准备目录
mkdir -p /etc/openssl/root/
mkdir -p /etc/openssl/server/
cd /etc/openssl
先建立一个 CA 的证书,首先为CA 创建一个 RSA 私用密钥,
openssl genrsa -des3 -out root/ca.key 1024
你可以用下列命令查看它的内容,
openssl rsa -noout -text -in root/ca.key
利用 CA 的 RSA 密钥创建一个自签署的 CA 证书(X.509结构)
openssl req -new -x509 -days 3650 -key root/ca.key -out root/ca.crt
你可以用下列命令查看它的内容,
openssl x509 -noout -text -in root/ca.crt
为你的 Apache 创建一个 RSA 私用密钥:
openssl genrsa -des3 -out server/server.key 1024
用 server.key 生成证书签署请求 CSR.
openssl req -new -key server/server.key -out server/server.csr
签署证书了,需要用到脚本
sign.sh sign.sh server/server.csr
#!/bin/sh
##
## sign.sh -- Sign a SSL Certificate Request (CSR)
## Copyright (c) 1998-1999 Ralf S. Engelschall, All Rights Reserved.
##
# argument line handling
CSR=$1
if [ $# -ne 1 ]; then
echo "Usage: sign. <whatever>.csr"; exit 1
fi
if [ ! -f $CSR ]; then
echo "CSR not found: $CSR"; exit 1
fi
case $CSR in
*.csr ) CERT="`echo $CSR | sed -e 's//.csr/.crt/'`" ;;
* ) CERT="$CSR.crt" ;;
esac
# make sure environment exists
if [ ! -d /etc/openssl/ca.db.certs ]; then
mkdir /etc/openssl/ca.db.certs
fi
if [ ! -f /etc/openssl/ca.db.serial ]; then
echo '01' >/etc/openssl/ca.db.serial
fi
if [ ! -f ca.db.index ]; then
cp /dev/null /etc/openssl/ca.db.index
fi
# create an own SSLeay config
cat >ca.config <<EOT
[ ca ]
default_ca = CA_own
[ CA_own ]
dir = /etc/openssl
certs = /etc/openssl/certs
new_certs_dir = /etc/openssl/ca.db.certs
database = /etc/openssl/ca.db.index
serial = /etc/openssl/ca.db.serial
RANDFILE = /etc/openssl/ca.db.rand
certificate = /etc/openssl/root/ca.crt
private_key = /etc/openssl/root/ca.key
default_days = 365
default_crl_days = 30
default_md = md5
preserve = no
policy = policy_anything
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
EOT
# sign the certificate
echo "CA signing: $CSR -> $CERT:"
openssl ca -config ca.config -out $CERT -infiles $CSR
echo "CA verifying: $CERT <-> CA cert"
openssl verify -CAfile /etc/openssl/root/ca.crt $CERT
# cleanup after SSLeay
rm -f ca.config
rm -f ca.db.serial.old
rm -f ca.db.index.old
# die gracefully
exit 0