openssl：Generate self signed CA and issue cert

GenerateCA and sign out certificate：

Precondition

1. Centos install（memory2048, GUI mode）

https://blog.csdn.net/hui_2016/article/details/68927487

2. Make sure openssl.cnf under /etc/pki/tls, we use default configuration

3. Following steps, you can refer to below:

https://blog.csdn.net/chenyefei/article/details/48522767

 

 

Steps：

 

1. Create private key

  opensslgenrsa -des3 -out ca.key 4096

  Note: the password is important (ca.key password:1234)

2. Generate root certificate whichis signed by itself

   openssl req -new -x509 -days 365 -key ca.key -out ca.crt 

openssl will ask you the pswd of private key, and then a serials of questions，

#  Common Name(CN) is important

 2.1 Formatconvert: crt to pem：

   openssl x509 -in ca.crt -out ca.pem

3. Generate server side private key

  openssl genrsa -des3 -out server.key 4096   （4090 is key size, also can select 1024,2048……）

Server.keypassword 4321

Challengepassword:1111

4. Generate signature request forthe object which need to be signed (server side):  

  openssl req -new -key server.key -out server.csr 

Note: CommonName must diff than root CA

5. Sign the step4’s signaturerequest by using root CA generated in step 2, and use private key instep1

openssl x509-req -days 365 -in server.csr-CA ca.pem -CAkey ca.key -set_serial 01-out dispenser.pem

 

Sign a one day expired certificate：

openssl x509-req -days 1 -in server.csr -CA ca.pem -CAkey ca.key -set_serial 04 -outdispenser3.pem

Revoke& CRL

Precondition

 

make sure  /etc/pki/CA has following file:

[root@lancy catesting]#touch crlnumber      new crlnumber file

[root@lancy catesting]#echo “00”>crlnumber     initial data 00

[root@lancy catesting]#touch index.txt     create DB file，initial，nodata

[root@lancy catesting]#touch serial       new serial file

[root@lancy catesting]#echo “00”>serial      initial data 00

 

Revoke certificate

openssl ca-revoke dispenser1.pem -cert ca.pem -keyfile ca.key

Generate CRL

openssl ca -gencrl -out client.crl -cert ca.pem -keyfile ca.key -config /etc/pki/tls/openssl.cnf

Note：-config /etc/pki/tls/openssl.cnf canignore, use default config

Mock up a CRL to root CA

cat ca.pemclient.crl > crl_chain_Test.pem 

others

print certificate serial number：

opensslx509 -in dispenser12.pem -noout –serial

 

check certificate dates：

opensslx509 -in dispenser3.pem -noout –dates

 

Verify certificate：

opensslverify -CAfile ca.pem dispenser4.pem

 

 Verifycertificate revoke：

openssl verify-crl_check -CAfile crl_chain_Test.pem dispenser4.pem

 

用SHA256算法计算文件ca.pem的哈西值,输出到文件digest.txt

openssl sha256-out digest.txt ca.pem

 

//解析证书完整信息

$openssl x509 -in user.cer -inform PEM -text-noout

 

//查看证书指定信息

$openssl x509 -in user.cer -inform PEM  -noout-pubkey-modulus-serial-subject-issuer-email-startdate-enddate-dates-fingerprint  -subject_hash-issuer_hash-subject_hash_old-issuer_hash_old

 

//查看证书用途

openssl x509 -purpose-noout-in user.cer

 

·        -x509—— 此选项输出自签名证书。这通常用于生成测试证书或自签名根证书。添加到证书的扩展项（如果有）在配置文件中指定。除非使用set_serial选项，否则将使用较大的随机数作为序列号。

·        -days n—— 当使用-x509选项时，指定证书的有效期。默认为30天。

·        -set_serial n—— 输出自签名证书时使用的序列号。如果前缀为0x，则可以将其指定为十进制值或十六进制值。

 

注意 

·        PEM格式使用头部和尾部： 
—–BEGIN CERTIFICATE—– 
—–END CERTIFICATE—– 
它还将处理包含的文件： 
—–BEGIN X509 CERTIFICATE—– 
—–END X509 CERTIFICATE—– 
可信任的证书有以下行： 
—–BEGIN TRUSTED CERTIFICATE—– 
—–END TRUSTED CERTIFICATE—–