openssl 简单实例

 

1.        签发根CA

       openssl genrsa -des3 -out myrootca.key 1024

      openssl req -new -key myrootca.key -out myrootca.req

      openssl x509 -req -days 7305 -extfile rootca.conf -signkey myrootca.key -in myrootca.req -out myrootca.crt

2.        签发中级CA

  openssl genrsa -out subca.key 1024

    openssl req -new -key subca.key -out subca.req

        openssl x509 -req -days 3650 -sha1 -extfile subca.conf -CA myrootca.crt -CAkey myrootca.key -CAserial myrootca.srl -CAcreateserial -in subca.req -out subca.crt

 

1.         使用中级CA签发一个服务器证书

openssl x509 -req -days 3650 -sha1 -extfile server.conf -CA subca.crt -CAkey subca.key -CAserial subca.srl -CAcreateserial -in certreq.txt -out serverbysubca.crt

1.         使用根CA签发一个服务器证书
openssl x509 -req -days 3650 -sha1 -extfile server.conf -CA myrootca.crt -CAkey myrootca.key -CAserial myrootca.srl -CAcreateserial -in myhost.req -out myhost.crt

rootca.conf：

basicConstraints = CA:true

keyUsage = keyCertSign, cRLSign

subca.conf

basicConstraints = CA:true,pathlen:0

keyUsage = keyCertSign, cRLSign

nsCertType = sslCA, emailCA, objCA

server.conf

 

basicConstraints = CA:false

keyUsage=digitalSignature,keyEncipherment,dataEncipherment, keyAgreement

nsCertType = server

extendedKeyUsage = serverAuth, msSGC, nsSGC