构建私有CA和证书

最新推荐文章于 2024-09-03 23:56:30 发布

陪小七许个愿

最新推荐文章于 2024-09-03 23:56:30 发布

阅读量349

点赞数 10

分类专栏： Server 文章标签： https CA

本文链接：https://blog.csdn.net/qq_59671942/article/details/141871469

版权

Server 专栏收录该内容

2 篇文章 0 订阅

订阅专栏

一、准备

两台虚拟机

192.168.252.148 CA

192.168.252.149 客户端

二、构建私有CA

192.168.252.148 CA

安装openssl

1.检查是否存在
rpm -qa openssl
2.安装或者更新openssl
yum install openssl openssl-devel -y

查看CA相关配置

/etc/pki/tls/openssl.cnf这个文件是CA的配置文件。

此文件对于是证书签署者的身份会使用到此文件

此文件对于证书的申请者的身份是无用的。

根证书服务器目录：

根CA服务器：/etc/pki/CA 192.168.252.148

网站服务器：/etc/pki/tls 192.168.252.149

查看文件
cat  /etc/pki/tls/openssl.cnf

创建所需文件

cd /etc/pki/CA/
ls
certs  crl  newcerts  private

1.创建生成证书索引数据库文件
touch index.txt
2.指定第一个颁发证书的序列号
echo 01 > serial

ls
certs  crl  index.txt  newcerts  private  serial

创建秘钥

1.使用openssl创建秘钥
cd /etc/pki/CA/
(umask 066; openssl genrsa -out private/cakey.pem 2048)

Generating RSA private key, 2048 bit long modulus
.....................+++
...............................+++
e is 65537 (0x10001)

2.在private中查看
ls private/
cakey.pem

生成自签名的证书

根CA自签名证书，根CA是最顶级的认证机构，没有人能够认证他，所以只能自己认证自己生成自签名证书。

1.生成自签名证书通过秘钥
openssl req -new -x509 -key /etc/pki/CA/private/cakey.pem -days 7300 -out /etc/pki/CA/cacert.pem -days 7300

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN                         //签发国家  
State or Province Name (full name) []:BEIJING                //签发省份
Locality Name (eg, city) [Default City]:BEIJING              //签发城市
Organization Name (eg, company) [Default Company Ltd]:CA     //签发公司
Organizational Unit Name (eg, section) []:OPT                //签发部门
Common Name (eg, your name or your server's hostname) []:www.syh.com   //签发域名
Email Address []:3146359748@qq.com                           //签发邮件                         

2.查看文件
ls
cacert.pem  certs  crl  index.txt  newcerts  private  serial

参数解释：

-new 			生成新证书签署请求
-x509 		专用于CA生成自签证书
-key 			生成请求时用到的私钥文件
-days 		证书的有效期限
-out 		 	证书的保存路径

下载安装证书

yum install -y lrzsz
sz /etc/pki/CA/cacert.pem

以谷歌浏览器为例：

点击设置

点击安全和隐私

向下滑

找到证书管理会出现一个弹窗

导入刚才上传电脑的证书

根据向导导入证书

导入刚才上传的证书

完成

三、服务器端进行CA证书申请和签名

192.168.252.149 客户端

安装openssl

1.检查是否存在
rpm -qa openssl
2.安装或者更新openssl
yum install openssl openssl-devel -y

生成私钥文件

1.生成私钥
(umask 066; openssl genrsa -out /etc/pki/tls/private/www.syh.com.key 2048)

Generating RSA private key, 2048 bit long modulus
...........................................................................................+++
.....+++
e is 65537 (0x10001)

2.查看私钥
ls /etc/pki/tls/private/
localhost.key  www.syh.com.key

私钥加密生成证书

1.私钥加密生成证书
openssl req -new -key /etc/pki/tls/private/www.syh.com.key -days 365 -out /etc/pki/tls/www.syh.com.csr

ww.syh.com.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:BEIJING
Locality Name (eg, city) [Default City]:BEIJING
Organization Name (eg, company) [Default Company Ltd]:CA
Organizational Unit Name (eg, section) []:OPT
Common Name (eg, your name or your server's hostname) []:www.syh.com
Email Address []:3146359748@qq.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

//此处的信息要一定与在生成自签名的证书的信息一致

2.查看证书的生成
ls  /etc/pki/tls/
cert.pem  certs  misc  openssl.cnf  private  www.syh.com.csr

四、证书签署

客户端的证书传输到CA端上

传输这个证书/etc/pki/tls/www.qf.com.csr到CA端

192.168.252.149:
cd  /etc/pki/tls/
scp  www.syh.com.csr  192.168.252.148:/etc/pki/CA/private

192.168.252.148:
cd /etc/pki/CA/private
ls
cakey.pem  www.syh.com.csr

证书签署

1.修改配置文件/etc/pki/tls/openssl.cnf，修改organizationName=supplied

192.168.252.148：
1.编辑配置文件
vim /etc/pki/tls/openssl.cnf
/organizationName搜索这个
找到这个模块修改：
# For the CA policy
[ policy_match ]
countryName             = match
stateOrProvinceName     = match
organizationName        = supplied
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

2.CA签署

192.168.252.148：
1.签署证书
openssl ca -in /etc/pki/CA/private/www.syh.com.csr -out /etc/pki/CA/certs/www.syh.com.crt -days 365
Using configuration from /etc/pki/tls/openssl.cnf


Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Sep  3 12:09:17 2024 GMT
            Not After : Sep  3 12:09:17 2025 GMT
        Subject:
            countryName               = CN
            stateOrProvinceName       = BEIJING
            organizationName          = CA
            organizationalUnitName    = OPT
            commonName                = www.syh.com
            emailAddress              = 3146359748@qq.com
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
                FA:A5:D7:6B:7D:8A:C2:BA:06:BA:7B:DF:71:35:40:5E:A1:AF:3A:F1
            X509v3 Authority Key Identifier: 
                keyid:AF:0C:F8:02:B7:C0:51:E3:B7:AB:3A:A0:15:EE:0A:39:8A:03:AB:6A

Certificate is to be certified until Sep  3 12:09:17 2025 GMT (365 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

2.查看证书
ls /etc/pki/CA/certs/
www.syh.com.crt

发送签署后的证书

192.168.252.148：
1.发送证书
cd /etc/pki/CA/certs/
scp www.syh.com.crt 192.168.252.149:/etc/pki/CA/certs/

192.168.252.149：
1.查看证书
ls /etc/pki/CA/certs/
www.syh.com.crt

五、测试

证书文件和密钥文件

证书文件路径：
/etc/pki/CA/certs/www.syh.com.crt
密钥文件路径：
/etc/pki/tls/private/www.syh.com.key

配置Nginx配置文件

1.编辑配置文件：
vim /etc/nginx/conf.d/nginx_ca.conf

server {
        listen       443 ssl;
        server_name  www.syh.com;

        ssl_certificate      /etc/pki/CA/certs/www.syh.com.crt;                 #指定证书路径
        ssl_certificate_key  /etc/pki/tls/private/www.syh.com.key;              #指定私钥路径
        ssl_session_timeout  5m;                                                #配置用于SSL会话的缓存
        ssl_protocols SSLv2 SSLv3 TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;  							#如果出现无法访问的连接就将此注释注释掉
        ssl_ciphers  ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP; #密码指定为OpenSSL支持的格式
        ssl_prefer_server_ciphers   on;                                         #设置协商加密算法时，优先使用服务端的
加密，而不是客户端浏览器的。

        location / {
                root /jump/html;
                index index.html index.htm;
        }
}

2.创建发布目录
mkdir -p  /jump/html
发布一个跳一跳

3.重启
nginx -t
systemctl restart nginx

配置windows解析

访问

https://www.syh.com

因为私有证书不受此浏览器信任所以会出现不安全的https连接

陪小七许个愿

关注

10
点赞
踩
4

收藏

觉得还不错? 一键收藏
0
评论
构建私有CA和证书

1.修改配置文件/etc/pki/tls/openssl.cnf，修改organizationName=supplied。根CA自签名证书，根CA是最顶级的认证机构，没有人能够认证他，所以只能自己认证自己生成自签名证书。/etc/pki/tls/openssl.cnf这个文件是CA的配置文件。传输这个证书/etc/pki/tls/www.qf.com.csr到CA端。根CA服务器：/etc/pki/CA 192.168.252.148。网站服务器：/etc/pki/tls 192.168.252.149。
复制链接

扫一扫

专栏目录