Centos CA根证书

本专栏提供售后服务，帮助解决问题，文章底部扫描进群即可

题目

CA
CA根证书路径/CA/cacert.pem；
签发数字证书，颁发者信息：
国家 = CN
单位 = Inc
组织机构 = www.skills.com
公用名 = Skill Global Root CA

一、安装openssl

yum install openssl -y

二、建立根证书存放目录

[root@Rserver ~]# mkdir /CA

[root@Rserver ~]# cd /CA

[root@Rserver CA]# mkdir certs #存放已颁发的证书

[root@Rserver CA]# mkdir newcerts #存放CA指令生成的新证书

[root@Rserver CA]# mkdir private #存放私钥

[root@Rserver CA]# touch index.txt #已签发证书的文本数据文件

[root@Rserver CA]# vim serial #证书签发时使用的序列号参考文件

01

[root@Rserver CA]# openssl genrsa -out private/cakey.pem 4096 #生成一个密钥，长度4096

Generating RSA private key, 4096 bit long modulus

............................................++

..........................................++e is 65537 (0x10001)

[root@Rserver CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem 签发数字证书，颁发者信息

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [XX]:CN

State or Province Name (full name) []:

Locality Name (eg, city) [Default City]:

Organization Name (eg, company) [Default Company Ltd]:Inc

Organizational Unit Name (eg, section) []:www.skills.com

Common Name (eg, your name or your server's hostname) []:Skill Gloabl Root CA

Email Address []:

三、测试

生成一个秘钥

[root@Rserver CA]# openssl genrsa -out private/apache2.key

Generating RSA private key, 2048 bit long modulus

......+++.............................+++

e is 65537 (0x10001)

生成一个证书

[root@Rserver CA]# openssl req -new -key private/apache2.key -out certs/apache2.csr

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [XX]:CN

State or Province Name (full name) []:

Locality Name (eg, city) [Default City]:

Organization Name (eg, company) [Default Company Ltd]:Inc

Organizational Unit Name (eg, section) []:www.skills.com

Common Name (eg, your name or your server's hostname) []:www.skills.com

Email Address []:

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

使用私钥进行签名

[root@Rserver CA]# openssl x509 -req -in /CA/certs/apache2.csr -CA cacert.pem -CAkey private/cakey.pem -CAcreateserial -out apache2.crt -days 365

Signature ok

subject=/C=CN/L=Default City/O=Inc/OU=www.skills.com/CN=www.skills.com

Getting CA Private Key