JP2008252219A - Server device and ssl server certificate issuing program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a server device and an SSL server certificate issuing program, for saving system-operator's burden in configuring and operating a system when issuing an SSL server certificate. <P>SOLUTION: A server device 100 equipped with a CPU 101 and a control program storage unit 102 has a server software setup unit 110 and an authentication station unit 120 configured with software. An authentication station structure device 111 generates a key pair by a key pair-CSR generating device 112, and determines a subject (object to be authenticated) of a root CA certificate 121 using a machine name of a server. An SSL server certificate issuing device 125 reads a CSR to issue and send an SSL server certificate to an SSL server certificate installation device 113. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a server device and an SSL server certificate issuance program, and more particularly to a server device and an SSL server certificate issuance program that perform encrypted communication.

  With the development of communication systems using communication networks such as the Internet, the importance of security technology during communication is increasing. In view of this, a technique called electronic signature for confirming that an electronic document to be communicated has a correct content by using an electromagnetic signature is used to prevent data falsification.

  Assume that A as one person transmits an electronic document to B as another person. In this case, A creates a plain text as an electronic document, and then compresses this plain text using a hash function to create a message digest. Then, this is encrypted using its own private key in a PKI (Public Key Infrastructures) system to create an electronic signature. A attaches an electronic signature to the above plain text, attaches a public key, and sends it to B using, for example, the Internet.

  B receives data sent from A via the Internet. Then, the digital signature is decrypted using the sent public key, and the message digest is extracted. In addition, the received plaintext is compressed using a hash function to create a message digest. It is determined whether these message digests match, and if they match, it can be seen that A who owns the private key corresponding to the sent public key has signed an electronic signature.

  By the way, encryption technology is used to generate an electronic signature necessary for personal authentication. The use of random numbers when performing encryption has been proposed as a first proposal (see, for example, Patent Document 1).

  FIG. 6 shows the outline of the first proposal. An information processing apparatus 401 such as a personal computer is connected to an IC (Integrated Circuit) card 403 via a predetermined communication device 402. The IC card 403 includes a microcomputer 404.

  The microcomputer 404 includes an I / O processing unit 411 that interfaces with the communication device 402, an electronic signature generation unit 412 that generates an electronic signature, and a random number generation unit 413. The random number generation unit 413 generates and supplies a random number when a request for a random number is received from the electronic signature generation unit 412. The electronic signature generation unit 412 encrypts input data with a random number, generates an electronic signature, and sends it to the communication device 402.

On the other hand, when a device and a client communicate via a network, it is proposed as a second proposal to use it as a guaranteed certificate without purchasing a certificate from outside the network (for example, Patent Document 2). reference). With this proposal, the device stores the root certificate signed with the private key, including the public key in the generated public / private key pair, in the storage means, and the root certificate is higher-level authenticated. A certificate creating means is prepared for creating a certificate including a station and signing the created certificate using a private key. Then, the certificate created by the certificate creating means is transmitted to the client. In addition, the client includes other storage means for storing the root certificate stored in the storage means, and verification means for verifying the signature of the certificate received from the device using a public key. ing.
JP 2000-242470 A (paragraphs 0018 to 0020, FIGS. 1 and 2) Japanese Patent Laying-Open No. 2005-006076 (paragraph 0012, FIGS. 1 and 2)

  However, according to such a conventional proposal, first, there is a problem that it is troublesome for a system operator to acquire and arrange an SSL (Secure Sockets Layer) server certificate. Conventionally, the server software or external software generates a private key / public key pair and creates a CSR (certificate request). The system operator receives the CSR file at the certificate authority and issues an SSL server certificate. Is going. The issued SSL server certificate must be set in the server software by the system operator. Therefore, there is a problem that it is very troublesome for the system operator to take each step.

  Further, according to such a conventional proposal, there is a problem that it takes time and effort for the system operator to construct and operate a certificate authority that issues an SSL server certificate. In other words, the system operator can generate a key pair, create a CSR (certificate request), and issue a self-signed certificate based on the CSR to create a root certificate in order to construct a certificate authority. Necessary. Further, in order to issue an SSL server certificate by a certificate authority, it is necessary to receive a CSR from server software, verify the CSR, and issue a certificate. It is troublesome for the system operator to take these steps.

  SUMMARY OF THE INVENTION Accordingly, an object of the present invention is to provide a server device and an SSL server certificate issuance program that can reduce the trouble of system construction and operation of a system operator when issuing an SSL server certificate.

  Another object of the present invention is to provide a server device and an SSL server certificate issuance program that can construct a secure communication path more efficiently.

  According to the first aspect of the present invention, (b) a key generating means for generating a pair of a private key and a public key when data is encrypted using an electronic certificate for communication, and (b) a unique value Certificate subject name setting means for setting the subject name as the name of the person who issues the certificate using (c), and (c) certification using the subject name of the certificate set by this certificate subject name setting means A certificate request generating means for generating a certificate request (CSR), and (d) sending a certificate request generated by the certificate request generating means to a certificate authority built in the own apparatus to request issuance of a server certificate. Server certificate issue request means, and (e) Corresponding to the private key and public key set by the key generation means when the certificate authority issues a server certificate based on the request from the server certificate issue request means Date To set thereby and a server certificate setting means to the server device.

  That is, in the present invention, the certificate subject name setting means sets the subject name by using a device name and a unique value using a random number as necessary, and uses this to set a certificate request (CSR). I am going to generate. Then, this certificate request is sent to the certificate authority built in the own device to request issuance of a server certificate. When the certificate authority issues a server certificate, it is received and the secret key set by the key generation means Setting to associate with public key. As a result, the SSL server certificate can be issued without the effort of the system operator.

  According to the sixth aspect of the present invention, a pair of a private key and a public key used when the server apparatus computer communicates by encrypting data using an electronic certificate as an SSL server certificate issuing program. (B) a certificate subject name setting process for setting the subject name as the name of the person who issues the certificate using a unique value, and (c) this certificate subject name Certificate request generation processing for generating a certificate request (CSR) using the subject name of the certificate set in the setting processing, and (d) constructing the certificate request generated by this certificate request generation processing in its own device Server certificate issuance request processing that is sent to the certificate authority that issued the request to issue a server certificate, and (e) the certificate authority issues a server certificate based on the request in this server certificate issuance request processing Is characterized in that to execute a server certificate setting process for setting associating a secret key and a public key set by the key generation processing received this time was.

  That is, in the present invention, the same technical idea as that of the invention described in claim 1 is executed by a computer as an SSL server certificate issuing program of the server device.

  As described above, according to the present invention, a key pair is generated and a CSR (certificate request) is generated by server software or external software, a CSR file is received by a certificate authority, and an SSL server certificate is issued. Since the SSL server certificate is set in the server software, the trouble of the system operator can be reduced. In addition, since the certificate authority that issues the SSL server certificate is built in the own apparatus, there is an effect that the operation is simplified.

  Hereinafter, the present invention will be described in detail with reference to examples.

  FIG. 1 shows the configuration of a server device that automatically issues an SSL server certificate according to an embodiment of the present invention. A server apparatus 100 that automatically issues a Secure Sockets Layer (SSL) server certificate includes a CPU (Central Processing Unit) 101, a control program storage unit 102 that stores a control program executed by the CPU 101, and a control program storage unit 102. The basic hardware unit 104 includes a working memory 103 that temporarily stores various data when executing the control program stored in the computer. When the CPU 101 in the basic hardware unit 104 executes the control program, the server device 100 functionally realizes the server software setup device 110 and the certificate authority device 120.

  The server software setup device 110 includes a certificate authority construction device 111, a key pair / CSR (Certificate Signing Request) creation device 112, and an SSL server certificate installation device 113. The certificate authority device 120 includes a root CA (Certificate Authority) certificate 121, a root CA private key 122, a CA information file 123, an SSL server certificate profile 124, and an SSL server certificate issuing device 125. .

  The server software setup device 110 constructs the certificate authority device 120 using the certificate authority construction device 111 during the process of step S201 for performing settings necessary for starting the server in various setup processes (step S202). It is like that. After the certificate authority device 120 is constructed, the subsequent processing moves from the certificate authority construction device 111 to the key pair / CSR creation device 112 (step S203).

  The key pair / CSR creation device 112 creates a key pair and CSR (certificate request) for SSL communication. Of these, the CSR (certificate request) is read by the SSL server certificate issuing device 125 of the certificate authority device 120 (step S204), and the SSL server certificate is issued. The issued SSL server certificate is sent to the SSL server certificate installing device 113 in the server software setup device 110 as shown in step S205.

  The SSL server certificate installation device 113 arranges the server certificate and the private key so that the server software can realize secure communication by SSL. Thereafter, various setup processes are taken over by the server software setup apparatus 110 as shown in step S206.

  By the way, the certificate authority device 120 generates various files such as the root CA certificate 121 and arranges them as necessary certificate authority configuration files in the SSL server certificate issuing device 125.

  FIG. 2 shows the state of automatic construction processing for a certificate authority. This will be described with reference to FIG. In this automatic construction process, a key pair is first generated (step S221). The generated key is used for a long time. For this reason, encryption algorithms such as a highly secure RSA (Rivest, Shamir, Adelman) 2048-bit encryption algorithm and an ECDSA (Elliptic Curve Digital Signature Algorithm) 256-bit circular curve encryption electronic signature algorithm And the key length.

  The generated private key must be encrypted and stored in a file. The password used for encryption is hashed using a summary function and data such as a value embedded in the certificate authority construction device 111 and a serial number of an OS (Operating System), and an SSL server certificate issuing device. The same password can be generated inside

  In the next step S222, the machine name is acquired. Then, the server machine name is added as a unique value to the subject (authentication target) of the root CA certificate 121 and determined. In addition, a random character string is generated using a random number generation means (not shown), and a unique subject is created if different servers are set up on the same machine.

  Since the subject, the public key, and the private key have been prepared as described above, the server software setup device 110 sends these pieces of information to the SSL server certificate issuing device 125 in the certificate authority device 120 in the next step S223, and self-signed. Issue a certificate. Here, the self-signed certificate is a certificate issued by the certificate authority device 120 to prove itself.

  The deadline for self-signed certificates is 10 to 20 years. Standardized by ITU (International Telecommunication Union) and ISO (International Organization for Standardization) of public key certificate standards. In 509, extended information can be set as an option. The extended information includes basic constraints (Basic Constraints), key usage (Key Usage), subject key identifier (Subject Key Identifier), and certificate authority identifier (Authority Key Identifier) as standard settings.

  Here, the basic constraint means information on whether the subject is CA (certificate issuer) or information on the maximum value of the hierarchy for verifying the certificate. The key usage indicates the purpose of use of the public key included in the certificate. The subject key identifier is information used to identify each public key possessed by the subject. The certificate authority identifier is information used to identify the public key that matches the private key that signed the certificate. Such extended information is automatically set. This self-signed certificate issued by the SSL server certificate issuing device 125 is used as the root CA certificate 121.

  In the last step S224, the CA necessary for operation is set and the CA information file 123 is generated. In addition, the SSL server certificate profile 124 for the SSL server certificate is also generated to complete the construction of the certificate authority (end).

  FIG. 3 shows a state of key pair generation and CSR creation processing for the SSL server certificate by the key pair / CSR creation device. Also in this case, the key pair is generated first (step S241). In order to use the same key pair for a certain period, the algorithm and key length of 1024 to 2048 bits encryption processing by the RSA method described above are used in consideration of security. Although other cryptographic processing algorithms can be adopted, the RSA method is the mainstream cryptographic algorithm in many current SSL implementations.

  The private key needs to be encrypted. As for the password for encryption, the same password can be generated inside the SSL server certificate issuing device 125 by hashing the data such as the certificate authority construction device 111 and the OS serial number shown in FIG. To.

  In the next step S242, the machine name is acquired and the subject of the SSL server certificate is determined. Here, the subject of the SSL server certificate is arbitrary. Basically, a random character string is generated, and a unique subject is set in the CSR (certificate request). If a server name is required for the server certificate, the server name or IP address (Internet Protocol address) is set as the common name (CN) of the subject.

  In the final step S243, a CSR is created and output to a file (END).

  FIG. 4 shows a procedure for issuing a certificate in the SSL server certificate issuing apparatus. This will be described with reference to FIG. The SSL server certificate issuing device 125 in the certificate authority device 120 reads the root CA private key 122 in step S261. The password used when decrypting the root CA private key 122 is generated by the certificate authority construction device 111 by hashing data such as a value embedded in the SSL server certificate issuing device 125 and the serial number of the OS. Use the same as.

  In the next step S262, the root CA certificate 121, CA information file 123 and SSL server certificate profile 124 necessary for CA operation are read.

  In the next step S263, the CSR created in step S243 in FIG. 3 is read to verify the signature.

  In the next step S264, an SSL server certificate is issued. The issued certificate is output as a file.

  Finally, in step S265, the CA information file 123, which is the management information read in step S262, is updated and the process ends (END).

  FIG. 5 shows an installation process by the SSL server certificate installation apparatus. The SSL server certificate installation device 113 in the server software setup device 110 shown in FIG. 1 first sets the root CA certificate 121 as a trust anchor (trusted CA certificate) (step S281).

  In the next step S282, the SSL server certificate issued in step S264 of FIG. 4 is set as the SSL server certificate for encrypted communication.

  In the last step S283, the secret key generated in step S241 in FIG. 3 is set as the SSL server secret key for encryption communication, and the process ends (END).

  Note that the server apparatus 100 described in the embodiment has a CRL (Certificate) that manages a list of SSL server certificates when the SSL server certificate issued by the SSL server certificate issuing apparatus 125 is erroneously issued or revoked. A Revocation List) management unit may be provided. The certificate authority device 120 in the server device 100 periodically issues these latest lists, so that other devices can check whether the SSL server certificate is valid.

  As described above, in this embodiment, a key pair is generated and a CSR (certificate request) is generated using server software or external software. Then, the certificate authority device 120 receives the CSR file, and issues an SSL server certificate in step 264 of FIG. Then, this SSL server certificate is set in the server software. For this reason, the trouble of the system operator can be reduced, and there is an effect that the acquisition and arrangement of the SSL server certificate are simplified.

  In general, the construction of the certificate authority apparatus 120 requires generation of a key pair, creation of a CSR (certificate request), and creation of a root certificate by issuing a self-signed certificate based on the CSR. It is. Further, in order to issue the SSL server certificate by the certificate authority device 120, it is necessary to receive the CSR from the server software, verify the CSR, and issue the certificate. In this embodiment, each of these steps is automated, so that the labor of the system operator can be reduced. Therefore, there is an effect that the construction and operation of the certificate authority device 120 that issues the SSL server certificate is simplified.

It is a block diagram showing the structure of the server apparatus in one Example of this invention. It is a flowchart showing the mode of automatic construction processing about a certificate authority in a present Example. It is the flowchart showing the key pair production | generation for SSL server certificates, and the CSR production | generation process by the key pair and CSR production | generation apparatus in a present Example. It is a flowchart showing the procedure of the certificate issue operation of the certificate authority in the SSL server certificate issuing device in this embodiment. It is a flowchart showing the mode of installation by the SSL server certificate installation apparatus in a present Example. It is a block diagram showing the outline | summary of the 1st proposal as a prior art.

Explanation of symbols

100 server apparatus 101 CPU
102 Control Program Storage Unit 110 Server Software Setup Device 111 Certificate Authority Construction Device 112 Key Pair / CSR Creation Device 113 SSL Server Certificate Installation Device 120 Certificate Authority Device 125 SSL Server Certificate Issuing Device

Claims (6)

A key generating means for generating a pair of a private key and a public key when communicating by encrypting data using an electronic certificate;
A certificate subject name setting means for setting a subject name as a name of a person who issues the certificate using a unique value;
A certificate request generation unit that generates a certificate request (CSR) using the subject name of the certificate set by the certificate subject name setting unit;
A server certificate issuance request means for sending the certificate request generated by the certificate request generation means to a certificate authority built in the own apparatus and requesting the issuance of a server certificate;
Server certificate setting means for receiving the certificate issued by the certificate authority based on the request from the server certificate issuance request means and setting the certificate to be associated with the private key and public key set by the key generation means And a server device.   2. The server device according to claim 1, wherein the unique value used by the certificate subject name setting unit includes a device name used to identify the own device from the other.   2. The server apparatus according to claim 1, wherein the unique value uses a random number in addition to the apparatus name.   The server apparatus according to claim 1, further comprising a certificate authority construction unit configured to construct the certificate authority in the self apparatus.   2. The server apparatus according to claim 1, further comprising CRL (Certificate Revocation List) issuing means for issuing a list of revoked server certificates set by the server certificate setting means. On the server device computer,
A key generation process for generating a pair of a private key and a public key when encrypting and communicating data using an electronic certificate;
A certificate subject name setting process for setting a subject name as a name of a person to whom the certificate is issued using a unique value;
A certificate request generation process for generating a certificate request (CSR) using the subject name of the certificate set in the certificate subject name setting process;
A server certificate issuance request process for requesting the issuance of a server certificate by sending the certificate request generated by the certificate request generation process to a certificate authority built in the own device;
Server certificate setting for receiving a certificate issued by the certificate authority based on a request in the server certificate issuance request process and setting the certificate to be associated with the private key and public key set in the key generation process An SSL server certificate issuance program characterized in that the processing is executed.

Images