ืคึผืจืึธื”ืึธืกื˜ืขืจ > ื‘ืœืึธื’ > ืึทื“ืžื™ื ื™ืกื˜ืจืึทืฆื™ืข > ืฆื•ื•ื™ื™-ืคืึทืงื˜ืึธืจ ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ืื•ื™ืฃ ื“ืขื ืคึผืœืึทืฅ ืžื™ื˜ ืึท ื•ืกื‘ ืกื™ืžืขืŸ. ืื™ืฆื˜ ืื•ื™ืš ืคึฟืึทืจ ืœื™ื ื•ืงืก

ืฆื•ื•ื™ื™-ืคืึทืงื˜ืึธืจ ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ืื•ื™ืฃ ื“ืขื ืคึผืœืึทืฅ ืžื™ื˜ ืึท ื•ืกื‘ ืกื™ืžืขืŸ. ืื™ืฆื˜ ืื•ื™ืš ืคึฟืึทืจ ืœื™ื ื•ืงืก

ืฆื•ื•ื™ื™-ืคืึทืงื˜ืึธืจ ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ืื•ื™ืฃ ื“ืขื ืคึผืœืึทืฅ ืžื™ื˜ ืึท ื•ืกื‘ ืกื™ืžืขืŸ. ืื™ืฆื˜ ืื•ื™ืš ืคึฟืึทืจ ืœื™ื ื•ืงืก
ะ’ ืื™ื™ื ืขืจ ืคื•ืŸ ืื•ื ื“ื–ืขืจ ืคืจื™ืขืจื“ื™ืงืŸ ืึทืจื˜ื™ืงืœืขืŸ ืžื™ืจ ื’ืขืจืขื“ื˜ ื•ื•ืขื’ืŸ ื“ื™ ื•ื•ื™ื›ื˜ื™ืงื™ื™ื˜ ืคื•ืŸ ืฆื•ื•ื™ื™-ืคืึทืงื˜ืึธืจ ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ืื•ื™ืฃ ืคึฟื™ืจืžืข ืคึผืึธืจื˜ืึทืœืก โ€‹โ€‹ืคื•ืŸ ืงืึธืžืคึผืึทื ื™ืขืก. ืœืขืฆื˜ืข ืžืึธืœ ืžื™ืจ ื“ืขืžืึทื ืกื˜ืจื™ื™ื˜ื™ื“ ื•ื•ื™ ืฆื• ืฉื˜ืขืœืŸ ื–ื™ื›ืขืจ ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ืื™ืŸ ื“ื™ IIS ื•ื•ืขื‘ ืกืขืจื•ื•ืขืจ.

ืื™ืŸ ื“ื™ ื‘ืึทืžืขืจืงื•ื ื’ืขืŸ, ืžื™ืจ ื–ืขื ืขืŸ ื’ืขื‘ืขื˜ืŸ ืฆื• ืฉืจื™ื™ึทื‘ืŸ ื™ื ืกื˜ืจืึทืงืฉืึทื ื– ืคึฟืึทืจ ื“ื™ ืžืขืจืกื˜ ืคึผืจืึธืกื˜ ื•ื•ืขื‘ ืกืขืจื•ื•ืขืจืก ืคึฟืึทืจ ืœื™ื ื•ืงืก - ื ื’ื™ื ืงืก ืื•ืŸ ืึทืคึผืึทื˜ืฉื™.

ื”ืืกื˜ ื’ืขืคืจืขื’ื˜ - ืžื™ืจ ื”ืื‘ืŸ ื’ืขืฉืจื™ื‘ืŸ.

ื•ื•ืึธืก ื˜ืึธืŸ ืื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ืึธื ื”ื™ื™ื‘ืŸ?

  • ืงื™ื™ืŸ ืžืึธื“ืขืจืŸ ืœื™ื ื•ืงืก ืคืึทืจืฉืคึผืจื™ื™ื˜ื•ื ื’. ืื™ืš ื”ืึธื‘ ื“ื•ืจื›ื’ืขืงืึธื›ื˜ ืึท ืคึผืจืึธื‘ืข ืกืขื˜ืึทืคึผ ืื•ื™ืฃ MX Linux 18.2_x64. ื“ืึธืก ืื™ื– ื“ืึธืš ื ื™ืฉื˜ ืึท ืกืขืจื•ื•ืขืจ ืคืึทืจืฉืคึผืจื™ื™ื˜ื•ื ื’, ืึธื‘ืขืจ ืขืก ื–ืขื ืขืŸ ืึทื ืœื™ื™ืงืœื™ ื“ื™ืคืขืจืึทื ืกื™ื– ืคึฟืึทืจ ื“ืขื‘ื™ืึทืŸ. ืคึฟืึทืจ ืื ื“ืขืจืข ื“ื™ืกื˜ืจื™ื‘ื™ื•ืฉืึทื ื–, ื“ื™ ืคึผืึทื˜ืก ืฆื• ื“ื™ ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ ืœื™ื™ื‘ืจืขืจื™ื– ืงืขืŸ ื–ื™ื™ืŸ ืึท ื‘ื™ืกืœ ืึทื ื“ืขืจืฉ.
  • ืกื™ืžืขืŸ. ืžื™ืจ ืคืึธืจื–ืขืฆืŸ ืฆื• ื ื•ืฆืŸ ื“ืขื ืžืึธื“ืขืœ Rutoken EDS PKI, ื•ื•ืึธืก ืื™ื– ื™ื“ืขืึทืœ ืื™ืŸ ื˜ืขืจืžื™ื ืขืŸ ืคื•ืŸ ื’ื™ื›ืงื™ื™ึทื˜ ืงืขืจืึทืงื˜ืขืจื™ืกื˜ื™ืงืก ืคึฟืึทืจ ืคึฟื™ืจืžืข ื ื•ืฆืŸ.
  • ืฆื• ืึทืจื‘ืขื˜ืŸ ืžื™ื˜ ืึท ืกื™ืžืขืŸ ืื™ืŸ ืœื™ื ื•ืงืก, ืื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ื™ื ืกื˜ืึทืœื™ืจืŸ ื“ื™ ืคืืœื’ืขื ื“ืข ืคึผืึทืงืึทื“ื–ืฉืึทื–:
    libccid libpcsclite1 pcscd pcsc-tools opensc

ืฆื•ื•ื™ื™-ืคืึทืงื˜ืึธืจ ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ืื•ื™ืฃ ื“ืขื ืคึผืœืึทืฅ ืžื™ื˜ ืึท ื•ืกื‘ ืกื™ืžืขืŸ. ืื™ืฆื˜ ืื•ื™ืš ืคึฟืึทืจ ืœื™ื ื•ืงืก

ืืจื•ื™ืกื’ืขื‘ืŸ ืกืขืจื˜ื™ืคื™ืงืื˜ืŸ

ืื™ืŸ ืคืจื™ืขืจื“ื™ืงืŸ ืึทืจื˜ื™ืงืœืขืŸ, ืžื™ืจ ืจื™ืœื™ื™ื“ ืื•ื™ืฃ ื“ื™ ืคืึทืงื˜ ืึทื– ืกืขืจื•ื•ืขืจ ืื•ืŸ ืงืœื™ืขื ื˜ ืกืขืจื˜ื™ืคื™ืงืึทืฅ ื•ื•ืขื˜ ื–ื™ื™ืŸ ืืจื•ื™ืก ืžื™ื˜ Microsoft CA. ืึธื‘ืขืจ ื–ื™ื ื˜ ืžื™ืจ ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ ืึทืœืฅ ืื™ืŸ ืœื™ื ื•ืงืก, ืžื™ืจ ื•ื•ืขืœืŸ ืื•ื™ืš ื–ืึธื’ืŸ ืื™ืจ ื•ื•ืขื’ืŸ ืึทืŸ ืึธืœื˜ืขืจื ืึทื˜ื™ื•ื• ื•ื•ืขื’ ืฆื• ืึทืจื•ื™ืกื’ืขื‘ืŸ ื“ื™ ืกืขืจื˜ื™ืคื™ืงืึทืฅ - ืึธืŸ ืคืึทืจืœืึธื–ืŸ ืœื™ื ื•ืงืก.
ืžื™ืจ ื•ื•ืขืœืŸ ื ื•ืฆืŸ XCA ื•ื•ื™ CA (https://hohnstaedt.de/xca/), ื•ื•ืึธืก ืื™ื– ื‘ื ื™ืžืฆื ืื•ื™ืฃ ืงื™ื™ืŸ ืžืึธื“ืขืจืŸ ืœื™ื ื•ืงืก ืคืึทืจืฉืคึผืจื™ื™ื˜ื•ื ื’. ืึทืœืข ื“ื™ ืึทืงืฉืึทื ื– ื•ื•ืึธืก ืžื™ืจ ื•ื•ืขืœืŸ ื“ื•ืจื›ืคื™ืจืŸ ืื™ืŸ XCA ืงืขื ืขืŸ ื–ื™ื™ืŸ ื“ื•ืจื›ื’ืขืงืึธื›ื˜ ืื™ืŸ ื“ื™ ื‘ืึทืคึฟืขืœืŸ ืฉื•ืจื” ืžืึธื“ืข ื ื™ืฆืŸ ื“ื™ OpenSSL ืื•ืŸ pkcs11-ืžื›ืฉื™ืจ ื™ื•ื˜ื™ืœืึทื˜ื™ื–, ืึธื‘ืขืจ ืคึฟืึทืจ ื’ืจืขืกืขืจืข ืคึผืึทืฉื˜ืขืก ืื•ืŸ ืงืœืขืจื™ื˜ื™, ืžื™ืจ ื•ื•ืขืœืŸ ื ื™ืฉื˜ ืคืึธืจืฉื˜ืขืœืŸ ื–ื™ื™ ืื™ืŸ ื“ืขื ืึทืจื˜ื™ืงืœ.

ื’ืขื˜ื™ื ื’ ืกื˜ืึทืจื˜ืขื“

  1. ื™ื ืกื˜ืึทืœื™ืจืŸ: 
    $ apt-get install xca
  2. ืื•ืŸ ืžื™ืจ ืœื•ื™ืคืŸ: 
    $ xca
  3. ืžื™ืจ ืžืึทื›ืŸ ืื•ื ื“ื–ืขืจ ื“ืึทื˜ืึทื‘ื™ื™ืก ืคึฟืึทืจ CA - /root/CA.xdb
    ืžื™ืจ ืจืขืงืึธืžืขื ื“ื™ืจืŸ ืกื˜ืึธืจื™ื ื’ ื“ื™ ืกืขืจื˜ื™ืคื™ืงืึทื˜ ืื•ื™ื˜ืึธืจื™ื˜ืขื˜ ื“ืึทื˜ืึทื‘ื™ื™ืก ืื™ืŸ ืึท ื˜ืขืงืข ื•ื•ื• ื‘ืœื•ื™ื– ื“ืขืจ ืึทื“ืžื™ื ื™ืกื˜ืจืึทื˜ืึธืจ ื”ืื˜ ืึทืงืกืขืก. ื“ืึธืก ืื™ื– ื•ื•ื™ื›ื˜ื™ืง ืฆื• ื‘ืึทืฉื™ืฆืŸ ื“ื™ ืคึผืจื™ื•ื•ืึทื˜ ืฉืœื™ืกืœืขืŸ ืคื•ืŸ ื“ื™ ื•ื•ืึธืจืฆืœ ืกืขืจื˜ื™ืคื™ืงืึทืฅ, ื•ื•ืึธืก ื–ืขื ืขืŸ ื’ืขื ื™ืฆื˜ ืฆื• ืฆื™ื™ื›ืŸ ืึทืœืข ืื ื“ืขืจืข ืกืขืจื˜ื™ืคื™ืงืึทืฅ.

ืฉืึทืคึฟืŸ ืฉืœื™ืกืœืขืŸ ืื•ืŸ ื•ื•ืึธืจืฆืœ CA ื‘ืึทื•ื•ื™ื™ึทื–ืŸ

ื ืฆื™ื‘ื•ืจ ืฉืœื™ืกืœ ื™ื ืคืจืึทืกื˜ืจืึทืงื˜ืฉืขืจ (PKI) ืื™ื– ื‘ืื–ื™ืจื˜ ืื•ื™ืฃ ืึท ื›ื™ื™ืขืจืึทืจืงืึทืงืึทืœ ืกื™ืกื˜ืขื. ื“ื™ ื”ื•ื™ืคึผื˜ ื–ืึทืš ืื™ืŸ ื“ืขื ืกื™ืกื˜ืขื ืื™ื– ื“ื™ ื•ื•ืึธืจืฆืœ ืกืขืจื˜ืึทืคืึทืงื™ื™ืฉืึทืŸ ืื•ื™ื˜ืึธืจื™ื˜ืขื˜ ืึธื“ืขืจ ื•ื•ืึธืจืฆืœ CA. ืื™ืจ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ ืžื•ื–ืŸ ื–ื™ื™ืŸ ื‘ืืฉืืคืŸ ืขืจืฉื˜ืขืจ.

  1. ืžื™ืจ ืžืึทื›ืŸ ืึท RSA-2048 ืคึผืจื™ื•ื•ืึทื˜ ืฉืœื™ืกืœ ืคึฟืึทืจ ื“ื™ CA. ืฆื• ื˜ืึธืŸ ื“ืึธืก, ื’ื™ื™ืŸ ืฆื• ื“ื™ ืงื•ื•ื™ื˜ืœ ืคึผืจื™ื•ื•ืึทื˜ืข ืงื™ื– ืฉื˜ื•ืคึผืŸ ื ื™ื™ึท ืฉืœื™ืกืœ ืื•ืŸ ืื•ื™ืกืงืœื™ื™ึทื‘ืŸ ื“ื™ ืฆื•ื ืขืžืขืŸ ื˜ื™ืคึผ.
  2. ืฉื˜ืขืœืŸ ืึท ื ืึธืžืขืŸ ืคึฟืึทืจ ื“ื™ ื ื™ื™ึทืข ืฉืœื™ืกืœ ืคึผืึธืจ. ืื™ืš ื’ืขืจื•ืคืŸ ืขืก CA Key.
  3. ืžื™ืจ ืึทืจื•ื™ืกื’ืขื‘ืŸ ื“ื™ CA ื‘ืึทื•ื•ื™ื™ึทื–ืŸ ื–ื™ืš, ื ื™ืฆืŸ ื“ื™ ื‘ืืฉืืคืŸ ืฉืœื™ืกืœ ืคึผืึธืจ. ืฆื• ื˜ืึธืŸ ื“ืึธืก, ื’ื™ื™ืŸ ืฆื• ื“ื™ ืงื•ื•ื™ื˜ืœ ืกืขืจื˜ื™ืคื™ืงืึทื˜ืขืก ืื•ืŸ ื’ื™ื˜ ื ื™ื• ืกืขืจื˜ื™ืคื™ืงืึทื˜.
  4. ื–ื™ื™ื˜ ื–ื™ื›ืขืจ ืฆื• ืงืœื™ื™ึทื‘ืŸ SHA-256, ื•ื•ื™ื™ึทืœ ื ื™ืฆืŸ SHA-1 ืงืขื ืขืŸ ื ื™ื˜ ืžืขืจ ื–ื™ื™ืŸ ื’ืขื”ืืœื˜ืŸ ื–ื™ื›ืขืจ.
  5. ื–ื™ื™ื˜ ื–ื™ื›ืขืจ ืฆื• ืงืœื™ื™ึทื‘ืŸ ื•ื•ื™ ืึท ืžื•ืกื˜ืขืจ [ืคืขืœื™ืงื™ื™ึทื˜] CA. ื“ื• ื–ืืœืกื˜ ื ื™ืฉื˜ ืคืึทืจื’ืขืกืŸ ืฆื• ื“ืจื™ืงื˜ ืื•ื™ืฃ ืฆื•ืœื™ื™ื’ืŸ ืึทืœืข, ืึทื ื“ืขืจืฉ ื“ื™ ืžื•ืกื˜ืขืจ ืื™ื– ื ื™ืฉื˜ ื’ืขื•ื•ืขื ื“ื˜.
  6. ืื™ืŸ ื“ื™ ืงื•ื•ื™ื˜ืœ ื•ื ื˜ืขืจื˜ืขื ื™ืง ืงืœื™ื™ึทื‘ืŸ ืื•ื ื“ื–ืขืจ ืฉืœื™ืกืœ ืคึผืึธืจ. ื“ืึธืจื˜ ืื™ืจ ืงืขื ืขืŸ ืคึผืœืึธืžื‘ื™ืจืŸ ืึทืœืข ื“ื™ ื”ื•ื™ืคึผื˜ ืคืขืœื“ืขืจ ืคื•ืŸ ื“ื™ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ.

ืฆื•ื•ื™ื™-ืคืึทืงื˜ืึธืจ ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ืื•ื™ืฃ ื“ืขื ืคึผืœืึทืฅ ืžื™ื˜ ืึท ื•ืกื‘ ืกื™ืžืขืŸ. ืื™ืฆื˜ ืื•ื™ืš ืคึฟืึทืจ ืœื™ื ื•ืงืก

ืงืจื™ื™ื™ื˜ื™ื ื’ ืฉืœื™ืกืœืขืŸ ืื•ืŸ ืึท https ืกืขืจื•ื•ืขืจ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ

  1. ืื™ืŸ ืึท ืขื ืœืขืš ื•ื•ืขื’, ืžื™ืจ ืžืึทื›ืŸ ืึท RSA-2048 ืคึผืจื™ื•ื•ืึทื˜ ืฉืœื™ืกืœ ืคึฟืึทืจ ื“ื™ ืกืขืจื•ื•ืขืจ, ืื™ืš ื’ืขืจื•ืคืŸ ืขืก ืกืขืจื•ื•ื™ืจืขืจ ืฉืœื™ืกืœ.
  2. ื•ื•ืขืŸ ืื™ืจ ืฉืึทืคึฟืŸ ืึท ื‘ืึทื•ื•ื™ื™ึทื–ืŸ, ืžื™ืจ ืื•ื™ืกืงืœื™ื™ึทื‘ืŸ ืึทื– ื“ื™ ืกืขืจื•ื•ืขืจ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ ืžื•ื–ืŸ ื–ื™ื™ืŸ ื’ืขื—ืชืžืขื˜ ืžื™ื˜ ืึท CA ื‘ืึทื•ื•ื™ื™ึทื–ืŸ.
  3. ื“ื• ื–ืืœืกื˜ ื ื™ืฉื˜ ืคืึทืจื’ืขืกืŸ ืฆื• ืื•ื™ืกืงืœื™ื™ึทื‘ืŸ SHA-256.
  4. ืžื™ืจ ืงืœื™ื™ึทื‘ืŸ ื•ื•ื™ ืึท ืžื•ืกื˜ืขืจ [ืคืขืœื™ืงื™ื™ึทื˜] ื”ื˜ื˜ืคึผืก_ืกืขืจื•ื•ืขืจ. ื“ืจื™ืงื˜ ืื•ื™ืฃ ืฆื•ืœื™ื™ื’ืŸ ืึทืœืข.
  5. ื“ืขืจื ืึธืš ืื•ื™ืฃ ื“ื™ ื‘ืœืึทื˜ ื•ื ื˜ืขืจื˜ืขื ื™ืง ืื•ื™ืกืงืœื™ื™ึทื‘ืŸ ืื•ื ื“ื–ืขืจ ืฉืœื™ืกืœ ืื•ืŸ ืคึผืœืึธืžื‘ื™ืจืŸ ืื™ืŸ ื“ื™ ืคืืจืœืื ื’ื˜ ืคืขืœื“ืขืจ.

ืฆื•ื•ื™ื™-ืคืึทืงื˜ืึธืจ ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ืื•ื™ืฃ ื“ืขื ืคึผืœืึทืฅ ืžื™ื˜ ืึท ื•ืกื‘ ืกื™ืžืขืŸ. ืื™ืฆื˜ ืื•ื™ืš ืคึฟืึทืจ ืœื™ื ื•ืงืก

ืฉืึทืคึฟืŸ ืฉืœื™ืกืœืขืŸ ืื•ืŸ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ ืคึฟืึทืจ ื“ื™ ื‘ืึทื ื™ืฆืขืจ

  1. ื“ืขืจ ื‘ืึทื ื™ืฆืขืจ ืก ืคึผืจื™ื•ื•ืึทื˜ ืฉืœื™ืกืœ ื•ื•ืขื˜ ื–ื™ื™ืŸ ืกื˜ืึธืจื“ ืื•ื™ืฃ ืื•ื ื“ื–ืขืจ ืกื™ืžืขืŸ. ืฆื• ืึทืจื‘ืขื˜ืŸ ืžื™ื˜ ืื™ื, ืื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ื™ื ืกื˜ืึทืœื™ืจืŸ ื“ื™ PKCS #11 ื‘ื™ื‘ืœื™ืึธื˜ืขืง ืคึฟื•ืŸ ืื•ื ื“ื–ืขืจ ื•ื•ืขื‘ื–ื™ื™ื˜ืœ. ืคึฟืึทืจ ืคืึธืœืงืก ื“ื™ืกื˜ืจื™ื‘ื™ื•ืฉืึทื ื–, ืžื™ืจ ืคืึทืจืฉืคึผืจื™ื™ื˜ืŸ ืคืึทืจื˜ื™ืง ืคึผืึทืงืึทื“ื–ืฉืึทื–, ื•ื•ืึธืก ื–ืขื ืขืŸ ืœื™ื’ืŸ ื“ืึธ - https://www.rutoken.ru/support/download/pkcs/. ืžื™ืจ ืื•ื™ืš ื”ืึธื‘ืŸ ืึทืกืขืžื‘ืœื™ื– ืคึฟืึทืจ arm64, armv7el, armv7hf, e2k, mipso32el, ื•ื•ืึธืก ืงืขื ืขืŸ ื–ื™ื™ืŸ ื“ืึทื•ื ืœืึธื•ื“ื™ื“ ืคึฟื•ืŸ ืื•ื ื“ื–ืขืจ SDK - https://www.rutoken.ru/developers/sdk/. ืื™ืŸ ืึทื“ื™ืฉืึทืŸ ืฆื• ืึทืกืขืžื‘ืœื™ื– ืคึฟืึทืจ ืœื™ื ื•ืงืก, ืขืก ื–ืขื ืขืŸ ืื•ื™ืš ืึทืกืขืžื‘ืœื™ื– ืคึฟืึทืจ ืžืึทืงืึธืก, ืคืจืขืขื‘ืกื“ ืื•ืŸ ืึทื ื“ืจื•ื™ื“.
  2. ืึทื“ื™ื ื’ ืึท ื ื™ื™ึทืข PKCS #11 ืคึผืจืึทื•ื•ื™ื™ื“ืขืจ ืฆื• XCA. ืฆื• ื˜ืึธืŸ ื“ืึธืก, ื’ื™ื™ืŸ ืฆื• ื“ื™ ืžืขื ื™ื• ืึธืคึผืฆื™ืขืก ืฆื• ื“ื™ ืงื•ื•ื™ื˜ืœ PKCS #11 ืคึผืจืึทื•ื•ื™ื™ื“ืขืจ.
  3. ืžื™ืจ ื“ืจื™ืงืŸ ืฆื•ื’ืขื‘ืŸ ืื•ืŸ ืกืขืœืขืงื˜ื™ืจืŸ ื“ืขื ื“ืจืš ืฆื• ื“ื™ PKCS #11 ื‘ื™ื‘ืœื™ืึธื˜ืขืง. ืื™ืŸ ืžื™ื™ืŸ ืคืึทืœ ืขืก ืื™ื– usrliblibrtpkcs11ecp.so.
  4. ืžื™ืจ ื“ืึทืจืคึฟืŸ ืึท ืคืึธืจืžืึทื˜ื˜ืขื“ Rutoken EDS PKI ื˜ืึธืงืขืŸ. ืืจืืคืงืืคื™ืข ื“ื™ rtAdmin ื ื•ืฆืŸ - https://dev.rutoken.ru/pages/viewpage.action?pageId=7995615
  5. ืžื™ืจ ืคื™ืจืŸ ืื•ื™ืก 
    $ rtAdmin -f -q -z /usr/lib/librtpkcs11ecp.so -u <PIN-ะบะพะด ะฟะพะปัŒะทะพะฒะฐั‚ะตะปั>
  6. ืžื™ืจ ืื•ื™ืกืงืœื™ื™ึทื‘ืŸ ื“ื™ RSA-2048 ืฉืœื™ืกืœ ืคึฟืึทืจ ื“ื™ Rutoken EDS PKI ื•ื•ื™ ื“ืขืจ ืฉืœื™ืกืœ ื˜ื™ืคึผ. ืื™ืš ื’ืขืจื•ืคืŸ ื“ืขื ืฉืœื™ืกืœ ืงืœื™ืขื ื˜ ืฉืœื™ืกืœ.

    ืฆื•ื•ื™ื™-ืคืึทืงื˜ืึธืจ ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ืื•ื™ืฃ ื“ืขื ืคึผืœืึทืฅ ืžื™ื˜ ืึท ื•ืกื‘ ืกื™ืžืขืŸ. ืื™ืฆื˜ ืื•ื™ืš ืคึฟืึทืจ ืœื™ื ื•ืงืก

  7. ืึทืจื™ื™ึทืŸ ื“ื™ PIN ืงืึธื“. ืื•ืŸ ืžื™ืจ ื•ื•ืึทืจื˜ืŸ ืคึฟืึทืจ ื“ื™ ืงืึทืžืคึผืœื™ืฉืึทืŸ ืคื•ืŸ ื™ื™ึทื–ื ื•ื•ืึทืจื’ ื“ื•ืจ ืคื•ืŸ ื“ื™ ืฉืœื™ืกืœ ืคึผืึธืจ

    ืฆื•ื•ื™ื™-ืคืึทืงื˜ืึธืจ ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ืื•ื™ืฃ ื“ืขื ืคึผืœืึทืฅ ืžื™ื˜ ืึท ื•ืกื‘ ืกื™ืžืขืŸ. ืื™ืฆื˜ ืื•ื™ืš ืคึฟืึทืจ ืœื™ื ื•ืงืก

  8. ืžื™ืจ ืžืึทื›ืŸ ืึท ื‘ืึทื•ื•ื™ื™ึทื–ืŸ ืคึฟืึทืจ ื“ื™ ื‘ืึทื ื™ืฆืขืจ ื“ื•ืจืš ืึทื ืึทืœืึทื“ื–ืฉื™ ืžื™ื˜ ื“ื™ ืกืขืจื•ื•ืขืจ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ. ื“ืึธืก ืžืึธืœ ืžื™ืจ ืื•ื™ืกืงืœื™ื™ึทื‘ืŸ ืึท ืžื•ืกื˜ืขืจ [ืคืขืœื™ืงื™ื™ึทื˜] HTTPS_client ืื•ืŸ ื˜ืึธืŸ ื ื™ื˜ ืคืึทืจื’ืขืกืŸ ืฆื• ื’ื™ื˜ ืฆื•ืœื™ื™ื’ืŸ ืึทืœืข.
  9. ืื™ืŸ ื“ื™ ืงื•ื•ื™ื˜ืœ ื•ื ื˜ืขืจื˜ืขื ื™ืง ืึทืจื™ื™ึทืŸ ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข ื•ื•ืขื’ืŸ ื“ืขื ื‘ืึทื ื™ืฆืขืจ. ืžื™ืจ ืขื ื˜ืคึฟืขืจืŸ ืื™ืŸ ื“ื™ ืึทืคืขืจืžืึทื˜ื™ื•ื• ืฆื• ื“ื™ ื‘ืงืฉื” ืฆื• ืจืึทื˜ืขื•ื•ืขืŸ ื“ื™ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ ืคึฟืึทืจ ื“ื™ ืกื™ืžืขืŸ.

ื•ื•ื™ ืึท ืจืขื–ื•ืœื˜ืึทื˜, ืื•ื™ืฃ ื“ื™ ืงื•ื•ื™ื˜ืœ ืกืขืจื˜ื™ืคื™ืงืึทืฅ ืื™ืŸ XCA ืื™ืจ ื–ืึธืœ ื‘ืึทืงื•ืžืขืŸ ืขืคึผืขืก ื•ื•ื™ ื“ืึธืก.

ืฆื•ื•ื™ื™-ืคืึทืงื˜ืึธืจ ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ืื•ื™ืฃ ื“ืขื ืคึผืœืึทืฅ ืžื™ื˜ ืึท ื•ืกื‘ ืกื™ืžืขืŸ. ืื™ืฆื˜ ืื•ื™ืš ืคึฟืึทืจ ืœื™ื ื•ืงืก
ื“ื™ ืžื™ื ื™ืžื•ื ื’ืึทื ื’ ืคื•ืŸ ืฉืœื™ืกืœืขืŸ ืื•ืŸ ืกืขืจื˜ื™ืคื™ืงืึทืฅ ืื™ื– ื’ืขื ื•ื’ ืฆื• ืึธื ื”ื™ื™ื‘ืŸ ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ ื“ื™ ืกืขืจื•ื•ืขืจืก ื–ื™ืš.

ืฆื• ืงืึทื ืคื™ื’ื™ืขืจ, ืžื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ืึทืจื•ื™ืกืคื™ืจืŸ ื“ื™ CA ื‘ืึทื•ื•ื™ื™ึทื–ืŸ, ืกืขืจื•ื•ื™ืจืขืจ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ ืื•ืŸ ืกืขืจื•ื•ืขืจ ืคึผืจื™ื•ื•ืึทื˜ ืฉืœื™ืกืœ.

ืฆื• ื˜ืึธืŸ ื“ืึธืก, ืกืขืœืขืงื˜ื™ืจืŸ ื“ืขื ื’ืขื•ื•ืืœื˜ ืคึผืึธื–ื™ืฆื™ืข ืื•ื™ืฃ ื“ื™ ืงืึธืจืึทืกืคึผืึทื ื“ื™ื ื’ ืงื•ื•ื™ื˜ืœ ืื™ืŸ XCA ืื•ืŸ ื’ื™ื˜ ืึทืจื•ื™ืกืคื™ืจืŸ.

ื ื’ื™ื ืงืก

ืื™ืš ื•ื•ืขืœ ื ื™ืฉื˜ ืฉืจื™ื™ึทื‘ืŸ ื•ื•ื™ ืฆื• ื™ื ืกื˜ืึทืœื™ืจืŸ ืื•ืŸ ืœื•ื™ืคืŸ ืึท nginx ืกืขืจื•ื•ืขืจ - ืขืก ื–ืขื ืขืŸ ื’ืขื ื•ื’ ืึทืจื˜ื™ืงืœืขืŸ ืื•ื™ืฃ ื“ืขื ื˜ืขืžืข ืื•ื™ืฃ ื“ืขืจ ืื™ื ื˜ืขืจื ืขืฅ, ื ื™ื˜ ืฆื• ื“ืขืจืžืึธื ืขืŸ ื“ื™ ื‘ืึทืึทืžื˜ืขืจ ื“ืึทืงื™ื•ืžืขื ื˜ื™ื™ืฉืึทืŸ. ื–ืืœ ืก ื‘ืึทืงื•ืžืขืŸ ื’ืœื™ื™ืš ืฆื• ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ HTTPS ืื•ืŸ ืฆื•ื•ื™ื™-ืคืึทืงื˜ืึธืจ ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ื ื™ืฆืŸ ืึท ืกื™ืžืขืŸ.

ืœื™ื™ื’ ื“ื™ ืคืืœื’ืขื ื“ืข ืฉื•ืจื•ืช ืฆื• ื“ื™ ืกืขืจื•ื•ืขืจ ืึธืคึผื˜ื™ื™ืœื•ื ื’ ืื™ืŸ nginx.conf:

server {
	listen 443 ssl;
	ssl_verify_depth 1;
	ssl_certificate /etc/nginx/Server.crt;
	ssl_certificate_key /etc/nginx/ServerKey.pem;
	ssl_client_certificate /etc/nginx/CA.crt;
	ssl_verify_client on;
}

ื ื“ื™ื˜ื™ื™ืœื“ ื‘ืึทืฉืจื™ื™ึทื‘ื•ื ื’ ืคื•ืŸ ืึทืœืข ืคึผืึทืจืึทืžืขื˜ืขืจืก ืฉื™ื™ึทื›ื•ืช ืฆื• ืงืึทื ืคื™ื’ื™ืขืจ ssl ืื™ืŸ nginx ืงืขื ืขืŸ ื–ื™ื™ืŸ ื’ืขืคึฟื•ื ืขืŸ ื“ืึธ - https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_client_certificate

ืื™ืš ื•ื•ืขืœ ื ืึธืจ ื‘ืขืงื™ืฆืขืจ ื‘ืึทืฉืจื™ื™ึทื‘ืŸ ื“ื™ ื•ื•ืึธืก ืื™ืš ื’ืขืคืจืขื’ื˜ ื–ื™ืš:

  • ssl_verify_client - ืกืคึผืขืฆื™ืคื™ืฆื™ืจืŸ ืึทื– ื“ื™ ืงื™ื™ื˜ ืคื•ืŸ ืฆื•ื˜ืจื•ื™ ืคึฟืึทืจ ื“ื™ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ ื“ืึทืจืฃ ื–ื™ื™ืŸ ื•ื•ืขืจืึทืคื™ื™ื“.
  • ssl_verify_depth - ื“ื™ืคื™ื™ื ื– ื“ื™ ื–ื•ื›ืŸ ื˜ื™ืคืงื™ื™ึทื˜ ืคึฟืึทืจ ื“ื™ ื˜ืจืึทืกื˜ื™ื“ ื•ื•ืึธืจืฆืœ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ ืื™ืŸ ื“ื™ ืงื™ื™ื˜. ื–ื™ื ื˜ ืื•ื ื“ื–ืขืจ ืงืœื™ืขื ื˜ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ ืื™ื– ืžื™ื“ ื’ืขื—ืชืžืขื˜ ืื•ื™ืฃ ื“ื™ ื•ื•ืึธืจืฆืœ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ, ื“ื™ ื˜ื™ืคืงื™ื™ึทื˜ ืื™ื– ื‘ืึทืฉื˜ื™ืžื˜ ืฆื• 1. ืื•ื™ื‘ ื“ืขืจ ื‘ืึทื ื™ืฆืขืจ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ ืื™ื– ื’ืขื—ืชืžืขื˜ ืื•ื™ืฃ ืึท ื™ื ื˜ืขืจืžื™ื“ื™ื™ื˜ CA, ื“ืขืžืึธืœื˜ 2 ืžื•ื–ืŸ ื–ื™ื™ืŸ ืกืคึผืขืกื™ืคื™ืขื“ ืื™ืŸ ื“ืขื ืคึผืึทืจืึทืžืขื˜ืขืจ, ืื•ืŸ ืึทื–ื•ื™ ืื•ื™ืฃ.
  • ssl_client_certificate - ืกืคึผืขืฆื™ืคื™ืฆื™ืจืŸ ื“ื™ ื“ืจืš ืฆื• ื“ื™ ื˜ืจืึทืกื˜ื™ื“ ื•ื•ืึธืจืฆืœ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ, ื•ื•ืึธืก ืื™ื– ื’ืขื ื™ืฆื˜ ื•ื•ืขืŸ ืงืึธื ื˜ืจืึธืœื™ืจื•ื ื’ ืฆื•ื˜ืจื•ื™ ืื™ืŸ ื“ืขืจ ื‘ืึทื ื™ืฆืขืจ ืก ื‘ืึทื•ื•ื™ื™ึทื–ืŸ.
  • ssl_certificate/ssl_certificate_key - ืึธื ื•ื•ื™ื™ึทื–ืŸ ื“ืขื ื“ืจืš ืฆื• ื“ื™ ืกืขืจื•ื•ืขืจ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ / ืคึผืจื™ื•ื•ืึทื˜ ืฉืœื™ืกืœ.

ื“ื• ื–ืืœืกื˜ ื ื™ืฉื˜ ืคืึทืจื’ืขืกืŸ ืฆื• ืœื•ื™ืคืŸ nginx -t ืฆื• ืงืึธื ื˜ืจืึธืœื™ืจืŸ ืึทื– ืขืก ื–ืขื ืขืŸ ืงื™ื™ืŸ ื˜ื™ืคึผืึธืก ืื™ืŸ ื“ื™ ืงืึธื ืคื™ื’, ืื•ืŸ ืึทื– ืึทืœืข ื˜ืขืงืขืก ื–ืขื ืขืŸ ืื™ืŸ ื“ื™ ืจืขื›ื˜ ืึธืจื˜, ืื•ืŸ ืึทื–ื•ื™ ืื•ื™ืฃ.

ืื•ืŸ ื“ืึธืก ืื™ื– ืึทืœืข! ื•ื•ื™ ืื™ืจ ืงืขื ืขืŸ ื–ืขืŸ, ื“ื™ ืกืขื˜ืึทืคึผ ืื™ื– ื–ื™ื™ืขืจ ืคึผืฉื•ื˜.

ื˜ืฉืขืง ืึทื– ืขืก ืึทืจื‘ืขื˜ ืื™ืŸ Firefox

ื–ื™ื ื˜ ืžื™ืจ ื˜ืึธืŸ ืึทืœืฅ ื’ืึธืจ ืื™ืŸ ืœื™ื ื•ืงืก, ืžื™ืจ ื•ื•ืขืœืŸ ื™ื‘ืขืจื ืขืžืขืŸ ืึทื– ืื•ื ื“ื–ืขืจ ื™ื•ื–ืขืจื– ืื•ื™ืš ืึทืจื‘ืขื˜ืŸ ืื™ืŸ ืœื™ื ื•ืงืก (ืื•ื™ื‘ ื–ื™ื™ ื”ืึธื‘ืŸ Windows, ื“ืขืจื™ื‘ืขืจ ื–ืขืŸ ื™ื ืกื˜ืจืึทืงืฉืึทื ื– ืคึฟืึทืจ ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ ื‘ืจืึทื•ื–ืขืจื– ืื™ืŸ ื“ืขื ืคืจื™ืขืจื“ื™ืงืŸ ืึทืจื˜ื™ืงืœ.

  1. ื–ืืœ ืก ืงืึทื˜ืขืจ Firefox.
  2. ื–ืืœ ืก ืคึผืจื•ื‘ื™ืจืŸ ืฆื• ืึทืจื™ื™ึทื ืœืึธื’ื™ืจืŸ ืึธืŸ ืึท ื˜ืึธืงืขืŸ ืขืจืฉื˜ืขืจ. ืžื™ืจ ื‘ืึทืงื•ืžืขืŸ ื“ืขื ื‘ื™ืœื“:

    ืฆื•ื•ื™ื™-ืคืึทืงื˜ืึธืจ ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ืื•ื™ืฃ ื“ืขื ืคึผืœืึทืฅ ืžื™ื˜ ืึท ื•ืกื‘ ืกื™ืžืขืŸ. ืื™ืฆื˜ ืื•ื™ืš ืคึฟืึทืจ ืœื™ื ื•ืงืก

  3. ืžื™ืจ ื’ื™ื™ืŸ ืื•ื™ืฃ ื•ื•ืขื’ืŸ: ืคึผืจืขืคึฟืขืจืขื ืฆืŸ # ืคึผืจื™ื•ื•ืึทื˜ืงื™ื™ื˜, ืื•ืŸ ืžื™ืจ ื’ื™ื™ืŸ ืฆื• ื–ื™ื›ืขืจื”ื™ื™ื˜ ื“ืขื•ื•ื™ืกืขืกโ€ฆ
  4. ืžื™ืจ ื“ืจื™ืงืŸ ืœืึธื“ืŸืฆื• ืœื™ื™ื’ืŸ ืึท ื ื™ื™ึท PKCS # 11 ื“ื™ื•ื•ื™ื™ืก ื“ืจื™ื™ื•ื•ืขืจ ืื•ืŸ ืกืคึผืขืฆื™ืคื™ืฆื™ืจืŸ ื“ืขื ื“ืจืš ืฆื• ืื•ื ื“ื–ืขืจ librtpkcs11ecp.so.
  5. ืฆื• ืงืึธื ื˜ืจืึธืœื™ืจืŸ ืึทื– ื“ื™ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ ืื™ื– ืงืขื ื˜ื™ืง, ืื™ืจ ืงืขื ื˜ ื’ื™ื™ืŸ ืฆื• ืกืขืจื˜ื™ืคื™ืงืึทื˜ ืžืึทื ืึทื’ืขืจ. ืื™ืจ ื•ื•ืขื˜ ื–ื™ื™ืŸ ืคึผืจืึทืžืคึผื˜ื™ื“ ืฆื• ืึทืจื™ื™ึทืŸ ื“ื™ื™ืŸ PIN. ื ืึธืš ืจื™ื›ื˜ื™ืง ืึทืจื™ื™ึทื ืฉืจื™ื™ึทื‘, ืื™ืจ ืงืขื ืขืŸ ืงืึธื ื˜ืจืึธืœื™ืจืŸ ื•ื•ืึธืก ืื™ื– ืื•ื™ืฃ ื“ื™ ืงื•ื•ื™ื˜ืœ ื“ื™ื™ืŸ ืกืขืจื˜ื™ืคื™ืงืึทืฅ ืื•ื ื“ื–ืขืจ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ ืคื•ืŸ ื“ื™ ืกื™ืžืขืŸ ืื™ื– ืืจื•ื™ืก.
  6. ืื™ืฆื˜ ืœืืžื™ืจ ื’ื™ื™ืŸ ืžื™ื˜ ื“ืขื ืกื™ืžืขืŸ. ืคื™ืจืขืคืึธืงืก ืคึผืจืึทืžืคึผืก ืื™ืจ ืฆื• ืื•ื™ืกืงืœื™ื™ึทื‘ืŸ ืึท ื‘ืึทื•ื•ื™ื™ึทื–ืŸ ื•ื•ืึธืก ื•ื•ืขื˜ ื–ื™ื™ืŸ ืื•ื™ืกื’ืขืงืœื™ื‘ืŸ ืคึฟืึทืจ ื“ื™ ืกืขืจื•ื•ืขืจ. ืงืœื™ื™ึทื‘ืŸ ืื•ื ื“ื–ืขืจ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ.

    ืฆื•ื•ื™ื™-ืคืึทืงื˜ืึธืจ ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ืื•ื™ืฃ ื“ืขื ืคึผืœืึทืฅ ืžื™ื˜ ืึท ื•ืกื‘ ืกื™ืžืขืŸ. ืื™ืฆื˜ ืื•ื™ืš ืคึฟืึทืจ ืœื™ื ื•ืงืก

  7. PROFIT!

    ืฆื•ื•ื™ื™-ืคืึทืงื˜ืึธืจ ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ืื•ื™ืฃ ื“ืขื ืคึผืœืึทืฅ ืžื™ื˜ ืึท ื•ืกื‘ ืกื™ืžืขืŸ. ืื™ืฆื˜ ืื•ื™ืš ืคึฟืึทืจ ืœื™ื ื•ืงืก

ื“ื™ ืกืขื˜ืึทืคึผ ืื™ื– ื’ืขื˜ืืŸ ืึทืžืึธืœ, ืื•ืŸ ื•ื•ื™ ืื™ืจ ืงืขื ืขืŸ ื–ืขืŸ ืื™ืŸ ื“ื™ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ ื‘ืขื˜ืŸ ืคึฟืขื ืฆื˜ืขืจ, ืžื™ืจ ืงืขื ืขืŸ ืจืึทื˜ืขื•ื•ืขืŸ ืื•ื ื“ื–ืขืจ ืกืขืœืขืงืฆื™ืข. ื ืึธืš ื“ืขื, ื™ืขื“ืขืจ ืžืึธืœ ืžื™ืจ ืงืœืึธืฅ ืื™ืŸ ื“ืขื ื˜ื•ื™ืขืจ, ืžื™ืจ ื ืึธืจ ื“ืึทืจืคึฟืŸ ืฆื• ืึทืจื™ื™ึทื ืœื™ื™ื’ืŸ ืึท ืกื™ืžืขืŸ ืื•ืŸ ืึทืจื™ื™ึทืŸ ื“ื™ ื‘ืึทื ื™ืฆืขืจ PIN ืงืึธื“ ื•ื•ืึธืก ืื™ื– ื’ืขื•ื•ืขืŸ ืกืคึผืขืกื™ืคื™ืขื“ ื‘ืขืฉืึทืก ืคืึธืจืžืึทื˜ื˜ื™ื ื’. ื ืึธืš ืึทื–ืึท ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ, ื“ืขืจ ืกืขืจื•ื•ื™ืจืขืจ ืฉื•ื™ืŸ ื•ื•ื™ื™ืกื˜ ื•ื•ืึธืก ื‘ืึทื ื™ืฆืขืจ ืื™ื– ืœืึธื’ื“ ืื™ืŸ ืื•ืŸ ืื™ืจ ืงืขื ืขืŸ ื ื™ื˜ ืžืขืจ ืฉืึทืคึฟืŸ ืงื™ื™ืŸ ื ืึธืš ืคึฟืขื ืฆื˜ืขืจ ืคึฟืึทืจ ื•ื•ืขืจืึทืคืึทืงื™ื™ืฉืึทืŸ, ืึธื‘ืขืจ ื’ืœื™ื™ืš ืœืึธื–ืŸ ื“ืขื ื‘ืึทื ื™ืฆืขืจ ืื™ืŸ ื–ื™ื™ืŸ ืคึผืขืจื–ืขื ืœืขืš ื—ืฉื‘ื•ืŸ.

ืึทืคึผืึทื˜ืฉื™

ืคึผื•ื ืงื˜ ื•ื•ื™ ืžื™ื˜ nginx, ืงื™ื™ืŸ ืื™ื™ื ืขืจ ื–ืึธืœ ื”ืึธื‘ืŸ ืงื™ื™ืŸ ืคืจืื‘ืœืขืžืขืŸ ืžื™ื˜ ื™ื ืกื˜ืึธืœื™ื ื’ ืึทืคึผืึทื˜ืฉื™. ืื•ื™ื‘ ืื™ืจ ื˜ืึธืŸ ื ื™ื˜ ื•ื•ื™ืกืŸ ื•ื•ื™ ืฆื• ื™ื ืกื˜ืึทืœื™ืจืŸ ื“ืขื ื•ื•ืขื‘ ืกืขืจื•ื•ืขืจ, ื ืึธืจ ื ื•ืฆืŸ ื“ื™ ื‘ืึทืึทืžื˜ืขืจ ื“ืึทืงื™ื•ืžืขื ื˜ื™ื™ืฉืึทืŸ.

ืื•ืŸ ืžื™ืจ ืึธื ื”ื™ื™ื‘ืŸ ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ ืื•ื ื“ื–ืขืจ HTTPS ืื•ืŸ ืฆื•ื•ื™ื™-ืคืึทืงื˜ืึธืจ ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ:

  1. ืขืจืฉื˜ืขืจ ืื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ืึทืงื˜ืึทื•ื•ื™ื™ื˜ mod_ssl: 
    $ a2enmod ssl
  2. ืื•ืŸ ื’ืขื‘ืŸ ื“ื™ ืคืขืœื™ืงื™ื™ึทื˜ ื”ื˜ื˜ืคึผืก ืกืขื˜ื˜ื™ื ื’ืก ืคื•ืŸ ื“ื™ ืคึผืœืึทืฅ: 
    $ a2ensite default-ssl
  3. ืื™ืฆื˜ ืžื™ืจ ืจืขื“ืึทื’ื™ืจืŸ ื“ื™ ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ ื˜ืขืงืข: /etc/apache2/sites-enabled/default-ssl.conf: 
        SSLEngine on
    SSLProtocol all -SSLv2

    SSLCertificateFile	/etc/apache2/sites-enabled/Server.crt
    SSLCertificateKeyFile /etc/apache2/sites-enabled/ServerKey.pem

    SSLCACertificateFile /etc/apache2/sites-enabled/CA.crt

    SSLVerifyClient require
    SSLVerifyDepth  10

    ื•ื•ื™ ืื™ืจ ืงืขื ืขืŸ ื–ืขืŸ, ื“ื™ ื ืขืžืขืŸ ืคื•ืŸ ื“ื™ ืคึผืึทืจืึทืžืขื˜ืขืจืก ืคึผืจืึทืงื˜ืึทืงืœื™ ืฆื•ื ื•ื™ืคืคืึทืœืŸ ืžื™ื˜ ื“ื™ ื ืขืžืขืŸ ืคื•ืŸ ื“ื™ ืคึผืึทืจืึทืžืขื˜ืขืจืก ืื™ืŸ ื ื’ื™ื ืงืก, ืึทื–ื•ื™ ืื™ืš ื•ื•ืขืœ ื ื™ืฉื˜ ื“ืขืจืงืœืขืจืŸ ื–ื™ื™. ื•ื•ื™ื“ืขืจ, ื•ื•ืขืจ ืขืก ื™ื– ืื™ื ื˜ืขืจืขืกื™ืจื˜ ืื™ืŸ ื“ื™ ื“ืขื˜ืึทื™ืœืก ืื™ื– ื‘ืึทื’ืจื™ืกื•ื ื’ ืฆื• ื“ื™ ื“ืึทืงื™ื•ืžืขื ื˜ื™ื™ืฉืึทืŸ.
    ืื™ืฆื˜ ืžื™ืจ ืจื™ืกื˜ืึทืจื˜ ืื•ื ื“ื–ืขืจ ืกืขืจื•ื•ืขืจ:

    $ service apache2 reload
$ service apache2 restart

    4. ื•ื•ื™ ืื™ืจ ืงืขื ืขืŸ ื–ืขืŸ, ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ ืึทืจื•ื™ืฃ ืฆื•ื•ื™ื™-ืคืึทืงื˜ืึธืจ ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ืื•ื™ืฃ ืงื™ื™ืŸ ื•ื•ืขื‘ ืกืขืจื•ื•ืขืจ, ืฆื™ ืื•ื™ืฃ ื•ื•ื™ื ื“ืึธื•ื– ืึธื“ืขืจ ืœื™ื ื•ืงืก, ื ืขืžื˜ ืžืึทืงืกื™ืžื•ื ืื™ื™ืŸ ืฉืขื”. ืื•ืŸ ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ ื‘ืจืึทื•ื–ืขืจื– ื ืขืžื˜ ื•ื•ืขื’ืŸ 5 ืžื™ื ื•ื˜. ืคื™ืœืข ืžืขื ื˜ืฉืŸ ื˜ืจืึทื›ื˜ืŸ ืึทื– ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ ืื•ืŸ ืืจื‘ืขื˜ืŸ ืžื™ื˜ ืฆื•ื•ื™ื™-ืคืึทืงื˜ืึธืจ ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ืื™ื– ืฉื•ื•ืขืจ ืื•ืŸ ื•ืžืงืœืึธืจ. ืื™ืš ื”ืึธืคึฟืŸ ืึทื– ืื•ื ื“ื–ืขืจ ืึทืจื˜ื™ืงืœ ื“ืขื‘ื•ื ืงืก ื“ืขื ืžื™ื˜ืึธืก, ืœืคึผื—ื•ืช ืึท ื‘ื™ืกืœ.

ื‘ืœื•ื™ื– ืจืขื’ื™ืกื˜ืจื™ืจื˜ ื ื™ืฆืขืจืก ืงืขื ืขืŸ ืึธื ื˜ื™ื™ืœ ื ืขืžืขืŸ ืื™ืŸ ื“ื™ ื™ื‘ืขืจื‘ืœื™ืง. ืกื™ื™ืŸ ืืจื™ื™ืŸื‘ื™ื˜ืข.

ืฆื™ ืื™ืจ ื“ืึทืจืคึฟืŸ ื™ื ืกื˜ืจืึทืงืฉืึทื ื– ืคึฟืึทืจ ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ TLS ืžื™ื˜ ืกืขืจื˜ื™ืคื™ืงืึทืฅ ืœื•ื™ื˜ GOST 34.10-2012:

  • ื™ืึธ, TLS-GOST ืื™ื– ื–ื™ื™ืขืจ ื ื•ื™ื˜ื™ืง

  • ื ื™ื™ืŸ, ื˜ื•ื ื™ื ื’ ืžื™ื˜ GOST ืึทืœื’ืขืจื™ื“ืึทืžื– ืื™ื– ื ื™ืฉื˜ ื˜ืฉื™ืงืึทื•ื•ืข

44 ื‘ืื ื•ืฆืขืจ ื”ืื‘ืŸ ื’ืขืฉื˜ื™ืžื˜. 9 ื‘ืื ื•ืฆืขืจ ื”ืื‘ืŸ ื–ื™ืš ืืคื’ืขื”ืืœื˜ืŸ.

ืžืงื•ืจ: www.habr.com

ืœื™ื™ื’ืŸ ืึท ื‘ืึทืžืขืจืงื•ื ื’