openssl 生成证书链

最新推荐文章于 2024-05-08 19:56:45 发布

raptor-minds

最新推荐文章于 2024-05-08 19:56:45 发布

阅读量1.7k

点赞数 1

分类专栏： linux基本常用命令文章标签： linux ubuntu 运维

本文链接：https://blog.csdn.net/weixin_38468566/article/details/106430612

版权

在Ubuntu 18.04上，通过OpenSSL 1.1.1版本详细步骤生成root CA证书，并进一步阐述如何利用自签root CA创建中间证书，以构建证书信任链，确保安全。

摘要由CSDN通过智能技术生成

基于ubuntu 18.04 版本
##生成 root CA 证书

检查openSSL Version

openssl version

OpenSSL 1.1.1 11 Sep 2018

create directory

mkdir -p /opt/ca/root
mkdir /opt/ca/root/key

vim /opt/ca/root/openssl.cnf

[ ca ]
default_ca	= CA_default
 
[ CA_default ]
dir		    = /opt/ca/root
certs		= $dir/certs
crl_dir		= $dir/crl
database	= $dir/index.txt
new_certs_dir	= $dir/newcerts
certificate	= $dir/key/cacert.crt
serial		= $dir/serial
crlnumber	= $dir/crlnumber
crl		    = $dir/crl.pem
private_key	= $dir/key/cakey.pem
RANDFILE	= $dir/key/.rand
unique_subject	= no
 
x509_extensions	= usr_cert
copy_extensions = copy
 
name_opt 	= ca_default
cert_opt 	= ca_default
 
default_days	= 365
default_crl_days= 30
default_md	= sha256
preserve	= no
policy		= policy_ca
 
[ policy_ca ]
countryName		= supplied
stateOrProvinceName	= supplied
organizationName	= supplied
organizationalUnitName	= supplied
commonName		= supplied
emailAddress		= optional
 
[ req ]
default_bits		= 2048
default_keyfile 	= privkey.pem
distinguished_name	= req_distinguished_name
attributes		= req_attributes
x509_extensions	= v3_ca
string_mask = utf8only
utf8 = yes
prompt                  = no
 
[ req_distinguished_name ]
countryName			= CN
stateOrProvinceName		= beijing
localityName			= beijing
organizationName        = Global Google CA Inc
organizationalUnitName	= Root CA
commonName			= Global Google Root