本专栏提供售后服务,帮助解决问题,文章底部扫描进群即可
题目
CA
CA根证书路径/CA/cacert.pem;
签发数字证书,颁发者信息:
国家 = CN
单位 = Inc
组织机构 = www.skills.com
公用名 = Skill Global Root CA
一、安装openssl
yum install openssl -y
二、建立根证书存放目录
[root@Rserver ~]# mkdir /CA
[root@Rserver ~]# cd /CA
[root@Rserver CA]# mkdir certs #存放已颁发的证书
[root@Rserver CA]# mkdir newcerts #存放CA指令生成的新证书
[root@Rserver CA]# mkdir private #存放私钥
[root@Rserver CA]# touch index.txt #已签发证书的文本数据文件
[root@Rserver CA]# vim serial #证书签发时使用的序列号参考文件
01
[root@Rserver CA]# openssl genrsa -out private/cakey.pem 4096 #生成一个密钥,长度4096
Generating RSA private key, 4096 bit long modulus
............................................++
..........................................++e is 65537 (0x10001)
[root@Rserver CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem 签发数字证书,颁发者信息
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:
Locality Name (eg, city) [Default City]:
Organization Name (eg, company) [Default Company Ltd]:Inc
Organizational Unit Name (eg, section) []:www.skills.com
Common Name (eg, your name or your server's hostname) []:Skill Gloabl Root CA
Email Address []:
三、测试
生成一个秘钥
[root@Rserver CA]# openssl genrsa -out private/apache2.key
Generating RSA private key, 2048 bit long modulus
......+++.............................+++
e is 65537 (0x10001)
生成一个证书
[root@Rserver CA]# openssl req -new -key private/apache2.key -out certs/apache2.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:
Locality Name (eg, city) [Default City]:
Organization Name (eg, company) [Default Company Ltd]:Inc
Organizational Unit Name (eg, section) []:www.skills.com
Common Name (eg, your name or your server's hostname) []:www.skills.com
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
使用私钥进行签名
[root@Rserver CA]# openssl x509 -req -in /CA/certs/apache2.csr -CA cacert.pem -CAkey private/cakey.pem -CAcreateserial -out apache2.crt -days 365
Signature ok
subject=/C=CN/L=Default City/O=Inc/OU=www.skills.com/CN=www.skills.com
Getting CA Private Key