CA:生成自签名证书
[root@CA ~]# cd /etc/pki/CA/
[root@CA CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048)
Generating RSA private key, 2048 bit long modulus
....................................+++
.....+++
e is 65537 (0x10001)
[root@CA CA]# ls
certs crl newcerts private
[root@CA CA]# ls -l private/cakey.pem
-rw-------. 1 root root 1679 Aug 8 16:19 private/cakey.pem
2、修改默认选项,可以不修改,经常使用的话就修改一下
[root@CA CA]# vim ../tls/openssl.cnf
[ req_distinguished_name ]
countryName = Country Name (2 letter code)
countryName_default = CN #修改的
countryName_min = 2
countryName_max = 2
stateOrProvinceName = State or Province Name (full name)
stateOrProvinceName_default = shanxi #修改的
localityName = Locality Name (eg, city)
localityName_default = xi'an #修改的
0.organizationName = Organization Name (eg, company)
0.organizationName_default = kcw9527 #修改的
# we can do this but it is not needed normally :-)
#1.organizationName = Second Organization Name (eg, company)
#1.organizationName_default = World Wide Web Pty Ltd
organizationalUnitName = Organizational Unit Name (eg, section)
#organizationalUnitName_default =
organizationalUnitName_default = Tech #修改的
先给自己生成一个自签证书
[root@CA CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 3656
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]: #这一块就是刚才在配置文件修改的默认值
State or Province Name (full name) [shanxi]: #
Locality Name (eg, city) [xian]: #
Organization Name (eg, company) [kcw9527]: #
Organizational Unit Name (eg, section) [Tech]: #
Common Name (eg, your name or your server's hostname) []:ca.test.com #这里很重要哦 这里是发给那个服务器的证书名字要和你的server名一样哦!不一致会有警告!这里测试发给自己的所以是ca.test.com
Email Address []:admin@admin.com #
要想成为一个私有的ca服务器还要修改几个默认选项
[ CA_default ]
dir = /etc/pki/CA # Where everything is kept
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crl # Where the issued crl are kept
database = $dir/index.txt # database index file.
#unique_subject = no # Set to 'no' to allow creation of
# several ctificates with same subject.
new_certs_dir = $dir/newcerts # default place for new certs.
certificate = $dir/cacert.pem # The CA certificate #避免修改所以一开始创建就这个名字
serial = $dir/serial # The current serial number
crlnumber = $dir/crlnumber # the current crl number
crl = $dir/crl.pem # The current CRL
private_key = $dir/private/cakey.pem# The private key #这就是刚才为毛放私钥到这个目录下的原因
RANDFILE = $dir/private/.rand # private random number file
创建目录和文件
[root@CA CA]# ls
cacert.pem certs crl newcerts private
[root@CA CA]# touch index.txt
[root@CA CA]# echo 01 > serial
这个时候CA已经创建好了
Httpd server端创建一对密钥 把公钥发个CA
[root@kcw ~]# cd /etc/httpd/
[root@kcw httpd]# mkdir ssl #创建一个专门的ssl目录
[root@kcw httpd]# cd ssl/
[root@kcw ssl]# (umask 077;openssl genrsa 2048 >httpd.key)
Generating RSA private key, 2048 bit long modulus
..............+++
.............................................................................+++
e is 65537 (0x10001)
再下来生成证书签署请求
[root@kcw ssl]# openssl req -new -key httpd.key -out httpd.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN #注意一定要和你CA服务器信息一致 因为是私有
State or Province Name (full name) []:shanxi #
Locality Name (eg, city) [Default City]:xi'an #
Organization Name (eg, company) [Default Company Ltd]:kcw9527 #
Organizational Unit Name (eg, section) []:Tech #
Common Name (eg, your name or your server's hostname) []:www.test.com #注意这个是你给那个虚拟主机颁发的在多个虚拟主机上只能有一个
Email Address []:admin@admin.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@kcw ssl]# ls
httpd.csr httpd.key
复制签署请求证书到CA服务器
[root@kcw ssl]# scp httpd.csr root@10.52.115.106:/tmp #记着在/etc/hosts做解析不然很慢
root@10.52.115.106's password:
httpd.csr 100% 1045 1.0KB/s 00:00
回到CA服务器签署
[root@CA ~]# openssl ca -in /tmp/httpd.csr -out /tmp/httpd.crt -days 3560
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Aug 8 21:15:47 2014 GMT
Not After : May 7 21:15:47 2024 GMT
Subject:
countryName = CN
stateOrProvinceName = shanxi
organizationName = kcw9527
organizationalUnitName = Tech
commonName = www.test.com
emailAddress = admin@admin.com
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
DE:4A:B8:24:99:4D:E4:4B:E6:F0:37:D8:D9:70:88:0F:1E:C9:CD:EA
X509v3 Authority Key Identifier:
keyid:EE:D9:8A:92:FF:FC:54:59:2E:33:3A:84:99:3B:B2:53:6F:44:33:4F
Certificate is to be certified until May 7 21:15:47 2024 GMT (3560 days)
Sign the certificate? [y/n]:y #
1 out of 1 certificate requests certified, commit? [y/n]y #
Write out database with 1 new entries
Data Base Updated
[root@CA ~]# cd /etc/pki/CA/
[root@CA CA]# ls
cacert.pem certs crl index.txt index.txt.attr index.txt.old newcerts private serial serial.old
[root@CA CA]# cat index.txt
V 240507211547Z 01 unknown /C=CN/ST=shanxi/O=kcw9527/OU=Tech/CN=www.test.com/emailAddress=admin@admin.com
[root@CA CA]# cat serial
02
OK证书做好了发给请求者即可
回到httpd server 把生成的复制回来
[root@kcw ssl]# scp 10.52.115.106:/tmp/httpd.crt ./
root@10.52.115.106's password:
httpd.crt 100% 4589 4.5KB/s 00:00
开始配置ssl.conf配置文件
[root@kcw ssl]# cd /etc/httpd/conf.d/
[root@kcw conf.d]# ls
README ssl.conf welcome.conf
[root@kcw conf.d]# cp ssl.conf ssl.conf.bak #修改之前先备份
修改ssl.conf如下
<VirtualHost 10.52.113.167:443>
ServerName www.test.com
DocumentRoot "/var/www/html"
SSLCertificateFile /etc/httpd/ssl/httpd.crt #证书
SSLCertificateKeyFile /etc/httpd/ssl/httpd.key #私钥文件
OK检查语法保存退出
[root@kcw conf]# httpd -t
Syntax OK
[root@kcw conf]# /etc/init.d/httpd restart
Stopping httpd: [FAILED]
Starting httpd: [ OK ]
[root@kcw conf]# netstat -antlp |grep httpd
tcp 0 0 :::80 :::* LISTEN 2782/httpd
tcp 0 0 :::443 :::* LISTEN 2782/httpd
测试
www.test.com
用https来试试
这样服务器发来得证书没问题。但是客户端没有信任ca所以复制CA服务器证书到客户端
客户端装载证书
改个名叫cacert.crt
然后安装证书
测试
可以看见哦了