openssl命令:配置文件:/etc/pki/tls/openssl.cnf
构建私有CA:
在确定配置为CA的服务上生成一个自签证书,并为CA提供所需要的目录及文件即可
步骤:
(1) 生成私钥;
[root@localhost ~]# (umask 077; openssl genrsa -out /etc/pki/CA/private/cakey.pem 4096)
(2) 生成自签证书;
[root@localhost ~]# openssl req -new -x509 -key /etc/pki/CA/private/cakey.pem -out /etc/pki/CA/cacert.pem -days 3655
/*-new:生成新证书签署请求;
-x509:生成自签格式证书,专用于创建私有CA时;
-key:生成请求时用到的私有文件路径;
-out:生成的请求文件路径;如果自签操作将直接生成签署过的证书;
-days:证书的有效时长,单位是day;*/
You are about to be asked to enter information that will be incorporatedinto your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:Beijing
Locality Name (eg, city) [Default City]:Beijing
Organization Name (eg, company) [Default Company Ltd]:ME
Organizational Unit Name (eg, section) []:Ops
Common Name (eg, your name or your server's hostname) []:ca.me.com
Email Address []:caadmin@me.com
(3) 为CA提供所需的目录及文件;
[root@localhost /]# mkdir -pv /etc/pki/CA/{certs,crl,newcerts}
[root@localhost /]# touch /etc/pki/CA/{serial,index.txt}
[root@localhost /]# echo 01 > /etc/pki/CA/serial
要用到证书进行安全通信的服务器,需要向CA请求签署证书:
步骤:(以httpd为例)
(1) 用到证书的主机生成私钥;
[root@localhost httpd]# mkdir /etc/httpd/ssl
[root@localhost httpd]# cd /etc/httpd/ssl
[root@localhost ssl]# (umask 077; openssl genrsa -out /etc/httpd/ssl/httpd.key 2048)
Generating RSA private key, 2048 bit long modulus
........+++
..+++
e is 65537 (0x10001)
(2) 生成证书签署请求
[root@localhost ssl]# openssl req -new -key /etc/httpd/ssl/httpd.key -out /etc/httpd/ssl/httpd.csr -days 365
You are about to be asked to enter information that will be incorporatedinto your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:Beijing
Locality Name (eg, city) [Default City]:Beijing
Organization Name (eg, company) [Default Company Ltd]:ME
Organizational Unit Name (eg, section) []:Ops
Common Name (eg, your name or your server's hostname) []:www.me.com
Email Address []:webmaster@me.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
(3) 将请求通过可靠方式发送给CA主机;
测试使用scp命令将请求发送至CA主机
[root@localhost ssl]# scp http.csr root@192.168.0.104:/tmp/
The authenticity of host '192.168.0.104 (192.168.0.104)' can't be established.
ECDSA key fingerprint is f6:80:c9:d6:5a:68:10:a0:95:49:a5:1c:48:f8:65:68.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.0.104' (ECDSA) to the list of known hosts.
root@192.168.0.104's password:
http.csr 100% 1041 1.0KB/s 00:00
(4) 在CA主机上签署证书;
[root@localhost /]# openssl ca -in /tmp/http.csr -out /etc/pki/CA/certs/httpd.crt -days 365
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Jun 3 14:05:39 2017 GMT
Not After : Jun 3 14:05:39 2018 GMT
Subject:
countryName = CN
stateOrProvinceName = Beijing
organizationName = ME
organizationalUnitName = Ops
commonName = www.me.com
emailAddress = webmaster@me.com
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
5A:FA:98:3F:D1:96:7B:F0:FF:83:BC:F5:2A:41:85:3E:DF:20:81:3E
X509v3 Authority Key Identifier:
keyid:74:46:21:24:27:6E:85:46:7E:37:6F:44:E9:97:76:3C:65:EB:6C:F8
Certificate is to be certified until Jun 3 14:05:39 2018 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
查看证书序列号:
[root@localhost CA]# cat /etc/pki/CA/index.txt
V 180603140539Z 01 unknown /C=CN/ST=Beijing/O=ME/OU=Ops/CN=www.me.com
/emailAddress=webmaster@me.com
将证书发给请求者:
[root@localhost CA]# scp /etc/pki/CA/certs/httpd.crt root@192.168.0.150:/etc/httpd/ssl/
The authenticity of host '192.168.0.150 (192.168.0.150)' can't be established.
ECDSA key fingerprint is 3b:89:4b:0b:f3:88:e8:9f:ab:8b:d0:d8:7a:83:6c:f2.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.0.150' (ECDSA) to the list of known hosts.
root@192.168.0.150's password:
httpd.crt
100% 5819 5.7KB/s 00:00
查看证书中的信息:
[root@localhost CA]# openssl x509 -in /etc/pki/CA/certs/httpd.crt -noout -serial -subjectserial=01
subject= /C=CN/ST=Beijing/O=ME/OU=Ops/CN=www.me.com/emailAddress=webmaster@me.com
或者:在客户机查看
[root@localhost ssl]# openssl x509 -in /etc/httpd/ssl/httpd.crt -noout -serial -subjectserial=01
subject= /C=CN/ST=Beijing/O=ME/OU=Ops/CN=www.me.com/emailAddress=webmaster@me.com
吊销证书:
步骤:
(1) 客户端获取要吊销的证书的serial(在使用证书的主机执行):
~]# openssl x509 -in /etc/pki/CA/certs/httpd.crt -noout -serial -subject
(2) CA主机吊销证书
先根据客户提交的serial和subject信息,对比其与本机数据库index.txt中存储的是否一致;
吊销:
# openssl ca -revoke /etc/pki/CA/newcerts/SERIAL.pem
其中的SERIAL要换成证书真正的序列号;
(3) 生成吊销证书的吊销编号(第一次吊销证书时执行)
# echo 01 > /etc/pki/CA/crlnumber
(4) 更新证书吊销列表
# openssl ca -gencrl -out thisca.crl
查看crl文件:
# openssl crl -in /PATH/FROM/CRL_FILE.crl -noout -text
转载于:https://blog.51cto.com/rylan/1932001