OpenSSL创建生成CA证书、服务器、客户端证书及密钥及配置

标题OpenSSL创建生成CA证书、服务器、客户端证书及密钥及配置

[root@worker01 ca]# 
[root@worker01 b] openssl version #查看有没有安装openssl
OpenSSL 1.0.2k-fips  26 Jan 2017
[root@worker01 b] cd /usr/local/ca #找一个目录放ca证书
[root@worker01 ca] mkdir ca #可以根据自己需求找存放位置
[root@worker01 ca] cd ca
[root@worker01 ca] openssl genrsa -passout pass:123456 -des3 -out CA.key 2048 #创建ca私钥，去掉-passout pass:123456 需要控制台输入密码
Generating RSA private key, 2048 bit long modulus
..+++
...........................................................+++
e is 65537 (0x10001)
[root@worker01 ca]openssl req -x509 -new -nodes -key CA.key -sha256 -days 7300 -out CA.crt -subj "/C=CN/ST=Beijing/L=Beijing/O=Beijing CSSCA Technologies Co., Ltd./OU=R&D/CN=CSSCA Root Certificate Authority" #生成ca证书也可以使用下面一句代替，需要自己手动输入国家、机构等内容
Enter pass phrase for CA.key:


[root@worker01 ca] openssl req -x509 -new -nodes -key CA.key -sha256 -days 7300 -out CA.crt
Enter pass phrase for CA.key:#输入上面设置的ca密码
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN #国家 
State or Province Name (full name) []:Beijing #省份
Locality Name (eg, city) [Default City]:Beijing #城市
Organization Name (eg, company) [Default Company Ltd]:asd #组织
Organizational Unit Name (eg, section) []:技术部 #部门
Common Name (eg, your name or your server's hostname) []:abc.erqu.com  #域名
Email Address []:152222223@qq.com 邮箱
[root@worker01 ca] openssl x509 -in CA.crt -noout -text #查看证书信息

##下面创建ssh证书私钥，可以和上面放在同一个文件夹，也可以自己单独建立一个这里展示，放在同一个文件夹
[root@worker01 ca]  openssl genrsa -out server.key 2048
Generating RSA private key, 2048 bit long modulus
..............................................+++
....+++
e is 65537 (0x10001)
[root@worker01 ca] openssl req -new -key server.key -out server.csr -subj "/C=CN/ST=Beijing/L=Beijing/O=Beijing CSSCA Technologies Co., Ltd./OU=R&D/CN=CSSCA Root Certificate Authority"
[root@worker01 ca] vim cert.ext
[root@worker01 ca] cat cert.ext 
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names

[alt_names]
IP.1 = 192.168.11.100 #表示https要访问的ip，ssl证书可以自签多个IP，这是自签的IP的证书
IP.2 = 192.168.10.200 #同上
DNS.3 = xa.it.com #表示https咬访问的域名，DNS.5和DNS.6都一样是域名。ssl证书说明可以自签多个域名，这是自签域名的证书
DNS.4 = xiykj.com

#使用CA根证书签署ssl证书，自签ssl证书有效期20年
[root@worker01 ca] openssl x509 -req -in server.csr -out server.crt -days 7000 -CAcreateserial -CA CA.crt -CAkey CA.key -CAserial serial -extfile cert.ext
Signature ok
subject=/C=CN/ST=Beijing/L=Beijing/O=Beijing CSSCA Technologies Co., Ltd./OU=R&D/CN=CSSCA Root Certificate Authority
Getting CA Private Key
Enter pass phrase for CA.key:
[root@worker01 ca] openssl x509 -in server.crt -noout -text#查看证书相关信息
[root@worker01 ca] openssl verify -CAfile ../ca/CA.crt server.crt #10、使用CA验证ssl证书状态，显示ok表示通过验证
server.crt: OK

将证书文件和证书私钥server.crt、server.key下载下来，使用sz命令。
进入到前端页面服务器。找到nginx.conf配置文件（如有修改找自己域名的conf文件）进行配置。

    listen 443 ssl;
    server_name yourdomain.com;
    ssl_certificate /path/to/server.crt; #自己上传server.crt的位置
    ssl_certificate_key /path/to/server.key;#自己上传server.key的位置
 
    ssl_session_cache shared:SSL:1m;
    ssl_session_timeout  10m;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
 
    location / {
        root /var/www/html;
        index index.html index.htm;
    }
}

然后nginx -t 检查配置文件， nginx -s reload 重新读取配置文件。
如果让访问这个域名默认跳https，在listen 80 的server里加上

rewrite ^(.*)$ https://自己的域名;

最后访问域名就是成功的加了证书，但是会显示不安全。但是没有关系。