<!doctype book public "-//OASIS//DTD DocBook V3.1//EN"
 [ <!entity header system "header.sgml">
 
]>

<book lang="ko">
<!-- DocBook file was created by LyX 1.1
  See http://www.lyx.org/ for more information -->
 <bookinfo>
  <title>
  SSL Certificates HOWTO
 </title>
 <date>
  V0.1-kr-2 2002³â 3¿ù 12ÀÏ 
 </date>

 <author>
  <firstname>Franck</firstname>
  <surname>Martin</surname>
  <affiliation>
   <address>
    <email>franck (at) sopac.org</email>
   </address>
  </affiliation>
 </author>
													
 
 
 <othercredit role="translator">
  <firstname>¾ç¹è</firstname>
  <surname>¹Ú</surname>
  <affiliation>
   <address>
    <email>godyang (at) kldp.org</email>
   </address>
  </affiliation>
 </othercredit>
 
 <revhistory>
   <revision>
      <revnumber>v0.1-kr-2</revnumber>
	  <date>2002-03-18</date>
	  <authorinitials>godyang</authorinitials>
	  <revremark>
	  </revremark>
   </revision>
   <revision>
      <revnumber>v0.1-kr</revnumber>
      <date>2002-03-12</date>
	  <authorinitials>godyang</authorinitials>
	  <revremark>
	  </revremark>
   </revision>
   <revision>
      <revnumber>v0.1</revnumber>
      <date>2001-11-18</date>
      <authorinitials>fm</authorinitials>
      <revremark>
      </revremark>
   </revision>
 </revhistory>
 <abstract>
 <para>
  ÀÎÁõ ±â°ü(Certificate Authority, CA)À» °ü¸®ÇÏ´Â ¹æ¹ý°ú, ±× ¿Ü À¥º¸¾È, e-mailº¸¾È, ÄÚµå »çÀÎ µî¿¡¼­ SSLÀ» ÀÌ¿ëÇÑ ÀÎÁõ¼­ÀÇ È°¿ë ¹æ¾ÈÀ» ´Ù·é´Ù. (¿ªÁÖ:¾ÆÁ÷ ¹®¼­ ¹öÀüÀÌ ³·¾Æ¼­ ¹Ì¿Ï¼º ºÎºÐÀÌ »ó´çÈ÷ ³²¾ÆÀÖ´Ù. ±¹½Â¼ö´Ô²²¼­ ÀÛ¼ºÇÏ½Å &quot;Certificate ServerÀÇ ¼³Ä¡ ¿Í ClientÀÎÁõ&quot;ÀÌ¶ó´Â ¹®¼­°¡ ¸Å¿ì ÀßµÇ¾î ÀÖÀ¸¹Ç·Î ±× ¹®¼­¸¦ ÂüÁ¶ÇÏ¸é¼­ º¸½Ã¸é µÈ´Ù.)
 </para>
 </abstract>
 </bookinfo>
 <chapter>
 
  <title>
  ¼­·Ð
 </title>
  <sect1>
   <title>
   ¹®¼­ÀÇ ¿ª»ç
  </title>
  <para>
  V0.1-kr-1 - ¹Ú¾ç¹è &lt;godyang (at) kldp.org &gt;
  <para>
  V0.1-kr ¹®¼­ÀÇ Àß¸øµÈ ÅÂ±×¸¦ ¼öÁ¤Çß´Ù.
  </para>
  <para>
  V0.1-kr - ¹Ú¾ç¹è &lt;godyang (at) kldp.org&gt;
  </para>
  <para>
  V0.1À» ±âÁØÀ¸·Î ¹ø¿ªÇß´Ù.
  </para>
  <para>
   V0.1 - Franck Martin &lt;franck (at) sopac.org&gt;
  </para>
  <para>
   SSL Certificate HOWTO¸¦ Ã³À½ Á¦ÀÛÇß´Ù.
  </para>
  </sect1>
  <sect1>
   <title>
   ¼Ò°³
  </title>
  <para>
   ÀÌ ±ÛÀ» ÀÐ´Â »ç¶÷ÀÌ¶ó¸é ÇÊÀÚÃ³·³ <ulink url="http://www.openssl.org">OpenSSL</ulink> ÇÁ·ÎÁ§Æ®¿¡ ÀÖ´Â ¹®¼­µéÀ» ´Þ´Þ ÀÐ¾úÀ» °ÍÀ¸·Î ¿¹»óµÈ´Ù. ÇÏÁö¸¸ ±× °÷ÀÇ ³»¿ë¸¸À¸·Î´Â ¹«¾ùºÎÅÍ ½ÃÀÛÇØ¾ßµÇ´ÂÁö, ÀÎÁõ¼­¸¦ ¾î¶»°Ô °ü¸®ÇØ¾ßÇÒ °ÍÀÎÁö ¾Ë¾Æ³»±â Èûµé¾úÀ» °ÍÀÌ´Ù. ÀÌ ¹®¼­´Â ±×·¯ÇÑ µ¶ÀÚµéÀÇ Áú¹®¿¡ ´ëÇØ ÇØ´äÀ» ÁÙ °ÍÀÌ´Ù.
  </para>
  <para>
   ÀÌ HOWTO´Â Linux¿ÜÀÇ ¾îÇÃ¸®ÄÉÀÌ¼Çµéµµ ´Ù·ê °ÍÀÌ´Ù. ¸ðµç ¾îÇÃ¸®ÄÉÀÌ¼ÇÀ» ´Ù·ç´Â °ÍÀº Èûµé°ÚÁö¸¸, È¤½Ã Ãß°¡ÇÒ »çÇ×ÀÌ³ª ¼öÁ¤ÇÒ »çÇ×ÀÌ ÀÖ´Ù¸é <ulink url="mailto: franck at sopac.org">franck at sopac.org</ulink>·Î ¸ÞÀÏÀ» º¸³»ÁÖ½Ã±â ¹Ù¶õ´Ù.
  </para>
   <sect2>
    <title>
    Ã¥ÀÓÀÇ ÇÑ°è¿Í ¶óÀÌ¼¾½º
   </title>
   <para>
	ÀÌ ¹®¼­´Â ÀÚÀ¯·Ó°Ô ¹èÆ÷µÉ ¼ö ÀÖÀ¸³ª ¾î¶°ÇÑ º¸Áõµµ ¾ø´Ù.; ÇÊÀÚ´Â ½ÃÀå¼ºÀÌ³ª ±×¿Í °ü·ÃµÈ ¾î¶°ÇÑ º¸Áõµµ Á¦°øÇÏÁö ¾Ê´Â´Ù.
   </para>
   <para>
	°£´ÜÇÏ°Ô ¸»ÇØ¼­, ÀÌ ¹®¼­¸¦ ÂüÁ¶ÇÏ´Ù°¡ »ó¿ë ¾îÇÃ¸®ÄÉÀÌ¼ÇÀÇ º¸¾ÈÀÌ ¸Á°¡Á³´Ù¸é ±×°Ç ÀüÀûÀ¸·Î ±× »ç¶÷ÀÇ Ã¥ÀÓÀÎ °ÍÀÌ´Ù. ÇÊÀÚÀÇ Àß¸øÀÌ ¾Æ´Ñ °ÍÀÌ´Ù.
   </para>
   <para>
   (¿ªÁÖ:ÀúÀÛ±Ç¿¡ °ü·ÃµÈ ¹®±¸´Â ¿ø¹®À¸·Î ³²°ÜµÐ´Ù.)
   </para>
   <para>
    Copyright (c) 2001 by Franck Martin and others from the openssl-users mailing list under GFDL (the <ulink url="http://www.gnu.org/">GNU</ulink>Free Documentation License).
   </para>
   <para>
    Please freely copy and distribute (sell or give away) this document in any format. It's requested that corrections and/or comments be forwarded to the document maintainer. You may create a derivative work and distribute it provided that you:
   </para>
   <orderedlist>
    <listitem>
    <para>
    Send your derivative work (in the most suitable format such as sgml) to the LDP (Linux Documentation Project) or the like for posting on the Internet. If not the LDP, then let the LDP know where it is available. 
    </para>
   </listitem>
    <listitem>
    <para>
    License the derivative work with this same license or use GPL. Include a copyright notice and at least a pointer to the license used. 
    </para>
   </listitem>
    <listitem>
    <para>
    Give due credit to previous authors and major contributors. If you're considering making a derived work other than a translation, it's requested that you discuss your plans with the current maintainer.
    </para>
   </listitem>
   </orderedlist>
   <para>
	¸¸¾à ÀÌ ¹®¼­¸¦ ÀÎ¼âÇÏ°Ô µÈ´Ù¸é »ùÇÃÀ» ÀúÀÚ¿¡°Ô º¸³»ÁÖ½Ã±â ¹Ù¶õ´Ù. ¸®ºä ¿ëµµ·Î »ç¿ëÇÒ °ÍÀÌ´Ù. ;-)
   </para>
   </sect2>
   <sect2>
    <title>
	¼±Çà Áö½Ä
   </title>
   <para>
	¼­·Ð¿¡¼­ ¸»Çß´Ù½ÃÇÇ ÀÌ ¹®¼­´Â HOWTOÀÌ¸ç, µ¶ÀÚµé¿¡°Ô ÀÌ ¹®¼­¸¦ ÀÐ±â Àü¿¡ OpenSSL man-page¸¦ ºñ¸©ÇÑ º¸¾È °ü·Ã Ã¥µéÀ» ÀÐ¾îº¼ °ÍÀ» ±ÇÇÑ´Ù. ±×·± ´ÙÀ½ ÀÌ ¹®¼­¸¦ ÀÐÀ¸¸é º¸´Ù È¿À²ÀûÀÏ °ÍÀÌ´Ù. ÀÎÁõ¼­(Certificate)¸¦ »ç¿ëÇÔÀ¸·Î½á »ç¹« Ã³¸®¿¡ ´ëÇÑ º¸¾ÈÀ» °­È­½ÃÅ³ ¼ö ÀÖÀ¸¸ç, ±×·¸°Ô ¸¸µé¾îÁø º¸¾ÈÀÌ ¾î¶»°Ô À¯ÁöµÇ´ÂÁö ¾Ë°Ô µÉ °ÍÀÌ´Ù. ¶ÇÇÑ OpenSSLÀÌ Á¦°øÇÏÁö ¾Ê´Â º¸¾È¿¡ ´ëÇØ¼­µµ ÀÌÇØÇÒ ¼ö ÀÖÀ» °ÍÀÌ´Ù.
   </para>
   </sect2>
  </sect1>
  <sect1>
   <title>
   SSLÀÌ¶õ ¹«¾ùÀÌ¸ç ÀÎÁõ¼­(Certificate)¶õ ¹«¾ùÀÎ°¡?
  </title>
  <para>
   SSL(Secure Socket Layer) ÇÁ·ÎÅäÄÝÀº Ã³À½¿¡ Netscape»ç¿¡¼­ À¥¼­¹ö¿Í ºê¶ó¿ìÀú »çÀÌÀÇ º¸¾ÈÀ» À§ÇØ ¸¸µé¾ú´Ù. SSLÀº Certificate Authority(CA)¶ó ºÒ¸®´Â ¼­µå ÆÄÆ¼·ÎºÎÅÍ ¼­¹ö¿Í Å¬¶óÀÌ¾ðÆ®ÀÇ ÀÎÁõÀ» ÇÏ´Âµ¥ »ç¿ëµÈ´Ù. ¾Æ·¡´Â SSLÀÌ ¾î¶»°Ô ÀÛµ¿ÇÏ´ÂÁö¿¡ ´ëÇÑ °£´ÜÇÑ °úÁ¤À» ¼³¸íÇÑ °ÍÀÌ´Ù.
  </para>
  <orderedlist>
   <listitem>
   <para>
   [À¥ºê¶ó¿ìÀú] SSL·Î ¾ÏÈ£È­µÈ ÆäÀÌÁö¸¦ ¿äÃ»ÇÏ°Ô µÈ´Ù. (ÀÏ¹ÝÀûÀ¸·Î https://°¡ »ç¿ëµÈ´Ù)
   </para>
  </listitem>
   <listitem>
   <para>
   [À¥¼­¹ö] Public Key¸¦ ÀÎÁõ¼­¿Í ÇÔ²² Àü¼ÛÇÑ´Ù.
   </para>
  </listitem>
   <listitem>
   <para>
   [À¥ºê¶ó¿ìÀú] ÀÎÁõ¼­°¡ ÀÚ½ÅÀÌ ½Å¿ëÀÖ´Ù°í ÆÇ´ÜÇÑ CA(ÀÏ¹ÝÀûÀ¸·Î trusted root CA¶ó°í ºÒ¸²)·ÎºÎÅÍ ¼­¸íµÈ °ÍÀÎÁö È®ÀÎÇÑ´Ù. (¿ªÁÖ:Internet Explorer³ª Netscape¿Í °°Àº À¥ºê¶ó¿ìÀú¿¡´Â ÀÌ¹Ì Verisign, Thawte¿Í °°Àº ³Î¸® ¾Ë·ÁÁø root CAÀÇ ÀÎÁõ¼­°¡ ¼³Ä¡µÇ¾î ÀÖ´Ù) ¶ÇÇÑ ³¯Â¥°¡ À¯È¿ÇÑÁö, ±×¸®°í ÀÎÁõ¼­°¡ Á¢¼ÓÇÏ·Á´Â »çÀÌÆ®¿Í °ü·ÃµÇ¾î ÀÖ´ÂÁö È®ÀÎÇÑ´Ù.
   </para>
  </listitem>
   <listitem>
   <para>
   [À¥ºê¶ó¿ìÀú] Public Key¸¦ »ç¿ëÇØ¼­ ·£´ý ´ëÄª ¾ÏÈ£È­Å°(Random symmetric encryption key)¸¦ ºñ¸©ÇÑ URL, http µ¥ÀÌÅÍµéÀ» ¾ÏÈ£È­ÇØ¼­ Àü¼ÛÇÑ´Ù.
   </para>
  </listitem>
   <listitem>
   <para>
   [À¥¼­¹ö] Private Key¸¦ ÀÌ¿ëÇØ¼­ ·£´ý ´ëÄª ¾ÏÈ£È­Å°¿Í URL, http µ¥ÀÌÅÍ¸¦ º¹È£È­ÇÑ´Ù.
   </para>
  </listitem>
   <listitem>
   <para>
   [À¥¼­¹ö] ¿äÃ»¹ÞÀº URL¿¡ ´ëÇÑ ÀÀ´äÀ» À¥ºê¶ó¿ìÀú·ÎºÎÅÍ ¹ÞÀº ·£´ý ´ëÄª ¾ÏÈ£È­Å°¸¦ ÀÌ¿ëÇÏ¿© ¾ÏÈ£È­ÇØ¼­ ºê¶ó¿ìÀú·Î Àü¼ÛÇÑ´Ù.
   </para>
  </listitem>
   <listitem>
   <para>
   [À¥ºê¶ó¿ìÀú] ´ëÄª Å°¸¦ ÀÌ¿ëÇØ¼­ http µ¥ÀÌÅÍ¿Í html¹®¼­¸¦ º¹È£È­ÇÏ°í, È­¸é¿¡ Á¤º¸¸¦ »Ñ·ÁÁØ´Ù.
   </para>
  </listitem>
  </orderedlist>
  <para>
   ¿©±â¼­ °£´ÜÇÑ °³³ä Á¤µµ´Â ¾Ë¾ÆµÎ¾î¾ß ÇÒ °ÍÀÌ´Ù.
  </para>
   <sect2>
    <title>
    °³ÀÎÅ°/°ø°³Å°(Private Key/Public Key):
   </title>
   <para>
	Private key/Public Key¸¦ ÀÌ¿ëÇÑ ¾ÏÈ£È­´Â ÇÏ³ªÀÇ Å°·Î ¾ÏÈ£È­ÇÏ°í ³ª¸ÓÁö ´Ù¸¥ ÇÏ³ª·Î º¹È£È­ÇÒ ¼ö ÀÖµµ·Ï µÇ¾îÀÖ´Ù. ÀÌÇØÇÏ±â ¾î·Æ°ÚÁö¸¸ ÇÊÀÚ¸¦ ¹Ï¾î¶ó. (¿ªÁÖ:µ¶ÀÚ°¡ PKI(Public Key Infrastructure)¿¡ ´ëÇØ¼­ Àß ¸ð¸¥´Ù¸é ÀÌ¿¡ ´ëÇÑ °£´ÜÇÑ ¹®¼­¸¦ ÀÐ¾îº¸±â¸¦ ±ÇÇÑ´Ù) ¾Õ¿¡¼­ ¾ÏÈ£È­ÇÑ Å°·Î¸¸ ¾ÏÈ£È­¸¦ ÇÒ ¼ö ÀÖ´Â °ÍÀÌ ¾Æ´Ï¶ó ¹Ý´ë ¹æÇâÀ¸·Î º¹È£È­ÇÑ Å°·Îµµ ¾ÏÈ£È­ÇÒ ¼öµµ ÀÖ´Ù.(´ç¿¬È÷ ¾Õ¿¡¼­ ¾ÏÈ£È­ÇÑ Å°°¡ ÀÌ¹ø¿£ º¹È£È­ÇÏ´Â Å°°¡ µÇ´Â °ÍÀÌ´Ù) ÀÌ·¯ÇÑ Å°½ÖÀº ¼Ò¼ö(prime number)·ÎºÎÅÍ »ý¼ºµÇ¸ç, ±× ±æÀÌ(Bit ´ÜÀ§)´Â ¾ÏÈ£È­ÀÇ °­µµ¸¦ ³ªÅ¸³½´Ù.</para>
	<para>Private Key/Public Key´Â ÀÌ·¯ÇÑ Å°½ÖÀ» °ü¸®ÇÏ´Â ¹æ¹ýÀÌ´Ù. ÇÑ°³ÀÇ Å°´Â ¾ÈÀüÇÑ Àå¼Ò¿¡ ÀÚ±â¸¸ ¾Ë ¼ö ÀÖµµ·Ï º¸°üÇÏ°í(Private Key) ´Ù¸¥ ÇÏ³ª´Â ¸ðµç »ç¶÷¿¡°Ô ÆÛ¶ß¸®´Â °Í(Public Key)ÀÌ´Ù. ±×·¸°Ô ÇÏ¸é ±× »ç¶÷µéÀÌ ´ç½Å¿¡°Ô ¸ÞÀÏÀ» º¸³¾ ¶§ ¾ÏÈ£È­ÇØ¼­ º¸³¾ ¼ö ÀÖÀ¸¸ç, ´ç½Å¸¸ÀÌ ±× ¾ÏÈ£¸¦ Ç® ¼ö ÀÖ´Ù. ¹Ý´ë·Î ´Ù¸¥ »ç¶÷¿¡°Ô ¸ÞÀÏÀ» º¸³¾ ÀÏÀÌ ÀÖÀ¸¸é Private Key¸¦ ÀÌ¿ëÇØ ¾ÏÈ£È­ ÇÒ ¼ö ÀÖ´Ù. ±×·¯¸é ±× »ç¶÷µéÀº º¹È£È­ÇØ¼­ º¼ ¼ö ÀÖ´Ù. ±×·¯³ª ÀÌ ¹æ¹ýÀº ¸ðµç »ç¶÷ÀÌ Public Key¸¦ °¡Áö°í ÀÖ¾î¾ß ÇÏ±â ¶§¹®¿¡ ±×¸® ¾ÈÀüÇÑ ¹æ¹ýÀÌ ¾Æ´Ï´Ù. (¿ªÁÖ:¿ÀÈ÷·Á ¿ªÈ¿°ú¸¦ ÀÏÀ¸Å³ ¼ö ÀÖ´Ù. ´Ü¼øÇÏ°Ô ¸Þ½ÃÁö, ÆÄÀÏ¿¡ ¾ÏÈ£È­, ¼­¸íÀ» ÇÒ »ý°¢ÀÌ¸é PGP³ª GnuPG¸¦ ±ÇÇÑ´Ù)
   </para>
   </sect2>
   <sect2>
    <title>
    ÀÎÁõ¼­(Certificate):
   </title>
   <para>
    ´ç½Å°ú Á¢¼ÓÇØÀÖ´Â »ç¶÷ÀÌ³ª À¥ »çÀÌÆ®°¡ ¹ÏÀ» ¼ö ÀÖ´ÂÁö ¾î¶»°Ô ÆÇ´ÜÇÒ ¼ö ÀÖÀ»±î? ÇÑ À¥»çÀÌÆ® °ü¸®ÀÚ°¡ ÀÖ´Ù°í °¡Á¤ÇÏÀÚ. ±× »ç¶÷ÀÌ ´ç½Å¿¡°Ô ÀÌ »çÀÌÆ®°¡ ¹ÏÀ»¸¸ÇÏ´Ù°í (½É°¢ÇÒ Á¤µµ·Î) ¿­½ÉÈ÷ ¼³¸íÇß´Ù. ´ç½ÅÀÌ ±× »çÀÌÆ®ÀÇ ÀÎÁõ¼­¸¦ ¼³Ä¡ÇØ ÁÖ±â¸¦ ¹Ù¶ó¸é¼­ ¸»ÀÌ´Ù. ÇÑµÎ¹øµµ ¾Æ´Ï°í ¸Å¹ø ÀÌ·¸°Ô ÇØ¾ßÇÑ´Ù¸é ±ÍÂúÁö ¾Ê°Ú´Â°¡?
	</para>
	<para>
    ÀÎÁõ¼­´Â ¿©·¯ ºÎºÐÀ¸·Î ÀÌ·ç¾îÁ®ÀÖ´Ù. ¾Æ·¡´Â ÀÎÁõ¼­ ¼Ó¿¡ µé¾îÀÖ´Â Á¤º¸ÀÇ Á¾·ù¸¦ ³ªÅ¸³½ °ÍÀÌ´Ù.
	</para>
	<orderedlist>
     <listitem>
      <para>
	ÀÎÁõ¼­ ¼ÒÀ¯ÀÚÀÇ e-mail ÁÖ¼Ò
	  </para>
	 </listitem>
	 <listitem>
	 <para>
	¼ÒÀ¯ÀÚÀÇ ÀÌ¸§
	</para>
	</listitem>
	<listitem>
	<para>
	ÀÎÁõ¼­ÀÇ ¿ëµµ
	</para>
	</listitem>
	<listitem>
	<para>
	ÀÎÁõ¼­ À¯È¿±â°£
	</para>
	</listitem>
	<listitem>
	<para>
	¹ßÇà Àå¼Ò
	</para>
	</listitem>
	<listitem>
     <para>
       Distinguished Name (DN)
     </para>
      <para>
	   - Common Name (CN)
      </para>
	  <para>
       - ÀÎÁõ¼­ Á¤º¸¿¡ ´ëÇØ ¼­¸íÇÑ »ç¶÷ÀÇ µðÁöÅÐ ID
	  </para>
	<listitem>
	<para>
	Public Key
	</para>
	</listitem>
	<listitem>
	<para>
	ÇØ½¬(Hash)
	</para>
	</listitem>
	</orderedlist>

    <para>
	SSLÀÇ ±âº» ±¸Á¶´Â ´ç½ÅÀÌ ÀÎÁõ¼­¸¦ ¼­¸íÇÑ »ç¶÷À» ½Å·ÚÇÑ´Ù¸é, ¼­¸íµÈ ÀÎÁõ¼­µµ ½Å·ÚÇÒ ¼ö ÀÖ´Ù´Â °ÍÀÌ´Ù. ÀÌ°ÍÀº ¸¶Ä¡ Æ®¸®(Tree)¿Í °°Àº ±¸Á¶¸¦ ÀÌ·ç¸é¼­ ÀÎÁõ¼­³¢¸® ¼­¸íÇÏ°Ô µÈ´Ù. ±×·¯¸é ÃÖ»óÀ§ ÀÎÁõ¼­´Â? ÀÌ ÀÎÁõ¼­¸¦ ¹ßÇàÇÑ ±â°üÀ» Root Certification Authority(ÁÙ¿©¼­ Root CA)¶ó°í ºÎ¸£¸ç, À¯¸íÇÑ ÀÎÁõ ±â°ü(¿ªÁÖ:Verisign, Thawte, Entrust, etc)ÀÇ Root CA ÀÎÁõ¼­´Â À¥ºê¶ó¿ìÀú¿¡ ±âº»ÀûÀ¸·Î ¼³Ä¡µÇ¾î ÀÖ´Ù. ÀÌ·¯ÇÑ ÀÎÁõ ±â°üÀº ÀÚ½ÅµéÀÌ ¼­¸íÇÑ ÀÎÁõ¼­µéÀ» °ü¸®ÇÒ »Ó¸¸ ¾Æ´Ï¶ó Ã¶È¸ ÀÎÁõ¼­(Revoked Certificate)µéµµ °ü¸®ÇÏ°í ÀÖ´Ù. ±×·¯¸é Root CAÀÇ ÀÎÁõ¼­´Â ´©°¡ ¼­¸íÀ» ÇßÀ»±î? ¸ðµç Root CA ÀÎÁõ¼­´Â ÀÚÃ¼ ¼­¸í(Self Signed)µÇ¾î ÀÖ´Ù.
	</para>
	
   </sect2>
   <sect2>
    <title>
	´ëÄªÅ°(The Symmetric key):
   </title>
	<para>
	Private Key/Public Key ¾Ë°í¸®ÁòÀº Á¤¸» ´ë´ÜÇÑ ¾Ë°í¸®ÁòÀÌÁö¸¸, ºñ½Ç¿ëÀûÀÌ¶ó´Â ´ÜÁ¡ÀÌ ÀÖ´Ù. ºñ´ëÄª(Asymmetric)ÀÌ¶õ ÇÏ³ªÀÇ Å°·Î ¾ÏÈ£È­¸¦ ÇÏ¸é ´Ù¸¥ Å°°¡ ÀÖ¾î¾ß º¹È£È­¸¦ ÇÒ ¼ö ÀÖ´Â °ÍÀ» ¶æÇÑ´Ù. Áï, ÇÏ³ªÀÇ Å°·Î ¾ÏÈ£È­/º¹È£È­¸¦ ÇÒ ¼ö ¾ø´Ù´Â ¸»ÀÌ´Ù. ´ëÄªÅ°(Symmetric Key)´Â ÇÏ³ªÀÇ Å°·Î ¾ÏÈ£È­/º¹È£È­¸¦ ÇÏ°Ô µÈ´Ù. ´ëÄªÅ°¸¦ »ç¿ëÇÏ¸é ºñ´ëÄªÅ°º¸´Ù ÈÎ¾À ºü¸£°Ô ¾ÏÈ£È­/º¹È£È­¸¦ ÇÒ ¼ö ÀÖ´Ù. ±×·¸Áö¸¸ ¼Óµµ ¶§¹®¿¡ ´ëÄªÅ°¸¦ ÀÌ¿ëÇÑ´Ù´Â °ÍÀº ³Ê¹« À§ÇèÇÏ´Ù.
	</para>
	<para>
	¸¸¾à ´ç½ÅÀÇ ÀûÀÌ Å°¸¦ ÀÔ¼öÇØ ¹ö¸®¸é ¿©ÅÂ±îÁö ¾ÏÈ£È­µÈ Á¤º¸°¡ ¸ðµÎ ¹«¿ëÁö¹°ÀÌ µÇ¾î¹ö¸®°Ô µÈ´Ù. ±×·¡¼­ ´ëÄªÅ° ¾Ë°í¸®ÁòÀ» »ç¿ëÇÑ Å°¸¦ »ó´ë¹æ¿¡°Ô Àü¼ÛÇÏ·Á¸é ÀÎÅÍ³Ý°ú °°Àº Åë·Î´Â ³Ê¹«³ªµµ À§ÇèÇÏ±â ¶§¹®¿¡ Á÷Á¢ ¼ÕÀ¸·Î Àü´ÞÇØ¾ß¸¸ ÇÑ´Ù. ±ÍÂúÁö ¾ÊÀº°¡? ÇØ°áÃ¥Àº ´ëÄªÅ°¸¦ ºñ´ëÄªÅ°·Î ¾ÏÈ£È­½ÃÄÑ¼­ Àü¼ÛÇÏ¸é µÈ´Ù. (¿ªÁÖ:À§¿¡¼­ »ìÆìº» À¥¼­¹ö¿Í ºê¶ó¿ìÀúÀÇ °ü°è¿¡¼­ º¼ ¼ö ÀÖ¾ú´Ù) ÀÚ½ÅÀÇ Private Key¸¸ ¾ÈÀüÇÏ°Ô °ü¸®ÇÏ¸é Public Key·Î ¾ÏÈ£È­µÇ¾î ¾ÈÀüÇÏ°Ô Àü¼ÛÇÒ ¼ö ÀÖ´Ù.(¿©±â¼­ º¸¾ÈÀº Á×À½ÀÌ³ª Çù¹Ú µîÀ» Á¦¿ÜÇÑ´Ù) ¶ÇÇÑ ´ëÄªÅ°´Â ¸Å¹ø ·£´ýÀ¸·Î ¼±ÅÃµÇ´Âµ¥, ÀÌ·¸°ÔµÇ¸é ¸¸¾à ´ëÄªÅ°°¡ ´©ÃâµÇ¾îµµ ´ÙÀ½¹ø¿¡´Â ´Ù¸¥ Å°°¡ »ç¿ëµÇ±â ¶§¹®¿¡ ¾ÈÀüÇÏ´Ù.
   </para>
   </sect2>
   <sect2>
    <title>
	¾ÏÈ£È­ ¾Ë°í¸®Áò(Encryption Algorithm):
   </title>
   <para>
   ¾ÏÈ£È­ ¾Ë°í¸®ÁòÀº ´ëÄªÀÌµç ºñ´ëÄªÀÌµç °£¿¡ »ó´çÈ÷ ¸¹Àº Á¾·ù°¡ ÀÖ´Ù. ÀÏ¹ÝÀûÀ¸·Î ¾ÏÈ£È­ ¾Ë°í¸®ÁòÀ¸·Î Æ¯Çã¸¦ ³¾ ¼ö ¾ø´Ù. ¸¸¾à Henri Paincare°¡ ¾ÏÈ£È­ ¾Ë°í¸®ÁòÀ¸·Î Æ¯Çã¸¦ ³½´Ù¸é Albert EinsteinÀ¸·ÎºÎÅÍ °í¼Ò´çÇÒ ¼ö ÀÖ´Â °ÍÀÌ´Ù. ´Ü, USA¿¡¼­´Â ¾ÏÈ£È­ ¾Ë°í¸®ÁòÀ¸·Î Æ¯Çã¸¦ ³¾ ¼ö ÀÖ´Ù.(¿ªÁÖ:¶ÇÇÑ ±º»ç¹ýÀ¸·Î º¸È£¹Þ°Ô µÈ´Ù.) OpenSSLÀÇ °æ¿ì¿¡´Â ¾ÏÈ£È­ ¾Ë°í¸®ÁòÀ¸·Î Æ¯Çã¸¦ ³¾ ¼ö ¾ø°í, ±º»ç¹ýÀÌ³ª º¸¾È¹ý¿¡ ÀúÃËµÇÁö ¾Ê´Â ±¹°¡¿¡¼­ °³¹ßµÇ°í ÀÖ´Ù.
   </para>
   <para>
   ½ÇÁ¦·Î ¾Ë°í¸®ÁòÀÌ ¾î¶»°Ô »ç¿ëµÇ´ÂÁö »ìÆìº¸ÀÚ. À¥¼­¹ö¿Í ºê¶ó¿ìÀú´Â ¼­·Î Åë½ÅÀ» ÇÏ´Â µ¿¾È ¼­·Î ¾î¶² ¾Ë°í¸®ÁòÀ» »ç¿ëÇÒ ¼ö ÀÖ´ÂÁö È®ÀÎÇÏ°Ô µÈ´Ù. ´ÙÀ½¿¡ ¼­·Î ÀÌÇØÇÒ ¼ö ÀÖ´Â ÀÏ¹ÝÀûÀÎ ¾Ë°í¸®ÁòÀ» ¼±ÅÃÇÑ ÈÄ Åë½ÅÀÌ ÀÌ·ç¾îÁö°Ô µÈ´Ù. OpenSSLÀº ÄÄÆÄÀÏÇØ¼­ »ðÀÔÇÒ ¾Ë°í¸®ÁòÀ» ÅÃÇÒ ¼ö ÀÖ´Ù. ±×·¸°Ô ÇÏ¸é ¾ÏÈ£È­ ¾Ë°í¸®Áò¿¡ Á¦ÇÑÀ» °É°í ÀÖ´Â ±¹°¡¿¡¼­µµ »ç¿ëÇÒ ¼ö ÀÖ°Ô µÈ´Ù.
   </para>
   </sect2>
   <sect2>
    <title>
	ÇØ½¬(Hash):
   </title>
   <para>
	ÇØ½¬´Â ÇØ½¬ ÇÔ¼ö¿¡ ÀÇÇØ ¸¸µé¾îÁö´Â ¼ýÀÚ´Ù. ÀÌ ÇÔ¼ö´Â ´Ü¹æÇâÀ¸·Î ¿¬»êµÇ´Â ÇÔ¼ö´Ù. Áï, ÇÑ¹ø ÇØ½¬ÇÔ¼ö·Î ¿øº»À¸·ÎºÎÅÍ ÇØ½¬°ªÀ» »ý¼ºÇß´Ù¸é, ÇØ½¬°ªÀ¸·ÎºÎÅÍ ¿øº» ¸Þ½ÃÁö¸¦ ¾Ë¾Æ³»´Â °ÍÀÌ ºÒ°¡´ÉÇÏ´Ù. ÇØ½¬ÀÇ ¿ëµµ´Â ¿øº» ¸Þ½ÃÁö°¡ ¼Õ»óÀÌ µÇ¾ú´ÂÁö¸¦ ¾Ë¾Æ³»´Âµ¥ ÀÖÀ¸¸ç, ÇØ½¬°ªÀ» º¯°æ½ÃÅ°Áö ¾Ê°í ¿øº»À» Á¶ÀÛÇÏ´Â °ÍÀº ±ØÈ÷ ¾î·Æ´Ù. ±×·¡¼­ ÇØ½¬ ÇÔ¼ö´Â ÆÐ½º¿öµå ¸ÞÄ¿´ÏÁòÀ» ºñ¸©ÇÑ ¼ÒÇÁÆ®¿þ¾îÀÇ ¼Õ»ó À¯¹«(MD5 sum)¸¦ °¡¸®´Âµ¥µµ ÀÌ¿ëÇÒ ¼ö ÀÖÀ¸¸ç, ¸Þ½ÃÁöÀÇ ¼Õ»óÀ» ¹æÁöÇÏ±â À§ÇØ ³Î¸® ¾²ÀÌ°í ÀÖ´Ù.
   </para>
   </sect2>
   <sect2>
    <title>
	¼­¸í(Signing):
   </title>
   <para>
	¼­¸íÀº Æ¯Á¤ ¸Þ½ÃÁö¸¦ ³»°¡ ÀÛ¼ºÇß´Ù´Â °ÍÀ» ÀÎÁõÇÏ´Â ¿ªÇÒÀ» ÇÑ´Ù. Text°¡ µÉ ¼öµµ ÀÖ°í, ÀÎÁõ¼­ µîµîÀÌ µÉ ¼ö ÀÖ´Ù. ¸Þ½ÃÁö¿¡ ¼­¸íÇÏ±â À§ÇØ¼­´Â ¾Æ·¡ÀÇ ¼ø¼­¸¦ µû¶ó¾ß ÇÑ´Ù.
	</para>
	<orderedlist>
	<listitem><para>ÇØ½¬ »ý¼º</para></listitem>
	<listitem><para>Private Key·Î ÇØ½¬ ¾ÏÈ£È­</para></listitem>
	<listitem><para>¾ÏÈ£È­µÈ ÇØ½¬¿Í ¼­¸íµÈ ÀÎÁõ¼­¸¦ ¸Þ½ÃÁö¿¡ Ãß°¡</para></listitem>
	<listitem><para>¹Þ´Â »ç¶÷Àº µû·Î ÇØ½¬¸¦ »ý¼º</para></listitem>
	<listitem><para>¹ÞÀº ¸Þ½ÃÁö¿¡ Æ÷ÇÔµÈ ÇØ½¬¸¦ Public Key¸¦ ÀÌ¿ëÇØ¼­ º¹È£È­</para></listitem>
	<listitem><para>4, 5¹ø °úÁ¤¿¡¼­ »ý¼ºµÈ ÇØ½¬¸¦ ºñ±³</para></listitem>
	</orderedlist>

   </sect2>
   <sect2>
    <title>
	¾ÏÈ£¹®(Pass Phrase):
   </title>
   <para>
	¾ÏÈ£¹®(Pass Phrase)Àº ±âÁ¸ÀÇ ÆÐ½º¿öµå(Password)¸¦ È®ÀåÇÑ ½Ã½ºÅÛÀÌ´Ù. ¿¹ÀüÀÇ Unix ½Ã½ºÅÛÀÇ ¾ÏÈ£(Password)´Â 8ÀÚ°¡ ÇÑ°è¿´´Ù. ¾ÏÈ£¹®ÀÌ¶ó´Â °ÍÀº ´Ü¼øÈ÷ ¾ÏÈ£ÀÇ ÇÑ°è°¡ ´õ ±æ¾îÁ³´Ù´Â °ÍÀ» ¶æÇÑ´Ù. ´ç¿¬È÷ 8ÀÚ°¡ ÇÑ°èÀÎ °Íº¸´Ù º¸¾ÈÀÌ °­·ÂÇÏ´Ù. ÃÖ±ÙÀÇ Unix ½Ã½ºÅÛÀº MD5¸¦ »ç¿ëÇÏ°í ÀÖ±â ¶§¹®¿¡ ¾ÏÈ£ÀÇ ±æÀÌ Á¦ÇÑÀÌ ¾ø¾îÁ³´Ù.
   </para>
   <para>
   (¿ªÁÖ:¾ÏÈ£¹®Àº SSL¿¡¼­ Å°°¡ ´©ÃâµÇ¾úÀ» °æ¿ì, ÃÖÁ¾ º¸¾È ÀåÄ¡ÀÌ±â ¶§¹®¿¡, Áß¿äÇÑ Å°¿¡´Â ¹Ýµå½Ã »õ°ÜµÎ¾î¾ß ÇÑ´Ù.)
   </para>
   </sect2>
  </sect1>
  <sect1>
   <title>
   S/MimeÀº ¹«¾ùÀ» ¶æÇÏ¸ç, ±× ¿Ü ´Ù¸¥ ÇÁ·ÎÅäÄÝÀº ¹«¾ùÀÌ ÀÖ´Â°¡?
  </title>
  <para>
   SSLÀÌ À¥ÀÇ ±â´ÉÀ» È®ÀåÇÏ±â À§ÇØ »ý°Ü³µ´Ù¸é, ´Ù¸¥ ÇÁ·ÎÅäÄÝµéµµ SSLÀ» »ç¿ëÇÏ¿©(Encapsulate) ¾ÏÈ£È­µÈ ÇÁ·ÎÅäÄÝ·Î ¸¸µé ¼ö ÀÖÀ» °ÍÀÌ´Ù. ÇöÀç ÀÌ·¸°Ô ¸¸µé¾îÁø ÇÁ·ÎÅäÄÝµéÀÌ IMAPS, POPS, SMAPS µîµîÀÌ ÀÖ´Ù. (¿ªÁÖ:³¡¿¡ S¸¸ Ãß°¡µÇ¾ú´Ù) ÀÌ·¯ÇÑ º¸¾È ÇÁ·ÎÅäÄÝÀº ±âÁ¸ÀÇ ÇÁ·ÎÅäÄÝ°ú´Â ´Ù¸¥ Æ÷Æ®(Port)¸¦ »ç¿ëÇÏ°Ô µÈ´Ù. SSLÀº ÀÌ·± ÇÁ·ÎÅäÄÝ»Ó¸¸ ¾Æ´Ï¶ó ¾î¶°ÇÑ µ¥ÀÌÅÍÀÇ Àü¼Û¿¡µµ Á¢¸ñÇØ¼­(Encapsulate) »ç¿ëÇÒ ¼ö ÀÖ´Ù. S/MimeÀº ¹Ù·Î ÀÌ·¯ÇÑ ¿ªÇÒÀ» ÇÏ´Â ÇÁ·ÎÅäÄÝÀÌ´Ù. ±×°ÍÀ» »ç¿ëÇÏ¸é ÀÏ¹Ý e-mail ¸Þ½ÃÁö¸¦ ¹Þ´Â »ç¶÷ÀÇ Public Key¸¦ ÀÌ¿ëÇØ¼­ ¾ÏÈ£È­ÇÒ ¼ö ÀÖ´Ù. ±×·¯¹Ç·Î S/MimeÀ» »ç¿ëÇÏ±â Àü¿¡ ¹Ýµå½Ã ¹Þ´Â »ç¶÷ÀÇ Public Key¸¦ À¥ÀÌ³ª ÀúÀå¼Ò(Repository), e-mailÀ» ÅëÇØ¼­ ¹Þ¾Æ¾ß ÇÑ´Ù. (e-mailÀ» »ç¿ëÇÒ ¶§´Â ±× »ç¶÷ÀÌ Á¤È®ÇÑ »ç¶÷ÀÎÁö È®ÀÎÇÏ±â À§ÇØ ÀÎÁõ¼­¿Í ÇÔ²² ¹Þ´Â °ÍÀÌ ÁÁ´Ù.)
  </para>
  <para>
   ¶ÇÇÑ ¹Ý´ë¹æÇâÀ¸·Î Å¬¶óÀÌ¾ðÆ®°¡ ¼­¸íµÈ ÀÎÁõ¼­¸¦ ¼­¹öÂÊÀ¸·Î º¸³¾ ¼öµµ ÀÖ´Ù. ¿¹ÄÁµ¥ À¥ºê¶ó¿ìÀú°¡ À¥¼­¹ö·Î ÀÎÁõ¼­¸¦ º¸³¾ ¼ö ÀÖ´Ù. ÀÌ·¸°Ô ÇÏ·Á¸é ¸ðµç »ç¶÷ÀÌ ÀÎÁõ ±â°ü À¥»çÀÌÆ®¿¡¼­ ºê¶ó¿ìÀú ÀÎÁõ¼­¸¦ ¹Þ¾Æ¾ß ÇÑ´Ù. ±×¸®°í ³ª¼­ ¼­¸íµÈ ÀÎÁõ¼­°¡ Private Key·Î ¾ÏÈ£È­µÇ¾î Àü¼ÛµÇ°í, Public Key·Î º¹È£È­µÈ´Ù.
  </para>
  </sect1>
 </chapter>
 <chapter>
  <title>
  ÀÎÁõ¼­ °ü¸®
 </title>
  <sect1>
   <title>
   ¼³Ä¡
  </title>
  <para>
   ¿À´Ã³¯ OpenSSLÀÇ ¼³Ä¡´Â ¸Å¿ì ½±°Ô µÇ¾îÀÖ´Ù.. ÆÐÅ°Áö °ü¸® ½Ã½ºÅÛ(¿ªÁÖ:DebianÀº deb, RedHatÀº rpm, FreeBSD´Â Æ÷Æ® ½Ã½ºÅÛ)À» »ç¿ëÇÏ¸é °£ÆíÇÏ°Ô ¼³Ä¡ÇÒ ¼ö ÀÖ´Ù. ¸¸¾à ÀÌ·¯ÇÑ ¿©°ÇÀÌ ¾ÈµÈ´Ù¸é OpenSSL tarball ÆÄÀÏ ¼Ó¿¡ ÀÖ´Â README¿Í INSTALL ÆÄÀÏÀ» ÀÐ¾îº¸±â¸¦ ±ÇÇÑ´Ù.
  </para>
  <para>
   È¤½Ã µ¶ÀÚµéÀÇ ½Ã½ºÅÛ°ú ÇÊÀÚÀÇ ½Ã½ºÅÛÀÌ Æ²¸± ¼ö ÀÖÀ¸¹Ç·Î, ¿©±â¼­ °£´ÜÈ÷ ÇÊÀÚÀÇ OpenSSL ¼³Ä¡ ¿É¼ÇÀ» ¼³¸íÇÏ°Ú´Ù.
  </para>
  <para>
   ¸ðµç OpenSSL ÀÎÁõ¼­°¡ ÀÖ´Â µð·ºÅä¸®´Â /var/ssl/·Î ¼³Á¤ÇÏ¿´´Ù. ÀÌ ¹®¼­ÀÇ ¸ðµç ¸í·É°ú °æ·Î´Â ÀÌ µð·ºÅä¸®¸¦ ÀÇ¹ÌÇÑ´Ù°í º¸¸é µÈ´Ù. Àý´ëÀûÀÎ °ÍÀº ¾Æ´ÏÁö¸¸, ¿¹Á¦¸¦ ÀÌÇØÇÏ´Âµ¥ µµ¿òÀÌ µÉ °ÍÀÌ´Ù.
  </para>
  <para>
   OpenSSLÀ» °¡Àå ±âº»ÀûÀÎ ¿É¼ÇÀ¸·Î ¼³Ä¡ÇÏ¸é ¼³Á¤ ÆÄÀÏÀÌ /usr/lib/ssl/openssl.cnf¿¡ À§Ä¡ÇÏ°Ô µÈ´Ù. ÀÌ °æ·Î´Â -config¿É¼ÇÀ¸·Î ¹Ù²Ü ¼ö ÀÖ´Ù. ÇÊÀÚ´Â /etc/openssl.cnf¸¦ ¼³Á¤ ÆÄÀÏ·Î »ç¿ëÇÏ°í ÀÖ´Ù. ÀÌ ¼³Á¤ ÆÄÀÏÀº openssl ca¸í·ÉÀÌ³ª openssl req¸í·É¿¡ ¿µÇâÀ» ¹ÌÄ¡°Ô µÈ´Ù.
  </para>
  <para>
   À¯Æ¿¸®Æ¼³ª ´Ù¸¥ ¶óÀÌºê·¯¸®µéÀº /usr/lib/ssl¿¡ À§Ä¡ÇÏ°í ÀÖ´Ù.
  </para>
  <para>
   CA.plÀÌ¶õ ½ÇÇà ½ºÅ©¸³Æ®°¡ /usr/sbin°ú °°Àº ½ÇÇà °æ·Î¿¡ ÀÖ´Â °ÍÀ» È®ÀÎÇØ¾ß ÇÑ´Ù. CA.plÀº ±âº»ÀûÀ¸·Î /usr/lib/ssl µð·ºÅä¸®¿¡ ÀÖ´Ù. ÀÌ ½ºÅ©¸³Æ®´Â º¹ÀâÇÑ openssl¸í·ÉÀ» °£ÆíÈ­½ÃÄÑÁÖ´Â À¯Æ¿¸®Æ¼´Ù.
  </para>
  <para>
   /usr/sbin/CA.plÆÄÀÏ¿¡¼­ openssl ca¿Í openssl req°¡ ½ÇÇàµÉ ¶§ -config /etc/openssl.cnf ¿É¼ÇÀÌ Æ÷ÇÔµÇµµ·Ï ¼öÁ¤ÇØ¾ß ÇÑ´Ù.
   
  </para>
  <programlisting>
#$SSLEAY_CONFIG=$ENV{"SSLEAY_CONFIG"} 
$SSLEAY_CONFIG="-config /etc/openssl.cnf"; 
  </programlisting>
  <para>
   /etc/openssl.cnf ¶ÇÇÑ ¼öÁ¤ÇØ¼­ ÀÔ·ÂÀ» ÃÖ¼ÒÈ­ÇØ¾ß ÇÑ´Ù. (¿ªÁÖ:openssl.cnf¿¡´Â ±âº»ÀûÀÎ ÀÎÁõ±â°ü Private KeyÀ§Ä¡, ÀÎÁõ¼­ À§Ä¡, Serial Number µîµîÀÇ À§Ä¡°¡ ÀÖ´Ù. ÀÌ·¯ÇÑ °ÍÀÌ Á¦´ë·Î µÇ¾îÀÖÁö ¾Ê´Ù¸é ¼öÁ¤ÇÏ°í, ÇÊ¿ä¿¡ µû¶ó policyºÎºÐ, Netscape Comment ºÎºÐµµ ¼öÁ¤ÇÑ´Ù. ±× ¿Ü¿¡ ÀÎÁõ¼­ÀÇ ¿ëµµ, ´Ù¸¥ ÀÌ¸§(Alt Name)µîµîµµ ÇÊ¿ä¿¡ µû¶ó ¼öÁ¤ÇÑ´Ù. ¾Æ·¡ÀÇ ¿¹Á¦´Â ¾ÆÁ÷ ¹®¼­ ¹öÀü 0.1¿¡´Â Æ÷ÇÔÀÌ µÇ¾î ÀÖÁö ¾ÊÀ¸³ª, ÃßÈÄ Ãß°¡µÉ °ÍÀÌ´Ù)
  </para>
  <programlisting>
/etc/openssl.cnf example
  </programlisting>
  <para>
   ÀÎÁõ ±â°ü(Certification Authority)À» »ý¼ºÇÏ·Á¸é ¾Æ·¡¿Í °°ÀÌ ¸í·ÉÀ» ³»¸®¸é µÈ´Ù:
  </para>
  <programlisting>
CA.pl -newca
  </programlisting>
  </sect1>
  <sect1>
   <title>
   ·çÆ® ÀÎÁõ ±â°ü ÀÎÁõ¼­(Root Certification Authority Certificate) ¸¸µé±â
  </title>
  <programlisting>
CA.pl -newcert 
(openssl req -config /etc/openssl.cnf-new -x509 -keyout newreq.pem -out newreq.pem -days 365) 
  </programlisting>
  <para>
   ÀÚÃ¼ ¼­¸íµÈ ·çÆ® ÀÎÁõ ±â°üÀÇ ÀÎÁõ¼­¸¦ ¸¸µç´Ù. ÀÎÁõ¼­¿Í Private Key´Â newreq.pem ¿¡ ÀúÀåµÈ´Ù. Common Name(CN)Àº &quot;ACME root Certificate&quot;¿Í °°Àº °ÍÀ» »ç¿ëÇÏ¸é µÈ´Ù. ÀÌ ÆÄÀÏ¿¡´Â ÀÎÁõ¼­¿Í Private Key°¡ ¼¯¿©ÀÖ±â ¶§¹®¿¡ ÂÉ°³¾ß ÇÑ´Ù. ---CERTIFICATE--- ºÎºÐÀº ÀÎÁõ¼­ ºÎºÐÀ¸·Î cacert.pemÀÌ¶õ ÆÄÀÏ¿¡ ÀúÀåÇÏ°í, ---RSA PRIVATE KEY---ºÎºÐÀº Private Key·Î cakey.pem¿¡ ÀúÀåÇÑ´Ù. (¿ªÁÖ:ÀÌ ¶§ ¹Ýµå½Ã ---BEGIN...---ºÎºÐ°ú ---END...--- ºÎºÐÀÌ Æ÷ÇÔµÇµµ·Ï ÀúÀåÇØ¾ß ÇÑ´Ù.) ±× ´ÙÀ½¿¡ Å° ´©ÃâÀ» ¹æÁöÇÏ±â À§ÇØ newreq.pemÀ» Áö¿ìÀÚ.
  </para>
  <para>
   openssl.cnf¿¡ Æ÷ÇÔµÈ database°æ·Î¿¡ &quot;index.txt&quot;¶ó´Â ºó ÆÄÀÏÀ» ¸¸µé°í, serial°æ·Î¿¡ 1 ÀÌ¶õ ¼ýÀÚ·Î µÈ &quot;serial&quot;ÆÄÀÏÀ» »ý¼ºÇÑ´Ù. (¿ªÁÖ:¾Æ·¡´Â ¿ªÀÚ°¡ »ý¼ºÇÑ ¹æ¹ýÀÌ´Ù.)
  </para>
  <programlisting>
# touch /etc/index.txt
# echo "01" > /etc/serial
  </programlisting>
  <para>
   ±âº»ÀûÀ¸·Î 365ÀÏ ³¯Â¥ Á¦ÇÑÀÌ µÇ¾î ÀÖ´Âµ¥, ÀÌ·¸°Ô ÇÏ¸é 1³âÀÌ Áö³ª°í ³ª¼­ ´õÀÌ»ó ·çÆ® ÀÎÁõ ±â°üÀÇ Å°¿Í ±×°Í¿¡ ÀÇÇØ ¼­¸íµÈ Å°µéÀ» »ç¿ëÇÒ ¼ö ¾ø´Ù. ÀÌ·¸°Ô µÇ´Â °ÍÀ» ¹æÁöÇÏ·Á¸é ³¯Â¥ Á¦ÇÑÀ» Å©°Ô ÇØ¼­ »ý¼ºÇÏ¸é µÈ´Ù. ±â¾÷ Á¤µµÀÇ ·¹º§¿¡¼­´Â ¾à 5³â Á¤µµÀÇ ±â°£À» ±Ç°íÇÑ´Ù. (¿ªÁÖ:¾ÆÁ÷ SSL¿¡ ´ëÇØ ¿Ïº®È÷ ¾ËÁö ¸øÇÑ´Ù¸é ÂªÀº ±â°£¸¸ ¼³Á¤ÇÒ °ÍÀ» ±Ç°íÇÑ´Ù.)
   
  </para>
  <programlisting>
openssl req -config /etc/openssl.cnf-new -x509 -keyout newreq.pem -out newreq.pem -days 1825
  </programlisting>
  <para>
   ÀÌ·¸°Ô »ý¼ºµÈ ·çÆ® ÀÎÁõ ±â°ü Å°´Â ¹Ýµå½Ã ´Ù¸¥ ÀÎÁõ¼­µéÀ» ¼­¸íÇÏ´Â °÷¿¡¸¸ »ç¿ëÇØ¾ß ÇÑ´Ù. Private Key´Â À§Çè¿¡ ³ëÃâµÇÁö ¾Êµµ·Ï ¹Ýµå½Ã ¾ÈÀüÇÑ °÷¿¡ º¸°üÇÏ°í, Àý´ë·Î ¾ÏÈ£¹®(Passphrase)À» Á¦°ÅÇØ¼­´Â ¾ÈµÈ´Ù.
  </para>
  <para>
   ÀÚ. ÀÌÁ¦ ·çÆ® ÀÎÁõ ±â°üÀ» ¸¸µé¾ú´Ù. ´Ù¸¥ »ç¶÷µéÀÌ ´ç½ÅÀÇ ·çÆ® ÀÎÁõ ±â°ü ÀÎÁõ¼­°¡ ÇÊ¿äÇÒ ¼ö ÀÖ´Ù. ±×·¯¸é ±×µé¿¡°Ô ´Ù¿î·Îµå¹Þ¾Æ¼­ ±×µéÀÇ ºê¶ó¿ìÀú¿¡ ¼³Ä¡ÇÏ¶ó°í ¾Ë·ÁÁÖ¸é µÈ´Ù.
  </para>
  <para>
   ´Ù¸¥ ÀÎÁõ¼­¸¦ ¼­¸íÇÒ ¶§¸¶´Ù ¾ÏÈ£¹®À» ÀÔ·ÂÇØ¾ß ÇÏ´Â ¹ø°Å·Î¿òÀÌ ÀÖÁö¸¸, Private Key°¡ ´©ÃâµÉ °ÍÀ» »ý°¢ÇØ¼­ ±ÍÂú°Ô ¿©±âÁö ¸»ÀÚ.
  </para>
  </sect1>
  <sect1>
   <title>
   ÇÏºÎ ÀÎÁõ ±â°ü ÀÎÁõ¼­(Non-root Certification Authority Certificate) ¸¸µé±â
  </title>
  <para>
   FIXME ÇÊÀÚ´Â ÀÌ ÀÛ¾÷¿¡ ´ëÇØ Àß ¾ËÁö ¸øÇÑ´Ù.
  </para>
  <para>
   ·çÆ® ÀÎÁõ ±â°ü¿¡ ÀÇÇØ ¼­¸íµÈ ÀÎÁõ¼­¸¦, ¶Ç´Ù½Ã ´Ù¸¥ ÀÎÁõ¼­¸¦ ¼­¸íÇÏ´Âµ¥ »ç¿ëÇÒ ¼öµµ ÀÖ´Ù. ÀÌ ¶§ ¼­¸í ±ÇÇÑÀ» ³Ñ°ÜÁÖ¾î¾ß ÇÑ´Ù. ¸¸¾à ÀÌ·¯ÇÑ ÀÎÁõ¼­¸¦ »ç¿ëÇÏ·Á¸é ÀÎÁõ ¿ä±¸¼­(Certificate Request)¿Í Private Key¸¦ ¸¸µç ÈÄ, ¼­µå ÆÄÆ¼¿¡°Ô ÀÎÁõ ¿ä±¸¼­¸¦ º¸³»¸é µÈ´Ù. ±×·¯¸é ¼­µå ÆÄÆ¼°¡ ¼­¸íÇÑ ÀÎÁõ¼­¸¦ ¹Þ¾Æ¼­ Private Key¿Í ÇÔ²² ¼³Ä¡ÇÏ¸é µÈ´Ù. ÀÌ¶§µµ ¿ª½Ã ---RSA PRIVATE KEY---ºÎºÐÀº cakey.pem°ú °°Àº ÆÄÀÏ¿¡ ÀúÀåÇÏ°í, ---CERTIFICATE---ºÎºÐÀº cacert.pemÀ¸·Î ÀúÀåÇØ¼­ »ç¿ëÇÏ¸é µÈ´Ù.
   </para>
   <para>
   (¿ªÁÖ:ÀÎÁõ ±ÇÇÑ ¼³Á¤Àº openssl.cnf¸¦ ÀÌ¿ëÇÏ¸é µÇ¸ç, ÀÌ·¯ÇÑ ÀÎÁõ¼­¸¦ ¸¸µé°í »ç¿ëÇÏ·Á¸é CA.pl°ú °°Àº ÀÚµ¿ ½ºÅ©¸³Æ®°¡ ¾Æ´Ñ, openssl.cnf¸¦ ºñ¸©ÇÑ openssl ¸í·ÉÀ» ÀÌ¿ëÇÑ ¼öµ¿ »ç¿ë¹ý¿¡ ´ëÇØ Àß ¾Ë°í ÀÖ¾î¾ß ÇÑ´Ù. Verisign°ú ThawteµîµîÀÇ »ó¾÷ ÀÎÁõ ±â°ü¿¡¼­ ¼­¸íµÈ Å°¸¦ »ç¿ëÇÏ·Á¸é ÀÎÁõ ¿äÃ»¼­(Certificate Request)¸¦ ¸¸µç ÈÄ, ÀÎÁõ ¿äÃ»¼­¸¦ ¿ä±Ý°ú ÇÔ²² º¸³»ÁÖ¸é ÀÎÁõ¼­¸¦ ¹ÞÀ» ¼ö ÀÖ´Ù. Á¶¸¸ÇÑ HOWTO¿¡µµ ÀÌ ºÎºÐÀÌ ÀÚ¼¼È÷ Ãß°¡µÉ °ÍÀ¸·Î ¿¹»óµÈ´Ù.)
  </para>
  </sect1>
  <sect1>
   <title>
   Root CA Certificate¸¦ Trusted Root Certificate·Î ¼³Ä¡ÇÏ±â
  </title>
  <para>
   ¿ì¼± ---CERTIFICATE---·Î µÈ ÀÎÁõ¼­ ºÎºÐÀ» Àß¶ó¾ß ÇÑ´Ù.
  </para>
  <programlisting>
openssl x509 -in cacert.pem -out cacert.crt
  </programlisting>
  <para>
   ÀÌ ÆÄÀÏÀ» http://mysite.com/ssl/cacert.crt¿Í °°Àº °æ·Î¿¡ ÀúÀåÇÑ´Ù. À¥¼­¹ö¿¡ .crt ÆÄÀÏ¿¡ ´ëÇÑ MIMEÀ» Ãß°¡ÇÏ°í, ºê¶ó¿ìÀú·Î ÇÏ¿©±Ý ÇÏµåµð½ºÅ©¿¡ ÀúÀåÇÏµµ·Ï ÇÏ¸é µÈ´Ù.
  </para>
   <sect2>
    <title>
    ³Ý½ºÄÉÀÌÇÁ(Netscape)
   </title>
   <para>
    FIXME
   </para>
   </sect2>
   <sect2>
    <title>
    °¥·¹¿Â(Galeon)
   </title>
   <para>
    FIXME
   </para>
   </sect2>
   <sect2>
    <title>
	ÀÎÅÍ³Ý ÀÍ½ºÇÃ·Î¾î(Internet Explorer)
   </title>
   <para>
	ºê¶ó¿ìÀú¿¡¼­ ÀÎÁõ¼­°¡ ÀÖ´Â ÁÖ¼Ò¸¦ Ä¡°í µð½ºÅ©¿¡ ÀúÀåÇÑ´Ù. ÆÄÀÏÀ» ´õºí Å¬¸¯ÇÏ°í ¼³Ä¡¸¦ ´©¸£¸é ÀÎÁõ¼­ ¼³Ä¡ ¸¶¹ý»ç(Certificate Installation Wizard)°¡ ½ÃÀÛµÉ °ÍÀÌ´Ù. ·çÆ® ÀÎÁõ ±â°ü ÀÎÁõ¼­´Â ÀÚÃ¼ ¼­¸íµÇ¾î ÀÖ±â ¶§¹®¿¡, ÀÎÅÍ³Ý ÀÍ½ºÇÃ·Î¾î¿¡¼­ ÀÚµ¿ÀûÀ¸·Î Trusted root Certificate Authority ¸®½ºÆ®¿¡ ÀúÀåÇÏ°Ô µÈ´Ù. ±×·¸°Ô ¼³Ä¡ÇÏ¸é ´ÙÀ½ºÎÅÍ ±× ·çÆ® ÀÎÁõ ±â°ü ÀÎÁõ¼­·Î ¼­¸íµÇ¾î ÀÖ´Â ÀÎÁõ¼­´Â ÀÚµ¿ÀûÀ¸·Î ½Å¿ëÇÏ°Ô µÈ´Ù.
   </para>
   </sect2>
  </sect1>
  <sect1>
   <title>
   ÀÎÁõ¼­ °ü¸®
  </title>
   <sect2>
    <title>
	ÀÎÁõ ¿ä±¸¼­ »ý¼º°ú ¼­¸íÇÏ±â
   </title>
   <programlisting>
CA.pl -newreq 
(openssl req -config /etc/openssl.cnf -new -keyout newreq.pem -out newreq.pem -days 365) 
   </programlisting>
   <para>
	»õ·Î¿î Private Key¿Í ÀÎÁõ ¿ä±¸¼­¸¦ newreq.pem¿¡ ÀúÀåÇÑ´Ù.
   </para>
   <programlisting>
CA.pl -sign 
(openssl ca -config /etc/openssl.cnf -policy policy_anything -out newcert.pem -infiles newreq.pem) 
   </programlisting>
   <para>
	ÀÎÁõ ¿ä±¸¼­¸¦ ¾Æ±î ¸¸µç ·çÆ® ÀÎÁõ ±â°üÀÇ Å°·Î ¼­¸íÇÑ ÈÄ, newcert.pemÀÌ¶õ »õ·Î¿î ÀÎÁõ¼­¸¦ »ý¼ºÇÑ´Ù. ÀÌ ¶§ ÀÎÁõ ±â°üÀÇ ¾ÏÈ£¹®(Passphrase)À» ³Ö¾î¾ß ¼­¸íÀÌ µÉ °ÍÀÌ´Ù. ±×¸®°í ³­ ÈÄ newcerts/xx.pemÀÌ¶õ ÆÄÀÏÀÌ openssl.cnf¿¡¼­ ÁöÁ¤ÇÑ °æ·Î¿¡ »ý±â¸ç, index.txt, serialÀÌ ÀÚµ¿À¸·Î °»½ÅµÈ´Ù.
   </para>
   <para>
	Private Key´Â newreq.pem ÆÄÀÏ¿¡ ---PRIVATE KEY--- ¶ó°í µÇ¾î ÀÖÀ¸¸ç, ÀÎÁõ¼­´Â newcert.pem¿¡ ---CERTIFICATE---¶ó°í µÇ¾î ÀÖ´Ù.
   </para>
   <para>
	¹æ±Ý ¸»Çß´Ù½ÃÇÇ newcerts/¶õ µð·ºÅä¸®¿¡ newcert.pemÆÄÀÏÀÌ »ý±â¸ç index.txt°¡ °»½ÅµÈ´Ù. Å¬¶óÀÌ¾ðÆ®´Â ÀÌ Á¤º¸¸¦ ¹ÙÅÁÀ¸·Î À¥¼­¹ö¿¡°Ô ÀÎÁõ ±â°ü¿¡ ´ëÇÑ Á¤º¸¸¦ ¿äÃ»ÇÒ ¼ö ÀÖ´Ù.
   </para>
   <para>
	newreq.pemÆÄÀÏÀ» Á¶½ÉÇØ¼­ ´Ù·ç¾î¾ß ÇÑ´Ù. ±× ÆÄÀÏ¿¡´Â ÀÎÁõ ¿ä±¸¼­ »Ó¸¸ ¾Æ´Ï¶ó, Private Key±îÁö µé¾îÀÖ±â ¶§¹®ÀÌ´Ù. Private Key´Â ¼­¸íÇÒ ½Ã¿¡ ÇÊ¿ä°¡ ¾øÀ¸¸ç, °°ÀÌ º¸³¾ °æ¿ì ÀÎÁõ ±â°ü¿¡°Ô º¸¾ÈÀÌ ³ëÃâµÉ ¼ö ÀÖ´Ù. ±×·¡¼­ ¸¸¾à ´Ù¸¥ ÀÎÁõ ±â°ü¿¡°Ô ÀÎÁõ ¿ä±¸¼­¸¦ º¸³¾ ¶§´Â ¹Ýµå½Ã ---PRIVATE KEY--- ºÎºÐÀº Àß¶ó³»¾ß ÇÑ´Ù. ¹Ý´ë·Î ´ç½ÅÀÌ ¼­¸íÀ» ÇÒ ¶§´Â ---CERTIFICATE REQUEST---ºÎºÐ¸¸ º¸³»ÁÖµµ·Ï ¿ä±¸ÇØ¾ßÇÑ´Ù.
   </para>
   </sect2>
   <sect2>
    <title>
	ÀÎÁõ¼­ Ã¶È¸ÇÏ±â
   </title>
   <para>
	ÀÎÁõ¼­¸¦ Ã¶È¸ÇÏ±â À§ÇØ¼­´Â ¾Æ·¡¿Í °°ÀÌ ¸í·ÉÇÏ¸é µÈ´Ù:
   </para>
   <programlisting>
openssl ca -revoke newcert.pem
   </programlisting>
   <para>
	±×·¯¸é µ¥ÀÌÅÍº£ÀÌ½º°¡ ¾÷µ¥ÀÌÆ®µÇ°í, ÀÎÁõ¼­°¡ Ã¶È¸µÇ¾ú´Ù°í Ç¥½ÃµÈ´Ù. ´ÙÀ½Àº ÀÎÁõ¼­ÀÇ ÀÎÁõ Ã¶È¸ ¸®½ºÆ®¸¦ ÀÛ¼ºÇØ¾ß ÇÑ´Ù.
   </para>
   <programlisting>
openssl ca -gencrl -out crl/crl.pem
   </programlisting>
   <para>
   (¿ªÁÖ:MS Windows¿¡¼­´Â .crlÀÌ¶õ È®ÀåÀÚ¸¦ ÀÎÁõ Ã¶È¸ ¸®½ºÆ®·Î ÀÎ½ÄÇÑ´Ù. À§ pemÈ®ÀåÀÚ¸¦ crlÀ¸·Î ¹Ù²Ù¸é MS Windows¿¡¼­ »ç¿ëÇÒ ¼ö ÀÖ´Ù.)
   </para>
   </sect2>
   <sect2>
    <title>
	ÀÎÁõ¼­ °»½ÅÇÏ±â
   </title>
   <para>
	³¯Â¥ Á¦ÇÑÀÌ Áö³ª°Å³ª Private Key°¡ ´©ÃâµÇ¸é ´õ ÀÌ»ó ÀÎÁõ¼­¸¦ »ç¿ëÇÒ ¼ö ¾øÀ¸¹Ç·Î »õ·Î¿î ÀÎÁõ¼­¸¦ ¹ßÇàÇØ¾ß ÇÑ´Ù. ÀÌ ¶§ À¯ÀúµéÀÌ ÀÎÁõ¼­¸¦ ºÐ½ÇÇØ¼­ ÀÎÁõ ¿ä±¸¼­³ª Private Key¸¦ º¸³»ÁÖ¸é¼­ Ã¶È¸ ¿ä±¸¸¦ ÇÒ ¼öµµ ÀÖ´Ù.
   </para>
   <para>
	¿ì¼± ¿¹ÀüÀÇ ÀÎÁõ¼­¸¦ Ã¶È¸ÇÏ°í ÀÎÁõ ¿ä±¸¼­¸¦ ´Ù½Ã ¼­¸íÇØ¾ß ÇÑ´Ù.
   </para>
   <para>
	¿¹ÀüÀÇ ÀÎÁõ¼­¸¦ Ã£±â À§ÇØ¼­´Â index.txt ÆÄÀÏ¿¡ Distinguished Name (DN) ºÎºÐ, serial ÆÄÀÏÀÇ Serial Number ºÎºÐÀ» ÀÎÁõ ¿ä±¸¼­¿Í ÇÔ²² ºñ±³ÇÏ¸é µÈ´Ù. ±×¸®°í ±×¿¡ ¸Â´Â cert/&lt;xx&gt;.pem ¿¡ ÀúÀåµÈ ÀÎÁõ¼­¸¦ ÀÎÁõ Ã¶È¸½Ã¿¡ »ç¿ëÇÏ¸é µÈ´Ù.
   </para>
   <para>
	½ÃÀÛ°ú ¸¸±âÀÏÀ» È®½ÇÈ÷ ÇÏ±â À§ÇØ ¼öµ¿À¸·Î ¼­¸íÇÒ ¼öµµ ÀÖ´Ù.
   </para>
   <programlisting>
openssl ca -config /etc/openssl.cnf -policy policy_anything -out newcert.pem -infiles newreq.pem -startdate [now] -enddate [previous enddate+365days]
   </programlisting>
   <para>
    &lsqb;now&rsqb; ºÎºÐ°ú &lsqb;previous enddate+365days&rsqb; ºÎºÐÀ» Á¤È®ÇÑ °ªÀ¸·Î ¼öÁ¤ÇØ¼­ ½ÇÇàÇÏ¸é µÈ´Ù.
   </para>
   </sect2>
   <sect2>
    <title>
	À¥ ±â¹Ý Certificate Authority ¸¸µé±â
   </title>
   <para>
	¾Æ·¡´Â ÀÎÁõ ±â°üÀ» ¿î¿µÇÒ ¶§ ÇÊ¿äÇÑ °ÍÀÌ´Ù.
   </para>
   <orderedlist>
    <listitem>
    <para>
	·çÆ® ÀÎÁõ ±â°üÀÇ ÀÎÁõ¼­¸¦ ¹ßÇàÇØ¼­ ÀÀ¿ë ÇÁ·Î±×·¥¿¡ ¼³Ä¡µÇµµ·Ï ÇØ¾ß ÇÑ´Ù.
    </para>
   </listitem>
    <listitem>
    <para>
	ÀÎÁõ Ã¶È¸ ¸®½ºÆ®¸¦ ¹ßÇàÇØ¾ß ÇÑ´Ù.
    </para>
   </listitem>
    <listitem>
    <para>
	ÀÎÁõ¼­ÀÇ Á¤º¸¸¦ Serial Number¸¦ Æ÷ÇÔÇØ¼­ ÀÚ¼¼È÷ Ãâ·ÂµÇµµ·Ï ÇØ¾ß ÇÑ´Ù.
    </para>
   </listitem>
    <listitem>
    <para>
	À¯Àúµé·Î ÇÏ¿©±Ý ÀÎÁõ ¿ä±¸¼­¸¦ ¹ÞÀ» ¼ö ÀÖµµ·Ï Æû(form)À» Á¦°øÇØ¾ß ÇÑ´Ù.
    </para>
   </listitem>
   </orderedlist>
   <para>
	À¥¼­¹ö¿Í ¸î¸î ½ºÅ©¸³Æ® ¾ð¾î¸¦ ÀÌ¿ëÇÏ¸é À§¿Í °°Àº °ÍµéÀ» ÇÒ ¼ö ÀÖ´Ù.
   </para>
   </sect2>
  </sect1>
  <sect1>
   <title>
   ÀÎÅÍ³Ý ÇÁ·ÎÅäÄÝ º¸¾È
  </title>
   <sect2>
    <title>
	Apache¿¡¼­ mod_sslÀ» ÀÌ¿ëÇÏ¿© ÀÎÁõ¼­ »ç¿ëÇÏ±â
   </title>
   <para>
	Àý´ë·Î ·çÆ® ÀÎÁõ ±â°ü ÀÎÁõ¼­¸¦ Apache¿¡¼­ »ç¿ëÇÏ¸é ¾ÈµÈ´Ù. ¿Ö³ÄÇÏ¸é ApacheÀÇ Private Key´Â ¾ÏÈ£¹®(Passphrase)À» Á¦°ÅÇØ¾ß¸¸ »ç¿ëÇÒ ¼ö ÀÖ±â ¶§¹®ÀÌ´Ù.
   </para>
   <para>
	¿ì¼± ÀÎÁõ ¿ä±¸¼­¸¦ ¹ßÇàÇØ¾ß ÇÑ´Ù. ÀÌ ¶§ ¹Ýµå½Ã Common Name(CN)À» www.mysite.com°ú °°Àº À¥ µµ¸ÞÀÎÀ¸·Î ÇØ¾ß ÇÑ´Ù.
   </para>
   <para>
	´ÙÀ½¿¡ Apache°¡ Á¤»óÀûÀ¸·Î ÀÛµ¿ÇÏ±â À§ÇØ¼­ ¾ÏÈ£¹®À» Á¦°ÅÇØ¾ß ÇÑ´Ù. ¾Æ·¡´Â Private Key¸¦ Æ÷ÇÔÇÏ°í ÀÖ´Â newreq.pemÆÄÀÏ¿¡¼­ ¾ÏÈ£¹®À» Á¦°ÅÇÏ´Â ¹æ¹ýÀÌ´Ù.
   </para>
   <programlisting>
openssl rsa -in newreq.pem -out wwwkeyunsecure.pem
   </programlisting>
   <para>
	Private Key°¡ Á¦°ÅµÈ »óÅÂÀÌ±â ¶§¹®¿¡ ¹Ýµå½Ã ±ÇÇÑ(Permission)µîÀ» Ã¶ÀúÇÏ°Ô Ã¼Å©ÇØ¾ß ÇÑ´Ù. ¸¸¾à ´Ù¸¥ »ç¶÷ÀÌ Private Key¸¦ ¾ò°Ô µÇ¸é ±× »çÀÌÆ®´Â º¸¾ÈÀÌ ¸Á°¡Áö°Ô µÇ¸ç, ±× »ç¶÷ÀÌ ¾ÇÀÇ·Î Å°¸¦ »ç¿ëÇÒ ¼ö ÀÖ´Ù. ÀÌ ÀÛ¾÷ÀÌ ³¡³ª¸é newcert¿Í wwwkeyunsecure.pemÀ» Apache¿¡¼­ »ç¿ëÇÏ¸é µÈ´Ù.
   </para>
   <para>
	wwwkeyunsecure.pem°ú newcert.pemÀ» /etc/httpd/conf/ssl/¿¡ wwwkeyunsecure.pem °ú wwwcert.crt¶ó´Â ÀÌ¸§À¸·Î º¹»çÇÑ´Ù. (¿ªÁÖ:ÀÌ ¶§ wwwkeyunsecure.pemÀÌ ¼­¹ö À¯Àú¿¡°Ô ³ëÃâµÇÁö ¾Êµµ·Ï ÆÛ¹Ì¼ÇÀ» Àß °ü¸®ÇÑ´Ù.)
   </para>
   <para>
	/etc/httpd/conf/ssl/ssl.default-vhost.conf ÆÄÀÏÀ» ¼öÁ¤ÇÑ´Ù.
   </para>
   <programlisting>
---- 
# Server Certificate: 
# Point SSLCertificateFile at a PEM encoded certificate. If 
# the certificate is encrypted, then you will be prompted for a 
# pass phrase. Note that a kill -HUP will prompt again. A test 
# certificate can be generated with `make certificate' under 
# built time. 
#SSLCertificateFile conf/ssl/ca.crt 
SSLCertificateFile wwwcert.crt
# Server Private Key: 
# If the key is not combined with the certificate, use this 
# directive to point at the key file. 
#SSLCertificateKeyFile conf/ssl/ca.key.unsecure
SSLCertificateKeyFile wwwkeyunsecure.pem 
----
   </programlisting>
   <para>
	httpd ÇÁ·Î¼¼½º¸¦ Á×ÀÌ°í(/etc/rc.d/init.d/httpd stop), ¸ðµç ÇÁ·Î¼¼½º°¡ Á×¾ú´ÂÁö È®ÀÎÇÑ ÈÄ(killall httpd), Àç½ÃÀÛÇÑ´Ù. (etc/rc.d/init.d/httpd start)
   </para>
   <para>
   (¿ªÁÖ:Apache-SSLÀÇ °æ¿ì Apache¿Í º°µµÀÇ ÇÁ·Î¼¼½º¿¡¼­ µ¹¾Æ°¡¸ç, httpd.conf¿¡ SSL°ü·Ã ¼³Á¤ÀÌ ³»ÀåµÇ¾î ÀÖ´Ù.)
   </para>
   </sect2>
   <sect2>
    <title>
	IMAPS¿¡¼­ ÀÎÁõ¼­ »ç¿ëÇÏ±â
   </title>
   <para>
    FIXME
   </para>
   </sect2>
   <sect2>
    <title>
	POP¿¡¼­ ÀÎÁõ¼­ »ç¿ëÇÏ±â
   </title>
   <para>
    FIXME
   </para>
   </sect2>
   <sect2>
    <title>
	Postfix¿¡¼­ ÀÎÁõ¼­ »ç¿ëÇÏ±â
   </title>
   <para>
    FIXME
   </para>
   </sect2>
   <sect2>
    <title>
	Microsoft Key Manager·Î Å° »ý¼º°ú ¼­¸íÇÏ±â
   </title>
   <para>
	¸¶ÀÌÅ©·Î¼ÒÇÁÆ® Å° ¸Å´ÏÀú(Microsoft Key Manager)¿¡¼­ Å°¸¦ ¸¸µé±â À§ÇØ¼­´Â »ç¿ëÇÒ ¼­ºñ½º(¿¹ÄÁµ¥ IMAPÀÌ³ª WWW)¸¦ ¼±ÅÃÇØ¾ß ÇÑ´Ù. »õ·Î¿î Å°¸¦ »ý¼ºÇÏ·Á¸é ¸¶¹ý»ç(Wizard)¸¦ »ç¿ëÇÏ¸é µÈ´Ù. ¾Õ¿¡¼­´Â Common Name(CN)À» »çÀÌÆ® ÁÖ¼Ò¿Í µ¿ÀÏÇÏ°Ô Àû¾úÀ¸³ª, ¿©±â¼­´Â Distinguished NameÀ» ´Ù¸£°Ô Àû¾îµµ µÈ´Ù. ¸¶¹ý»ç´Â C:&bsol;NewKeyRq.txt ÀÌ¶õ ÆÄÀÏ¿¡ ÀÎÁõ ¿ä±¸¼­¸¦ ÀúÀåÇÏ°Ô µÈ´Ù. Å° ¸Å´ÏÀú´Â ±× Å°°¡ ¼­¸íµÇÁö ¾Ê¾Ò´Ù°í °æ°íÇÒ °ÍÀÌ´Ù.
   </para>
   <para>
	/var/ssl µð·ºÅä¸®¿¡ ±× ÆÄÀÏÀ» ¹Þ¾Æ¿Í¼­ newreq.pemÀ¸·Î ÀÌ¸§À» ¹Ù²Ù°í ¼­¸íÇÑ´Ù.
   </para>
   <programlisting>
CA.pl -sign
   </programlisting>
   <para>
	´ÙÀ½¿¡ newcert.pemÀ» È®ÀÎÇØº¸¸é ---CERTIFICATE---ºÎºÐ°ú ´Ù¸¥ ÅØ½ºÆ®µéÀÌ ÀÖ´Â °ÍÀ» º¼ ¼ö ÀÖ´Ù. ---CERTIFICATE---ºÎºÐÀ» Á¦¿ÜÇÑ ÅØ½ºÆ®¸¦ Á¦°ÅÇØ¾ß ºñ·Î¼Ò Å° ¸Å´ÏÀú°¡ ÀÎ½ÄÇÒ ¼ö ÀÖ°Ô µÈ´Ù. ¾Æ·¡¿Í °°ÀÌ ½±°Ô Á¦°ÅÇÒ ¼ö ÀÖ´Ù.
   </para>
   <programlisting>
openssl x509 -in newcert.pem -out newcertx509.pem
   </programlisting>
   <para>
	°£´ÜÇÏ°Ô ÅØ½ºÆ® ¿¡µðÅÍ¸¦ ÀÌ¿ëÇØ¼­ Áö¿öµµ µÈ´Ù. (ÀÌ ¶§ ---CERTIFICATE---ºÎºÐÀÌ Áö¿öÁöÁö ¾Êµµ·Ï ÁÖÀÇÇÏÀÚ)
   </para>
   <para>
	ÀÌ·± ÀÛ¾÷À» °ÅÄ¡¸é newcertx509.pem¿¡´Â ---CERTIFICATE---ºÎºÐ¸¸ ³²°Ô µÈ´Ù.
   </para>
   <para>
	newcertx509.pem ÆÄÀÏÀ» Å° ¸Å´ÏÀú°¡ µ¹¾Æ°¡°í ÀÖ´Â ÄÄÇ»ÅÍ·Î Àü¼ÛÇÏ°í, ¸¶¿ì½º ¿À¸¥ÂÊ ¹öÆ°À» ´©¸£¸é ¼³Ä¡ÇÒ ¼ö ÀÖ´Ù. ´ÙÀ½¿¡ ¾ÏÈ£¹®À» ÀÔ·ÂÇÏ¸é ±× Å°´Â ¿Ïº®ÇÏ°Ô ÀÛµ¿ÇÏ°Ô µÈ´Ù.
   </para>
   </sect2>
  </sect1>
  <sect1>
   <title>
   E-mail º¸¾È
  </title>
   <sect2>
    <title>
	S/MIME ÀÎÁõ¼­ÀÇ »ý¼º°ú »ç¿ë
   </title>
   <para>
	´Ü¼øÇÏ°Ô ÀÎÁõ ¿ä±¸¼­¸¦ »ý¼ºÇØ¼­ ¼­¸íÇÏ¸é µÈ´Ù. ±×·¯³ª ¹Ýµå½Ã Common Name (CN)À» »ç¿ëÀÚÀÇ e-mail ÁÖ¼Ò·Î Àû¾î¾ß ÇÑ´Ù.
   </para>
   <para>
	´ÙÀ½¿¡ test.txt¶ó´Â ¸Þ½ÃÁö¸¦ ÀÎÁõ¼­(newcert.pem)¿Í Private Key(newreq.pem)·Î ¼­¸íÇÑ´Ù. °á°ú´Â test.msg¿¡ ÀúÀåµÈ´Ù.
   </para>
   <programlisting>
openssl smime -sign -in test.tx -text -out test.msg -signer newcert.pem -inkey newreq.pem
   </programlisting>
   </sect2>
   <sect2>
    <title>
	MS Outlook¿¡¼­ ÀÌ·¯ÇÑ ÀÎÁõ¼­ »ç¿ëÇÏ±â
   </title>
   <para>
	¿ì¼± Outlook¿¡¼­ PKCS12 ÇüÅÂÀÇ ÆÄÀÏÀ» ¼öÀÔ(Import)ÇØ¾ß ÇÑ´Ù. PKCS12 ÆÄÀÏÀ» newcert.pem°ú newreq.pemÀ¸·ÎºÎÅÍ »ý¼ºÇÏ±â À§ÇØ¼­´Â ¾Æ·¡¿Í °°ÀÌ ¸í·ÉÇÏ¸é µÈ´Ù.
   </para>
   <programlisting>
CA.pl -pkcs12 "Franck Martin"
(openssl pkcs12 -export -in newcert.pem -inkey newreq.pem -out newcert.p12 -name "Franck Martin")
   </programlisting>
   <para>
	ÀÌ ÀÎÁõ¼­¿¡´Â Public Key»Ó¸¸ ¾Æ´Ï¶ó Private Keyµµ ÀúÀåµÇ¾î ÀÖ´Ù´Â Á¡À» »ó±âÇØ¾ß ÇÑ´Ù.(¾ÏÈ£¹®µµ ¶Õ¸°´Ù¸é ±×¾ß¸»·Î ³¡ÀåÀÌ´Ù) ÀÌ ÆÄÀÏÀÌ Å¸ÀÎÀÇ ¼Õ¿¡ ³Ñ¾î°¡Áö ¾Êµµ·Ï ÁÖÀÇÇÏÀÚ.
   </para>
   <para>
	MS Outlook¿¡¼­ µµ±¸(Tools), ¿É¼Ç(Options), º¸¾È(Security)ºÎºÐ¿¡ °¡¼­ ¼öÀÔ/¼öÃâ(import/export) ¹öÆ°À» ´©¸£°í newcert.p12 ÆÄÀÏÀ» ¼öÀÔÇÑ´Ù. ´ÙÀ½¿¡ ÆÐ½º¿öµå¿Í µðÁöÅÐ ID &quot;Franck Martin&quot;¸¦ ÀÔ·ÂÇÑ´Ù. (µðÁöÅÐ ID´Â À§ÀÇ ¿¹¿¡¼­ ÀÔ·ÂÇÑ °ÍÀ» ±×´ë·Î ÀÔ·ÂÇÏ¸é µÈ´Ù.) ±×¸®°í OK¸¦ ´©¸£¸é µÈ´Ù.
   </para>
   <para>
	´ÙÀ½¿¡ ¼³Á¤(Setting) ¹öÆ°À» ´©¸£°í MS OutlookÀ¸·Î ÇÏ¿©±Ý ±âº» ¼³Á¤À¸·Î »ç¿ëÇÒ ¼ö ÀÖ°Ô²û New¸¦ Å¬¸¯ÇÑ´Ù. ±×¸®°í ¸¶Áö¸·À¸·Î ÀÌ ¼³Á¤À» ±âº» ¼³Á¤À¸·Î À¯ÁöÇÏ°í ½ÍÀ¸¸é OK¸¦ ´©¸£¸é µÈ´Ù. ÀÌ·¸°Ô ÇÏ¸é ºñ·Î¼Ò e-mailÀ» º¸³¾ ÁØºñ°¡ ³¡³ª°Ô µÈ´Ù. ±×¸®°í¸é ´Ù¸¥ »ç¶÷¿¡°Ô ¸ÞÀÏÀ» º¸³»¸é Public Key¿Í ÇÔ²² Àü¼ÛµÇ¾î ±× »ç¶÷Àº ´ç½Å¿¡°Ô e-mailÀ» º¸³¾ ¶§ ¾ÏÈ£È­ÇÒ ¼ö ÀÖ´Ù.
   </para>
   <para>
	¸¸¾à Á÷Á¢ »ý¼ºÇÑ ·çÆ® ÀÎÁõ ±â°ü¿¡¼­ ¼­¸íÇÑ ÀÎÁõ¼­¶ó¸é ÀÀ¿ë ÇÁ·Î±×·¥¿¡¼­ ·çÆ® ÀÎÁõ ±â°üÀ» ½Å¿ëÇÒ ¼ö ¾ø´Ù°í °æ°í°¡ ³ª¿Ã ¼ö ÀÖ´Ù. ·çÆ® ÀÎÁõ ±â°ü ÀÎÁõ¼­¸¦ ´Ù¿î·Îµå¹Þ¾Æ¼­ ¼³Ä¡ÇÏ¸é ÀÌ·¯ÇÑ °æ°í°¡ ³ª¿ÀÁö ¾Ê´Â´Ù. ·çÆ® ÀÎÁõ ±â°ü ÀÎÁõ¼­´Â &quot;Root CA Certificate¸¦ Trusted Root Certificate·Î ¼³Ä¡ÇÏ±â&quot;ºÎºÐÀÇ &quot;ÀÎÅÍ³Ý ÀÍ½ºÇÃ·Î¾î&quot;ºÎºÐÀ» º¸¸é µÈ´Ù.
   </para>
   </sect2>
   <sect2>
    <title>
	Outlook Express¿¡¼­ ÀÌ·¯ÇÑ ÀÎÁõ¼­ »ç¿ëÇÏ±â
   </title>
   <para>
    FIXME
   </para>
   </sect2>
   <sect2>
    <title>
	Galeon¿¡¼­ ÀÌ·¯ÇÑ ÀÎÁõ¼­ »ç¿ëÇÏ±â
   </title>
   <para>
    FIXME
   </para>
   </sect2>
  </sect1>
 </chapter>


</book>

