openssl证书生产过程

使用OpenSSL生成证书  

 
下载安装openssl(把ssl目录下的openssl.cnf 拷贝到当前目录下）


1.首先要生成服务器端的私钥(key文件):
[root@localhost opensslKey]# cp /usr/local/ssl/bin/openssl.cnf ./
[root@localhost opensslKey]# ls
openssl.cnf
[root@localhost opensslKey]# openssl genrsa -des3 -out server.key 1024
Generating RSA private key, 1024 bit long modulus
.++++++
.......++++++
e is 65537 (0x10001)
Enter pass phrase for server.key:
Verifying - Enter pass phrase for server.key:
[root@localhost opensslKey]# ls
openssl.cnf  server.key
[root@localhost opensslKey]# 


运行时会提示输入密码,此密码用于加密key文件(参数des3便是指加密算法,当然也可以选用其他你认为安全的算法.),
以后每当需读取此文件(通过openssl提供的命令或API)都需输入口令.如果觉得不方便,也可以去除这个口令,但一定要采取其他的保护措施!


去除key文件口令的命令:
[root@localhost opensslKey]# openssl rsa -in server.key -out server.key
Enter pass phrase for server.key:
writing RSA key
[root@localhost opensslKey]# ls
openssl.cnf  server.key


2.生成Certificate Signing Request（CSR）,生成的csr文件交给CA签名后形成服务端自己的证书.屏幕上将有提示,依照其指示一步一步输入要求的个人信息即可.
[root@localhost opensslKey]# openssl req -new -key server.key -out server.csr -config openssl.cnf
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:zh
State or Province Name (full name) [Some-State]:gd
Locality Name (eg, city) []:sz
Organization Name (eg, company) [Internet Widgits Pty Ltd]:xzwd
Organizational Unit Name (eg, section) []:serverteam
Common Name (e.g. server FQDN or YOUR name) []:flylove
Email Address []:123456@qq.com


Please enter the following 'extra' attributes
to