openssl 설치여부 확인
[ec2-user@ip-10-1-10-219 ~]$ openssl version
OpenSSL 1.0.2k-fips  26 Jan 2017

개인키 생성
[ec2-user@ip-10-1-10-219 ~]$ openssl genrsa -des3 -out minman.key 2048
Generating RSA private key, 2048 bit long modulus
....+++
..............................................................................................+++
e is 65537 (0x10001)
Enter pass phrase for minman.key: xxxxxxxxxxxxx
Verifying - Enter pass phrase for minman.key: xxxxxxxxxxxxx

서버 개인키인 minman.key 파일이 생성된다.

인증요청서 생성
[ec2-user@ip-10-1-10-219 ~]$ openssl req -new -key minman.key -out minman.csr
Enter pass phrase for minman.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:KR
State or Province Name (full name) []:Seoul
Locality Name (eg, city) [Default City]:Gangnam
Organization Name (eg, company) [Default Company Ltd]:company
Organizational Unit Name (eg, section) []:company
Common Name (eg, your name or your server's hostname) []:minman
Email Address []:qwndoqwndk@naver.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []: xxxxxxxxx
An optional company name []:company
             
서버 인증요청서인 minman.csr 파일이 생성되었다.         
[ec2-user@ip-10-1-10-219 ~]$ ls
minman.csr  minman.key
             
키에 패스워드가 들어있으면 아파치 구동시마다 물어본다. 패스워드를 제거하더라도 SSL 암호화 통신에는 문제가 없으므로 제거해야한다.
호스팅업체에서 제공하는 로드밸런서에 사설인증서를 올릴 때에도 패스워드를 제거해야 한다.
[ec2-user@ip-10-1-10-219 ~]$ cp minman.key minman.key.origin
             
패스워드가 제거된 파일(minman.key)과 원래 파일(minman.key.origin)을 확인할 수 있다.
[ec2-user@ip-10-1-10-219 ~]$ openssl rsa -in minman.key.origin -out minman.key
Enter pass phrase for minman.key.origin:
writing RSA key

패스워드가 제거된 개인키 파일 minman.key 이 생성된다.
[ec2-user@ip-10-1-10-219 ~]$ ll
total 12
-rw-rw-r-- 1 ec2-user ec2-user 1119 Jul 30 01:16 minman.csr
-rw-rw-r-- 1 ec2-user ec2-user 1675 Jul 30 01:18 minman.key
-rw-rw-r-- 1 ec2-user ec2-user 1743 Jul 30 01:17 minman.key.origin

개인키와 인증요청서를 가지고 인증서를 생성해보자.
[ec2-user@ip-10-1-10-219 ~]$ openssl x509 -req -days 3650 -in minman.csr -signkey minman.key -out minman.crt
Signature ok
subject=/C=KR/ST=Seoul/L=Gangnam/O=company/OU=company/CN=minman/emailAddress=qwndoqwndk@naver.com
Getting Private key
서버 인증서인 minman.crt 파일이 생성되었다.
유효기간을 3650일(10년)로 했는데, 필요에 따라 바꾸면 된다.
             
개인키 생성확인
[ec2-user@ip-10-1-10-219 ~]$ cat minman.key | head -2
-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEA4MfB7dxxxxxxxxxNUdEv3bM14ZUPHIIa5US
    
사설인증서 생성확인
[ec2-user@ip-10-1-10-219 ~]$ cat minman.crt | head -2
-----BEGIN CERTIFICATE-----
MIIDkDCCAngCCQCo8/5uj7eWexxxxxxxxxxxxxAQsFADCBiTELMAkGA1UEBhMC
             
[ec2-user@ip-10-1-10-219 ~]$ sudo cp minman.key /root/minman.key
[ec2-user@ip-10-1-10-219 ~]$ sudo cp minman.crt /root/minman.crt

[ec2-user@ip-10-1-10-219 ~]$ sudo amazon-linux-extras install nginx1.12 -y
[ec2-user@ip-10-1-10-219 ~]$ sudo vim /etc/nginx/nginx.conf
# For more information on configuration, see:
#   * Official English Documentation: http://nginx.org/en/docs/
#   * Official Russian Documentation: http://nginx.org/ru/docs/

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

# Load dynamic modules. See /usr/share/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;

events {
    worker_connections 1024;
}

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 2048;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;

    # Load modular configuration files from the /etc/nginx/conf.d directory.
    # See http://nginx.org/en/docs/ngx_core_module.html#include
    # for more information.
    include /etc/nginx/conf.d/*.conf;

    server {
           listen       443 default_server;
           listen       [::]:433 default_server;
           server_name  localhost;
           root         /usr/share/nginx/html;
           rewrite ^/$ https://$host/_plugin/kibana redirect;

           # 실제 ec2의 인증서 위치
           ssl_certificate           /root/minman.crt;
           ssl_certificate_key       /root/minman.key;

           ssl on;
           ssl_session_cache  builtin:1000  shared:SSL:10m;
           ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
           ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
           ssl_prefer_server_ciphers on;

           # Load configuration files for the default server block.
           include /etc/nginx/default.d/*.conf;

           location / {
               proxy_set_header X-Real-IP $remote_addr;
               proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
               proxy_set_header Host $http_host;
               proxy_redirect off;
               proxy_redirect http://vpc-pms-elasticsearch-test-xxxxxxxxxxxxxxxxxx.ap-northeast-2.es.amazonaws.com:9200/_plugin/kibana/ http://$host;
               proxy_pass https://vpc-pms-elasticsearch-test-xxxxxxxxxxxxxxxxxx.ap-northeast-2.es.amazonaws.com:443;
           }
    }
}
[ec2-user@ip-10-1-10-219 ~]$ sudo service nginx start
Redirecting to /bin/systemctl start nginx.service