSL �t�m�ɮ׫�O�p�U�ҭz�G

SSLSessionTimeout

SSLSessionTimeout ��O�Ω󱱨� SSL2 ���q�@�~���֨�C

�y�k

SSLSessionTimeout seconds

�䤤 seconds �O�֨� SSL ���q�@�~�O��Ī���ơC�w�]�Ȭ� 100�C�p�G��w�F SSLSessionTimeout ��O�A��ƪ��ȱN�۰ʭ��w�� 5 �� 100 �����C

SSLCacheEntries

��w�i�H�֨� SSL ���q�@�~���ƥءC

SSL3SessionTimeout

SSL3SessionTimeout ��O�Ω󱱨� SSL3 �M TLS ���q�@�~�֨�C

�y�k

SSL3SessionTimeout seconds

�䤤 seconds �O�֨� SSL3 ���q�@�~�O��Ī���ơC�w�]�Ȭ� 86400 �� (24 �p��)�C�p�G��w�F SSL3SessionTimeout ��O�A��ƪ��ȱN�۰ʭ��w�� 5 �� 86400 �����C


�ϥΥ~���[�K�Ҳ�

Sun ONE Web Server 6.1 �䴩�H�U�ϥΥ~���[�K�Ҳ� (�p���z�d�ΰO����) ����k�G

�Ұ� FIPS-140 �[�K�зǤ��e�A�z�ݭn�W�[ PKCS #11 �ҲաC

�w�� PKCS#11 �Ҳ�

Sun ONE Web Server �䴩���}���_�[�K�з� (PKCS) #11�A�Ӽзǩw�q�F�b SSL �M PKCS#11 �Ҳդ����q�T�ҨϥΪ������CPKCS#11 �ҲեΩ��V SSL �w��[�t�����зdzs�u�C�~���w��[�t�����פJ�ҮѩM���_�x�s�b secmod.db �ɮפ��A���ɮצb�w�� PKCs#11 �Ҳծɲ��͡C

�ϥ� modutil �u��w�� PKCS#11 �Ҳ�

�i�H�ϥ� modutil �u��åH .jar �ɮשΪ����ɮת��Φ��w�� PKCS#11 �ҲաC

�Y�n�ϥ� modutil �w�� PKCS#11 �ҲաA�а��U�C�B�J�G

  1. �T�w��F�Ҧ���A�� (�]�A Administration Server)�C
  2. ���ܥ]�t��Ʈw�� server_root/alias �ؿ��C
  3. �N server_root/bin/https/admin/bin �W�[�ܱz�� PATH ���C
  4. �b server_root/bin/https/admin/bin ����� modutil�C
  5. �]�w��ҡC�Ҧp�G
    • �b UNIX �W�Gsetenv
    • LD_LIBRARY_PATH server_root/bin/https/lib:${LD_LIBRARY_PATH}

    • �b IBM-AIX �W�GLIBPATH
    • �b HP-UX �W�GSHLIB_PATH
    • �b Windows �W�A�N�H�U���e�W�[�� PATH

      LD_LIBRARY_PATH server_root/bin/https/bin

      �z�i�H�b�H�U�ؿ���z��� PATH�Gserver_root/https-admin/start�C

  6. ��J��O�Gmodutil�C
  7. �N�C�X�U�ؿﶵ�C

  8. ���һݪ��ʧ@�C
  9. �Ҧp�A�n�b UNIX ���W�[ PCKS#11 �ҲաA�z�ݭn��J�G

    modutil -add (PCKS#11 �ɮת��W��) -libfile (PCKS#11 �� libfile) -nocertdb -dbdir (�z�� db �ؿ�)�C

�ϥ� pk12util

�ϥ� pk12util �i�H�q������Ʈw���ץX�ҮѩM���_�A�ñN��פJ�����Υ~�� PKCS#11 �ҲաC�z�i�H�N�ҮѩM���_�l�׶ץX�ܤ�����Ʈw�A��h�ƥ~���O�����|���\�z�ץX�ҮѩM���_�C�̹w�]�Apk12util �ϥΦW�� cert8.db �M key3.db ���ҮѩM���_��Ʈw�C

�z�L pk12util �ץX

�Y�n�q������Ʈw���ץX�ҮѩM���_�A�а��U�C�B�J�G

  1. ���ܥ]�t��Ʈw�� server_root/alias �ؿ��C
  2. �N server_root/bin/https/admin/bin �W�[�ܱz�� PATH ���C
  3. �b server_root/bin/https/admin/bin ����� pk12util�C
  4. �]�w��ҡC�Ҧp�G
    • �b UNIX �W�Gsetenv
    • LD_LIBRARY_PATH/server_root/bin/https/lib:${LD_LIBRARY_PATH}

    • �b IBM-AIX �W�GLIBPATH
    • �b HP-UX �W�GSHLIB_PATH
    • �b Windows �W�A�N�H�U���e�W�[�� PATH
    • LD_LIBRARY_PATH server_root/bin/https/bin

      �z�i�H�b�H�U�ؿ���z��� PATH�Gserver_root/https-admin/start�C

  5. ��J��O�Gpk12util�C
  6. �N�C�X�U�ؿﶵ�C

  7. ���һݪ��ʧ@�C
  8. �Ҧp�A�b UNIX ���A�z�ݭn��J�G

    pk12util -o certpk12 -n Server-Cert [-d /server/alias] [-P https-test-host]

  9. ��J��Ʈw�K�X�C
  10. ��J pkcs12 �K�X�C
�z�L pk12util �פJ

�Y�n�N�ҮѩM���_�פJ�����Υ~�� PKCS#11 �ҲաA�а��U�C�B�J�G

  1. ���ܥ]�t��Ʈw�� server_root/alias �ؿ��C
  2. �N server_root/bin/https/admin/bin �W�[�ܱz�� PATH ���C
  3. �b server_root/bin/https/admin/bin ����� pk12util�C
  4. �]�w��ҡC�Ҧp�G
    • �b UNIX �W�Gsetenv
    • LD_LIBRARY_PATH/server_root/bin/https/lib:${LD_LIBRARY_PATH}

    • �b IBM-AIX �W�GLIBPATH
    • �b HP-UX �W�GSHLIB_PATH
    • �b Windows �W�A�N�H�U���e�W�[�� PATH
    • LD_LIBRARY_PATH server_root/bin/https/bin

      �z�i�H�b�H�U�ؿ���z��� PATH�Gserver_root/https-admin/start�C

  5. ��J��O�Gpk12util�C
  6. �N�C�X�U�ؿﶵ�C

  7. ���һݪ��ʧ@�C
  8. �Ҧp�A�b UNIX ���A�z�ݭn��J�G

    pk12util -i pk12_sunspot [-d certdir][-h nCipher][-P https-jones.redplanet.com-jones-]

    -P ������b -h ����A�åB�����O�̫�@�Ӥ޼ơC

    ��J���T���O���W�١A�]�A�j�g�r�)M�޸��������Ů�C

  9. ��J��Ʈw�K�X�C
  10. ��J pkcs12 �K�X�C�z�L�Y�ӥ~���ҮѱҰʦ�A���C

�p�G��A�����ҮѦw�˦b�~�� PKCS#11 �Ҳ� (�Ҧp�A�w��[�t��) ���A��A���N�L�k�ϥθ��ҮѶi��ҰʡA���D�z�� server.xml �i��s��A�Ψ̦p�U�ҭz�ӫ�w�ҮѦW�١C

��A���l�׹xըϥΦW���uServer-Cert�v���ҮѱҰʡC��~�� PKCS#11 �Ҳդ����ҮѱN�b�ѧO�X���]�t�ӼҲժ��Y�ӰO���W�١C�Ҧp�A�W���usmartcard0�v���~�����z�dŪ��W�w�˪���A���Ү�3�W���usmartcard0:Server-Cert�v�C

�Y�n�ϥΦw�˦b�~���Ҳդ����ҮѱҰʦ�A���A�N�ݭn������A������ť�M���r��w�ҮѦW�١C

����ť�M���r����ҮѦW��

�Y�n����ť�M���r����ҮѦW�١A�а��U�C�B�J�G


�Ƶ�

�p�G���b��ť�M���r�W�ҥ� [Security]�A�h���|�C�X�ҮѪ���T�C�Y�n����ť�M���r����ҮѦW�١A����T�w�w�ҥΤF�ӮM���r�W���w���ʡC�p�ݧ�h��T�A�аѾ\�u����ť�M���r�ҥΦw�����v�C


  1. �s�� [Administration Server] �� [Server Manager]�A�M���� [Preferences] ���ҡC
  2. ��� [Server Manager]�A�z������q�U�Ԧ��M�椤����A����ҡC

  3. ��� [Preferences] ���� (�p�G�|�����)�C
  4. ��@�U [Edit Listen Sockets] �s���C
  5. �ù�W�|��� [Edit Listen Sockets] �����C

  6. ��@�U�n�P�Ү����p����ť�M���r�ҹ�3�� [Listen Socket Id] �s���C
  7. �ù�W�|��� [Edit Listen Socket] �����C

  8. �q [Server Certificate Name] �U�Ԧ��M�椤����ť�M���r����A���ҮѡC
  9. �ӲM��]�t�Ҧ��w�w�˪������M�~���ҮѡC


    �Ƶ�

    �p�G���w�˥���A���ҮѡA�N���ĵ�i�ӫD [Server Certificate Name] �U�Ԧ��M��C


  10. ��@�U [OK]�C
  11. ��� [Server Manager]�A��@�U [Apply]�A�M���@�U [Restart] �H���ܧ�ͮġC

�z�]�i�H��ʽs�� server.xml �ɮסA���A���z�L�Ӧ�A���ҮѱҰʡC�N SSLPARAMS ���� servercertnickname �ݩ��ܧ󬰡G

�Y�n�d�� $TOKENNAME �ϥΪ��ȡA�в��ܦ�A���� [Security] ���Ҩÿ�� [Manage Certificates] �s���C��z�n�J���x�s Server-Cert ���~���ҲծɡA$TOKENNAME:$NICKNAME ��檺�M�椤�N��ܨ��ҮѡC


�Ƶ�

�p�G�����إߥi�H���Ʈw�A�h�|�b���~�� PKCS#11 �ҲեӽЩΦw���ҮѤ��ɬ��z�إߤ@�ӥi�H���Ʈw�C�إߪ��w�]��Ʈw�S���K�X�A�B�L�k�s��C�~���Ҳեi�H�u�@�A��z����ӽЩM�w�˦�A���ҮѡC�p�G�إߪ��w�]��Ʈw�S���K�X�A�Шϥ� [Security] ���ҩM [Create Database] �����ӳ]�w�K�X�C


FIPS-140 �з�

�z�L PKCS#11 API�A�z�i�H�P���[�K�@�~���n��εw��Ҳնi��q�T�C�b��A���W�w�� PKCS#11 ����A�z�i�H�� Sun ONE Web Server �i��t�m�A�H�Ϩ�P�p����T�B�z�з� (FIPS)-140 �ۮe�C�o�ǵ{���w�ȥ]�t�b SSL 3.0 �������C

�Y�n�ҥ� FIPS-140�A�а��U�C�B�J�G

  1. �̾� FIPS-140 ��������w�˸� Plug-in�C
  2. �s�� [Administration Server] �� [Server Manager]�A�M���� [Preferences] ���ҡC
  3. ��� [Server Manager]�A�z������q�U�Ԧ��M�椤����A����ҡC

  4. ��@�U [Edit Listen Sockets] �s���C
  5. �ù�W�|��� [Edit Listen Sockets] �����C���w����ť�M���r�A[Edit Listen Socket] ��������ܥi�Ϊ��w���ʳ]�w�C


    �Ƶ�

    �Y�n�ϥ� FIPS-140�A�нT�w�w�b���ť�M���r�W�ҥΤF�Ӧw���ʡC�p�ݧ�h��T�A�аѾ\�u����ť�M���r�ҥΦw�����v�C


  6. �q SSL ���� 3 �U�Ԧ��M���� [Enabled] (�p�G�|�����)�C
  7. �֨�A�? FIPS-140 �K�X�աG
    • (FIPS) 56 �줸�[�K�� DES �M SHA �T���{��
    • (FIPS) 168 �줸�[�K���T�� DES �M SHA �T���{��
  8. ��@�U [OK]�C
  9. ��� [Server Manager]�A��@�U [Apply]�A�M���@�U [Restart] �H���ܧ�ͮġC


�]�w�Τ�ݦw���ʻݨD

���i�O�@��A���w���ʪ��Ҧ��B�J��A�i�H���Τ�ݳ]�w��L�w���ʻݨD�C

�n�D�Τ�ݻ{��

�z�i�H�� Administration Server �M�C�Ӧ�A����ұҥΰ�ť�M���r�A�H�n�D�Τ�ݻ{�ҡC�ҥΥΤ�ݻ{�ҫ�A�������ѥΤ���ҮѡA��A���~��V�d�߶ǰe�^3�C

Sun ONE Web Server �䴩�z�L�ϥΤ���ҮѤ��� CA �Pñ�W�Τ���ҮѮɫH�� CA �ǰt�����ҥΤ���ҮѡC�z�i�H�b Administration Server �� [Manage Certificates] �������� [Security] �U�˵�ñ�W�Τ���ҮѮɫH�� CA �M��C���|�������� CA�G

�z�i�H�t�m Web ��A���A�H�ڵ����㦳�Ӧۥi�H�� CA �Τ���ҮѪ��Ҧ��Τ�ݡC�Y�n����Ωڵ��i�H�� CA�A�����w�g�� CA �]�w�F�Τ�ݫH��C�p�ݧ�h��T�A�аѾ\�u�޲z�Ү��v�C

�p�G�ҮѤw�L�aASun ONE Web Server �N�O���~�B�ڵ��ҮѨæV�Τ�ݶǦ^�@�h�T���C�]�i�H�b Administration Server �� [Manage Certificates] �������˵�w�L�j��ҮѡC

�z�i�H���A���i��t�m�A�H�K�q�Τ���ҮѦ�����T�èϨ�P LDAP �ؿ�ϥΪ̶��ؤǰt�C�o�˥i�H�T�w�Τ�ݾ֦����Ī��ҮѩM LDAP �ؿ���ءC�ӥB�٥i�H�T�w�Τ���ҮѻP LDAP �ؿ��ҮѬۤǰt�C�Y�n�A�Ѧp��i�榹�@�~�A�аѾ\�u�N�Τ���Үѹ�M�� LDAP�v�C

�z�i�H�N�Τ���ҮѩM�s���X�ϥΡA�H�K���F�Ӧۥi�H�� CA �H�~�A�P�Ү����p���ϥΪ��٥����P�s���W�h (ACL) �ۤǰt�C�p�ݧ�h��T�A�аѾ\�u�ϥΦs����ɮ��v�C

�z�]�i�H�B�z�Τ���ҮѪ���T�C�p�ݧ�h��T�A�аѾ\�uSun ONE Web Server 6.1 NSAPI Programmer's Guide�v�C

�ӽХΤ�ݻ{��

�Y�n�ӽХΤ�ݻ{�ҡA�а��U�C�B�J�G

  1. �s�� [Administration Server] �� [Server Manager]�A�M���� [Preferences] ���ҡC
  2. ��� [Server Manager]�A�z������q�U�Ԧ��M�椤����A����ҡC

  3. ��@�U [Edit Listen Sockets] �s���C
  4. �ù�W�|��� [Edit Listen Sockets] �����C

  5. ��@�U�n�ӽХΤ�ݻ{�Ҫ���ť�M���r�ҹ�3�� [Listen Socket Id] �s���C
  6. �ù�W�|��� [Edit Listen Socket] �����C

  7. �Y�n����ť�M���r�ӽХΤ�ݻ{�ҡA�бq [Client Authentication] �U�Ԧ��M���� [Required]�C
  8. ��@�U [OK]�C
  9. ��� [Server Manager]�A��@�U [Apply]�A�M���@�U [Restart] �H���ܧ�ͮġC

    �Ƶ�

    �ثe�A�C�� Web ��A����ҥu���@�ӥi�H���ҮѸ�Ʈw�C�b�Ӧ�A����ҤU��檺�Ҧ��w�����&�A�����@�ΦP�@�ӥi�H��Τ�� CA �M��C�p�G��ӵ��&�A���ݭn���P���i�H�� CA�A�h�o�ǵ��&�A��3�Ӧb�㦳��W�i�H���Ʈw�����P��A����Ҥ����C


�N�Τ���Үѹ�M�� LDAP

���`���� Sun ONE Web Server �ΨӱN�Τ���Үѹ�M�� LDAP �ؿ�ت��{�ǡC

��A���q�Τ�ݨ�o�ӽЫ�A�N�b�B�z�ӽФ��e�mn�Τ�ݪ��ҮѡC�Y�ǥΤ�ݷ|�b�V��A���ǰe�ӽЪ��P�ɶǰe�Τ���ҮѡC


�Ƶ�

�N�Τ���Үѹ�M�� LDAP ���e�A�ٻݭn�]�w�һݪ� ACL�F�p�ݧ�h��T�A�аѾ\�u������A�����s���v�C


��A���N�x��˵�� CA �O�_�P Administration Server �����Y�ӥi�H�� CA �ǰt�C�p�G�䤣��ǰt�� CA�ASun ONE Web Server �N�פ�s�u�C�p�G�����ǰt�� CA�A��A���N�~��B�z�ӽСC

�����ҮѬO�Ӧۥi�H�� CA ����A��A���|�z�L�H�U�覡�N�Үѹ�M�� LDAP ���ءG

��A���ϥΦW�� certmap.conf ���Үѹ�M�ɮרӽT�w�p��i�� LDAP �j�M�C��M�ɮױN�i�D��A���n�ϥΥΤ���ҮѤ������ǭ� (�p�@��ϥΪ̪��W�١B�q�l�l���}��)�C��A���N�ϥγo�ǭȷj�M LDAP �ؿ�ϥΪ̶��ءA���A������ݭn�T�w�q LDAP �ؿ���Ӧ�m�}�l�j�M�C�Үѹ�M�ɮפ]�|�i�D��A���}�l�j�M����m�C

��A���A�ѤF�}�l�j�M����m�M�ݭn�j�M�����e (�B�J 1) ����A�N�b LDAP �ؿ���j�M (�B�J 2)�C�p�G�����ǰt���ةΧ��h�Ӥǰt���ءA�åB���]�w��M�H�����ҮѡA�j�M�N���ѡC�p�ݦ���w�wj�M���G�欰������M��A�аѾ\�U��u�� 6-1�v�C�Ъ`�N�A�z�i�H�b ACL ����w�w�j��欰�A�Ҧp�A�z�i�H��w Sun ONE Web Server �b�ҮѤǰt���Ѯɶȱ���z�C�p�ݦ���p��]�w ACL �ߦn�]�w����h��T�A�аѾ\�u�ϥΦs����ɮ��v�C

�� 6-1  LDAP �j�M���G

LDAP �j�M���G

�Ү����ҡu�}�ҡv

�Ү����ҡu��v

����춵��

�{�ҥ���

�{�ҥ���

��n���@�Ӷ���

�{�ҥ���

�{�Ҧ��\

���h�Ӷ���

�{�ҥ���

���v����

��A���b LDAP �ؿ���ǰt�����ةM�Үѫ�A�N�i�H�ϥθӸ�T�B�z���ʡC�Ҧp�A�Y�Ǧ�A���ϥ��ҮѨ� LDAP ����M�ӽT�w��Y�Ӧ�A�����s���v���C

�ϥ� certmap.conf �ɮ�

�Үѹ�M�Ω�T�w��A���b LDAP �ؿ�d��ϥΪ̶��ت��覡�C�z�i�H�ϥ� certmap.conf �t�m�Ү� (�̦W�٫�w) ��M�� LDAP ���ت��覡�C�z�i�H�s�覹�ɮרüW�[���ءA�H�ǰt LDAP �ؿ��´�M�C�X�z�Ʊ�ϥΪ֦̾����ҮѡC�ϥΪ̥i�H��� subjectDN ���ϥΪ��ϥΪ� ID�B�q�l�l���}�Υ���L�ȶi��{�ҡC�S�O�O�A��M�ɮץi�w�q�H�U��T�G

�Үѹ�M�ɮצ��H�U��m�G

���ɮץ]�t�F�@�өΦh�Ӥw�R�W��M�A�C�ӹ�M���M�Ω󤣦P�� CA�C��M���y�k�p�U�G

�Ĥ@��Ω��w���ت��W�٥H�ΧΦ� CA �ҮѤ��ϧO�W�٪��ݩʡC�ӦW�٬O��N���A�z�i�H�N��w�q���һݪ����W�١C��O�AissuerDN �����P�ֵo�Τ���ҮѪ� CA ���ֵo�� DN �����ǰt�C�Ҧp�A�H�U��� issuerDN ��Ȧb�9j�ݩʪ��Ů�W���Үt���A���A���N����Ӥ��P�����ءG

�w�R�W��M�����ĤG��M�H�᪺��i�H���ݩʻP�Ȭۤǰt�Ccertmap.conf �ɮפ��]�t���ӹw�]�S�� (�i�H�ϥ��Ү� API �ۭq�S��)�G

�p�ݦ���o�ǯS�ʪ���h��T�A�аѾ\�u��M�d���v

�إߦۭq�S��

�z�i�H�ϥΥΤ���Ү� API �إߦۤv���S�ʡC�p�ݦ���{���]�p�M�ϥΥΤ���Ү� API ����h��T�A�аѾ\�uNSAPI Programmer's Guide�v�C

�إߦۭq��M��A�N�i�H�ѷӥH�U�榡����M�G

<name>:library <path_to_shared_library>
<name>:InitFn <name_of_init_function>

�Ҧp�G

��M�d��

certmap.conf �ɮפ�3�ܤ֥]�t�@�Ӷ��ءC�H�U�d�Үi�ܤF�i�H�ϥ� certmap.conf �ɮת����P�覡�C

�d�� #1

���d�Ҫ�ܥu���@�ӡu�w�]�v��M�� certmap.conf �ɮסG

�ϥΥ��d�ҡA��A���i�H�b�]�t ou=<orgunit>, o=<org>, c=<country> ���ت� LDAP �$��I�B�}�l�j�M�A�䤤 <> ������r�N��N���Τ���ҮѤ��D�D DN ���ȡC

�M��A��A���N�ϥ��ҮѤ����q�l�l���}�M�ϥΪ� ID ���Ȧb LDAP �ؿ�j�M�ǰt�����ءC���ǰt�����خɡA��A���N���Τ�ݶǰe���ҮѩM�x�s�b�ؿ��ҮѡA�H���Ҹ��ҮѡC

�d�� #2

�H�U�d���ɮפ��]�A��ӹ�M�G�@�ӥΩ�w�]�A�t�@�ӥΩ���l�F�A�ȡG

�p�G��A����o���ҮѨӦ۬��l�F�A�ȥH�~����L�ϥΪ̡A�h��A���N�ϥιw�]��M�A�Y�q LDAP �𪺳��ݱҰʨ÷j�M�ǰt�Τ�ݹq�l�l���}�M�ϥΪ� ID �����ءC�p�G�ҮѨӦ۬��l�F�A�ȡA��A���N�q�]�t��´�椸�� LDAP �$�Ұʨ÷j�M�ǰt���q�l�l���}�C�ӥB�Ъ`�N�A�p�G�ҮѨӦ� USPS�A��A���N���Ҹ��ҮѡA�Ӥ��|���Ҩ�L�ҮѡC


ĵ�i

�ҮѤ����ֵo�� DN (�Y CA ����T) �����P��M���Ĥ@�椤�ҦC���ֵo�� DN �����ۦP�C�b�H�W�d�Ҥ��A�Ӧۮֵo�� DN (�Y o=United States Postal Service,c=US) ���ҮѴN���ǰt�A�]�� o �M c �ݩʤ����S���Ů�C


�d�� #3

�H�U�d�Ҩϥ� CmapLdapAttr �S�ʷj�M LDAP ��Ʈw���W�� certSubjectDN ���ݩʡA��ȻP�Τ���ҮѤ�����ӥD�D DN �����ǰt�C

�p�G�Τ���ҮѪ��D�D���G

��A���N����j�M�]�t�H�U��T�����ءG

�p�G���@�өΦh�Ӥǰt�����ءA��A���N�~�����ҦU���ءC�p�G�����ǰt�����ءA��A���N�ϥ� DNComps �M FilterComps �j�M�ǰt�����ءC�b���d�Ҥ��A��A���|�b o=LeavesOfGrass Inc, c=US �U���Ҧ����ؤ��j�M uid=Walt Whitman�C


�Ƶ�

���d�Ұ��] LDAP �ؿ�]�t�a�� certSubjectDN �ݩʪ����ءC



�]�w��j�K�X

[Stronger Ciphers] �ﶵ�i��z��ܥΩ�s�� 168 �줸�B128 �줸�� 56 �줸�j�p�����_�٥i��ܤ����w�j�p�����_�C�z�i�H��w���ŦX���w���ɨϥΪ��ɮסC�p�G����w�ɮסASun ONE Web Server �N�Ǧ^�uForbidden�v���A�C

�p�G�Ω�s��ҿ���_�j�p�P [Security Preferences] �U���ثe�K�X�]�w���@�P�ASun ONE Web Server �N��ܤ@���۲{����ܤ��Aĵ�i�z�ݭn�ҥαa����j���_�j�p���K�X�C

���_�j�p���w����I�ثe��� obj.conf ���� NSAPI PathCheck ��O�A�Ӥ��O Service fn=key-toosmall�C�ӫ�O���G

�䤤�A<nbits> �O���_���һݪ��̤p�줸�ơA<filename> �O���ŦX���w���ɨϥΪ��ɮ� (�ӫD URI) ���W�١C

�p�G���ҥ� SSL �Ϊ̥���w secret-keysize �ѼơAPathCheck �N�Ǧ^ REQ_NOACTION�C�p�G�ثe���q�@�~�����_�j�p�p���w�� secret-keysize�A�禡�N�Ǧ^���A�� PROTOCOL_FORBIDDEN �� REQ_ABORTED (�p�G����w bong-file) �Ψ�L REQ_PROCEED�A�åB�upath�v�ܼƳQ�]�w�� bong-file <filename>�C�ӥB�A�p�G���ŦX���_�j�p���w�A�ثe���q�@�~�� SSL ���q�@�~�֨�رN���ġA�]���U����P�@�ӥΤ�ݳs�u���A���ɡA�N�o�ͧ��㪺 SSL �洫�C


�Ƶ�

��b�u��j�K�X�v��椤�W�[ PathCheck fn=ssl-check �ɡA���N�����b���󤤧�쪺�Ҧ� Service fn=key-toosmall ��O�C


�Y�n�]�w��j�K�X�A��U�C�B�J�G

  1. �s�� [Server Manager] �ñq�U�Ԧ��M�椤����A����ҡC
  2. ��@�U [Virtual Server Class] ���ҡC
  3. �q�U�Ԧ��M����@�����O�ë�@�U [Manage]�C
  4. �ù�W�|��� [Class Manager] �����C

  5. ��� [Content Mgmt] ���ҡC
  6. ��� [Stronger Ciphers]�C
  7. ��ܳz�L�H�U�覡�i��s��G
    • �q�U�Ԧ��M�椤
    • ��@�U [Browse]
    • ��@�U [Wildcard]
  8. �����_�j�p�����w�G
    • 168 �줸�Χ�j
    • 128 �줸�Χ�j
    • 56 �줸�Χ�j
    • �L���w
  9. ��J�n�ڵ��s��T���Ҧb���ɮצ�m�C
  10. ��@�U [OK]�C
  11. ��@�U [Apply]�C
  12. ���w���Ұ�/���s�ҰʩΰʺA�M�ΡC

�p�ݧ�h��T�A�аѾ\�uIntroduction to SSL�v�C


�Ҷq��L�w���ʰ��D

���F�Y�ǨϥΪ̷|�xկ}�ѱz���[�K�H�~�A�٦s�b��L�w���ʭ��I�C����{�����I�Ӧۥ~���M�������b�ȡA�L�̨ϥΦU�ؤ�k�xզs��z����A���H�Φ�A���W����T�C

�]���A���F�b��A���W�ҥΥ[�K�~�A��3�Ĩ��B�~���w�����@���I�C�Ҧp�A�N��A�����b�@�Ӧw�����ж����A�����\��󤣥i�H��ϥΪ̱N�{���W��ܱz����A���C

�H�U�p�`�y�z�F���Ϧ�A����w���ү��檺�̭��n�ʧ@�G

�������s��

�o��²�檺�w����k�g�`�|�Q��ѡC�N��A�����b�@�ӤW�ꪺ�ж����A�u���g�L���v���ϥΪ̤~��i�J�өж��C�o�˥i�H������H��;��A��������C

�ӥB�A�n�O�@�n����޲z (��) �K�X (�p�G��)�C

����޲z�s��

�p�G�ϥλ��ݰt�m�A�нT�w�]�w�F�s���A�H�K�u��ּƨϥΪ̩M�q���i��޲z�C�p�G�Ʊ� Administration Server ���@��ϥΪ̴��ѹ� LDAP ��A���Υ���ؿ��T���s���v���A�ЦҶq���@��� Administration Server �M�ϥ��O���޲z�C�o�˱ҥΤF SSL �� Administration Server �i�@���D��A���A�ӥt�@�� Administration Server �h�Ω�@��ϥΪ̪��s��C

�p�ݦ����O������h��T�A�аѾ\�u����O���v�C

�z��3�Ӭ� Administration Server �}�ҥ[�K�\��C�p�G���N SSL �s�u�Ω�޲z�A����z�L�D�[�K������滷�ݦ�A���޲z��3�Ӯ�~�p�ߡA�]�����H���i�H�I��z���޲z�K�X�í��s�t�m�z����A���C

��ܥi�a���K�X

�z�i�H�b��A�����ϥΦh�ӱK�X�G�޲z�K�X�B�p�K���_�K�X�B��Ʈw�K�X�����C�޲z�K�X�O�����K�X���̭��n���@�ӡA�]������ӱK�X���ϥΪ̧��i�H�b�z���q���W�t�m����A���C�p�K���_�K�X�O�����n���K�X�C�p�G�Y�ӨϥΪ̨�o�F�z���p�K���_�M�p�K���_�K�X�A�h�i�H�إ߰���A�� (���˦��z����A��)�A�Ϊ̺I��M�ܧ�z��A�����q�T��T�C

�K�X�̦n�O�K��z�ۤv�O�СA�L�H�S�L�k�q��C�Ҧp�A�z�i�H�N MCi12!mo �O���uMy Child is 12 months old!�v�C���n�ϥΫĤl���m�W�Υͤ�@���K�X�C

�إ���H�}�Ѫ��K�X

�H�U�o��²�檺��ɭ�h�i0�U�z�إߧ�n���K�X�C

�����N�H�U�����W�h���Ω�@�ӱK�X�A��ϥΪ��W�h�V�h�A�z���K�X�N�V��H�Q�}�ѡG

�ܧ�K�X�� PIN

�w���ܧ�z���i�H���Ʈw/���_���ɮױK�X�� PIN �O�@�Ӧn�ߺD�C�p�G�b Administration Server ���ҥΤF SSL�A�h�Ұʦ�A���ɻݭn���K�X�C�w���ܧ�K�X�i�H�W�[���A�����B�~�O�@�C

�u��b�����W�ܧ󦹱K�X�C�p�ݦ����ܧ�K�X���`�N�ƶ��M��A�аѾ\�u�إ���H�}�Ѫ��K�X�v�C

�ܧ�K�X

�Y�n�ܧ� Administration Server �Φ�A����Ҫ��i�H���Ʈw/���_���ɮױK�X�A�а��U�C�B�J�G

  1. �s�� [Administration Server] �� [Server Manager]�C
  2. ��� [Server Manager]�A�z������q�U�Ԧ��M�椤����A����ҡC

  3. ��� [Change Password] �s���C
  4. �q�U�Ԧ��M�椤���n�b�䤤�ܧ�K�X���w���ʰO���C
  5. �̹w�]�A�������_��Ʈw���w���ʰO�����uinternal�v�C�p�G�w�ˤF PKCS#11 �ҲաA�h�|�ݨ�C�X���Ҧ��O���C��@�U [Change Password] �s���C

  6. ��J�ثe�K�X�C
  7. ��J�s�K�X�C
  8. �A����J�s�K�X�C
  9. ��@�U [OK]�C
  10. ��� [Server Manager]�A��@�U [Apply]�A�M���@�U [Restart] �H���ܧ�ͮġC

�T�w�z�����_���ɮר��O�@�CAdministration Server �N���_���ɮ��x�s�b server_root/alias �ؿ�C�ЦҶq���ɮשM�ؿ�u��Q�z�q���W�w�˪� Sun ONE ��A��Ū��C

�A�ѳƥ�ϱa�W�O�_�x�s�F���ɮץH�Ψ�L�H�O�_���I����ɮפ]�ܭ��n�C�p�G�x�s�F���ɮסA�h�������O�@��A���@�˺ɤO�O�@�z���ƥ�C

�����A���W����L3�ε{��

��Ҧ�3�ε{�����b�@����A�����P�@�x��W���ɡA�ݭn��~�p�ߡC�Q�Φ�A���W��檺��L�{�������|�}�i�H�׶}��A�����w���O�@�C�а��ΩҦ������n���{���M�A�ȡC�Ҧp�AUNIX sendmail �`�n�{����H�i��w���a�t�m�A�]���]�N�i�H���i��{���]�p�A�H�b��A����W����L�i�঳�`���{���C

UNIX �M Linux

�J�ӿ�ܱq inittab �M rc �{���ɱҰʪ��{�ǡC�Фűq��A������ telnet �� rlogin�C�åB�A�]��3�Ӧb��A����W��� rdist (����O�i�ΨӤ0t�ɮסA��]�i�Ω��s��A����W���ɮ�)�C

Windows

�P��L��@�κϺо�M�ؿ�ɭn��~�p�ߡC�ӥB�A�n�Ҷq���ǨϥΪ̨㦳�b���� Guest �v���C

�P�ˡA�b��A���W�w�˭��ǵ{���H�άO�_���\��L�ϥΪ̦b��A���W�i��w�˳��n��~�p�ߡC��L�ϥΪ̪��{���i��|�s�b�w���|�}�C���V�|���O�A���H�i��|�W���h���c�N���{���A�ت��N�O�}�a�z���w���ʡC�b�z����A���W�w�˵{�����e�@�w�n�J���ˬd�o�ǵ{���C

����Τ�ݧ֨� SSL �ɮ�

�z�L�b HTML �ɮת� <HEAD> ���$��W�[�H�U��A�i�H����Τ�ݧ֨�[�K���ɮסG

����s����

���ξ�W���ϥΪ��Ҧ��s����C�ϥθ�Ѿ��Ψ�����t�m�H����P����̤p�s���𶰥H�~�����s����i��i�Ӫ��s�u�C�o�N��ۨ�o��W Shell ���ߤ@��k�N�O��ڨϥΦ�A������A�Ӿ�3�Ӧb�@�ӭ��w���ϰ줺�C

�A�Ѧ�A��������

��A�����ѤF��A���M�Τ�ݤ������w���s�u�C�Τ�ݨ�o��T����A��A���J�L�k�����T���w���ʡA�]�L�k������A��������Ψ�ؿ�M�ɮת��s��C

�A�ѳo�ǭ���U��z�z�ѭn�קK���DZ��ΡC�Ҧp�A�z�i�H�z�L SSL �s�u��o�H�Υd���A��o�Ǹ��X�O�_�x�s�b��A����W���w���ɮפ��O�HSSL �s�u�פ��A�o�Ǹ��X�|��˩O�H�z3�ӹ�Τ�ݳz�L SSL �ǰe���z������T���w���ʭt�d�C

�i���L�ܧ�H�O�@��A��

�p�G�n�P�ɨϥΨ�O�@���M����O�@����A���A�h3�Ӧb��O�@����A���H�~����L��W��椣��O�@����A���C�p�G�z���귽�����A�����b�P�@�x��W��椣��O�@����A���M��O�@����A���A�а��H�U�@�~�G

chroot ���\�z�إ߲ĤG�Ӯڥؿ�A�H�����A���ϥίS�w���ؿ�C�N�ϥΦ��S�ʨӫO�@����O�@����A���C�Ҧp�A�z�i�H�N�ڥؿ�]�w�� /d1/ms�C����AWeb ��A���C���xզs��ڥؿ�A���|�u����o /d1/ms�C�p�G�xզs��O /dev�A�h�|��o /d1/ms/dev �����C�o���\�z�b UNIX/Linux �t�ΤW��� Web ��A���A�ӵL�ݱ¤������ڮڥؿ�U�����ɮת��s���v���C

��O�A�p�G�ϥΪ��O chroot�A�h�ݭn�b�%N�ڥؿ�U�]�w Sun ONE Web Server �һݪ�����ؿ�c�A�p�U�ϩҥܡG

�����&�A�����O��w chroot

�i�H�z�L���H�U�B�J�����&�A�����O��w chroot �ؿ�G

  1. �s�� [Server Manager] �ñq�U�Ԧ��M�椤����A����ҡC
  2. ��� [Virtual Server Class] ���ҡC
  3. ��@�U [Edit Classes] �s���C
  4. �T�w�Ʊ�b�䤤��w chroot �����O�� [Option] �]�w�� [Edit]�C
  5. ��@�U�����O�� [Advanced] ��s�C
  6. �ù�W�|��� [Virtual Servers CGI Settings] �����C

  7. �b [Chroot] ��줤��J���㪺��|�W�١C
  8. ��@�U [OK]�C
  9. ��@�U [Apply]�C
  10. ��� [Load Configuration Files] �H�ʺA�M�ΡC

�����&�A����w chroot

�i�H�z�L���H�U�B�J���S�w���&�A����w chroot �ؿ�G

  1. �s�� [Server Manager] �ñq�U�Ԧ��M�����A����ҡC
  2. ��� [Virtual Server Class] ���ҡC
  3. �q��A�������˵�A��@�U�n��w chroot �ؿ���&�A�����s���C
  4. ��� [Settings] ���ҡC
  5. �ù�W�|��� [Settings] �����C

  6. �b [Chroot Directory] ���䪺 [Set to] ��줤��J���㪺��|�W�١C
  7. ��@�U [OK]�C
  8. ��@�U [Apply]�C
  9. ��� [Load Configuration Files] �H�ʺA�M�ΡC

�z�]�i�H�ϥ� [Class Manager Virtual Servers] ���ҩM [CGI Settings] �s�������&�A����w chroot �ؿ�C

�p�ݦ���p�󬰵��&�A����w chroot �ؿ��h��T�A�аѾ\�uSun ONE Web Server 6.1 Programmer's Guide�v�C



�W�@��      �ؿ�      �d�      �U�@��     


Copyright 2004 Sun Microsystems, Inc. ���v�Ҧ��C