OpenSSL:
三个组件:
openssl: 多用途的命令行工具;
libcrypto: 加密解密库;
libssl:ssl协议的实现;
PKI:Public Key Infrastructure
CA
RA
CRL
证书存取库
建立私有CA:
OpenCA
openssl
证书申请及签署步骤:
1、生成申请请求;
2、RA核验;
3、CA签署;
4、获取证书;
创建私有CA:
openssl的配置文件:/etc/pki/tls/openssl.cnf
(1) 创建所需要的文件
# touch index.txt
# echo 01 > serial
#
(2) CA自签证书
# (umask 077; openssl genrsa -out /etc/pki/CA/private/cakey.pem 2048)
# openssl req -new -x509 -key /etc/pki/CA/private/cakey.epm -days 7300 -out /etc/pki/CA/cacert.pem
-new: 生成新证书签署请求;
-x509: 专用于CA生成自签证书;
-key: 生成请求时用到的私钥文件;
-days n:证书的有效期限;
-out /PATH/TO/SOMECERTFILE: 证书的保存路径;
(3) 发证
(a) 用到证书的主机生成证书请求;
# (umask 077; openssl genrsa -out /etc/httpd/ssl/httpd.key 2048)
# openssl req -new -key /etc/httpd/ssl/httpd.key -days 365 -out /etc/httpd/ssl/httpd.csr
(b) 把请求文件传输给CA;
(c) CA签署证书,并将证书发还给请求者;
# openssl ca -in /tmp/httpd.csr -out /etc/pki/CA/certs/httpd.crt -days 365
查看证书中的信息:
openssl x509 -in /PATH/FROM/CERT_FILE -noout -text|-subject|-serial
(4) 吊销证书
(a) 客户端获取要吊销的证书的serial
# openssl x509 -in /PATH/FROM/CERT_FILE -noout -serial -subject
(b) CA
先根据客户提交的serial与subject信息,对比检验是否与index.txt文件中的信息一致;
吊销证书:
# openssl ca -revoke /etc/pki/CA/newcerts/SERIAL.pem
(c) 生成吊销证书的编号(第一次吊销一个证书)
# echo 01 > /etc/pki/CA/crlnumber
(d) 更新证书吊销列表
# openssl ca -gencrl -out thisca.crl
查看crl文件:
# openssl crl -in /PATH/FROM/CRL_FILE.crl -noout -text
具体实现和操作步骤:
一:安装CA服务器 自己装证书颁发机构
[root@server6 ~]# cd /etc/pki/CA
[root@server6 ~]# touch index.txt
[root@server6 ~]# echo 01 > serial
#生成私钥
[root@server6 CA]# (umask 077; openssl genrsa -out private/cakey.pem 2048)
[root@server6 CA]# ls -l private/
total 4
-rw------- 1 root root 1679 Aug 22 20:45 cakey.pem
# -x509表示自签证书
[root@server6 CA]# openssl req -new -x509 -key /etc/pki/CA/private/cakey.pem -days 7300 -out /etc/pki/CA/cacert.pem
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:SHANGHAI
Locality Name (eg, city) [Default City]:SHANGHAI
Organization Name (eg, company) [Default Company Ltd]:xxx
Organizational Unit Name (eg, section) []:ops
Common Name (eg, your name or your server's hostname) []:ca.xxx.com
Email Address []:admin@xxx.com
[root@server6 CA]# ls
cacert.pem certs crlindex.txt newcerts private serial
[root@server6 CA]# ls -l
total 24
-rw-r--r-- 1 root root 1415 Aug 22 20:56 cacert.pem
drwxr-xr-x. 2 root root 4096 Mar 23 05:46 certs
drwxr-xr-x. 2 root root 4096 Mar 23 05:46 crl
-rw-r--r-- 1 root root 0 Aug 22 20:38 index.txt
drwxr-xr-x. 2 root root 4096 Mar 23 05:46 newcerts
drwx------. 2 root root 4096 Aug 22 20:45 private
-rw-r--r-- 1 root root 3 Aug 22 20:39 serial
二:客户端请求证书
#生成私钥 .key 或者.pem都可以 表示私钥
[root@server9 ssl]# (umask 077;openssl genrsa -out http.key 2048)
#csr是请求的内容,作用是发送到CA颁发机构去请求证书
[root@server9 ssl]# openssl req -new -key http.key -days 3650 -out httpd.csr
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:SHANGHAI
Locality Name (eg, city) [Default City]:SHANGHAI
Organization Name (eg, company) [Default Company Ltd]:xxx
Organizational Unit Name (eg, section) []:ops
Common Name (eg, your name or your server's hostname) []:test.server9.com
Email Address []:webadmin@server9.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@server9 ssl]# ls
httpd.csr http.key
# 测试用 直接把.csr文件传到CA颁发机构(生产环境一般是CA做一个http网站,请求者到网站上去请求证书)
[root@server9 ssl]# scp httpd.csr root@192.168.8.6:/tmp/
三:回到CA颁发机构 给签证书
[root@server6 CA]# openssl ca -in /tmp/httpd.csr -out /tmp/httpd.crt -days 3650
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Aug 22 13:14:07 2017 GMT
Not After : Aug 20 13:14:07 2027 GMT
Subject:
countryName = CN
stateOrProvinceName = SHANGHAI
organizationName = Ubisoft
organizationalUnitName = ops
commonName = test.server9.com
emailAddress = webadmin@server9.com
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
A2:BA:65:E6:63:8C:72:CB:88:AA:7C:9E:02:2F:E2:43:8B:C5:47:7E
X509v3 Authority Key Identifier:
keyid:19:FF:6D:B7:51:08:24:4E:54:57:F6:BF:7B:E6:B4:B7:9F:FA:F9:35
Certificate is to be certified until Aug 20 13:14:07 2027 GMT (3650 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
[root@server6 CA]# cat index.txt
V270820131407Z01unknown/C=CN/ST=SHANGHAI/O=Ubisoft/OU=ops/CN=test.server9.com/emailAddress=webadmin@server9.com
#把.crt发回客户端
[root@server6 CA]# scp /tmp/httpd.crt root@192.168.8.9:/etc/httpd/ssl/
四:回到客户端查看证书
#这时候.csr文件已经没有用了,可删除
[root@server9 ssl]# ls
httpd.crt httpd.csr http.key
转载于:https://blog.51cto.com/wxtan/1958481