ca 自建 颁发证书_基于OpenSSL自建CA和颁发SSL证书

...

[ CA_default ]

dir = /etc/pki/CA # Where everything is kept

certs = $dir/certs # Where the issued certs are kept

crl_dir = $dir/crl # Where the issued crl are kept

database = $dir/index.txt # database index file.

#unique_subject = no # Set to 'no' to allow creation of

# several ctificates with same subject.

new_certs_dir = $dir/newcerts # default place for new certs.

certificate = $dir/cacert.pem # The CA certificate

serial = $dir/serial # The current serial number

crlnumber = $dir/crlnumber # the current crl number

# must be commented out to leave a V1 CRL

crl = $dir/crl.pem # The current CRL

private_key = $dir/private/cakey.pem # The private key

RANDFILE = $dir/private/.rand # private random number file

...

default_days = 3650 # how long to certify for

...

# For the CA policy

[ policy_match ]

countryName = match

stateOrProvinceName = optional

localityName = optional

organizationName = optional

organizationalUnitName = optional

commonName = supplied

emailAddress = optional

...

[ req_distinguished_name ]

countryName = Country Name (2 letter code)

countryName_default = CN

countryName_min = 2

countryName_max = 2

stateOrProvinceName = State or Province Name (full name)

stateOrProvinceName_default = GD

...

[ req_distinguished_name ] 部分主要是颁证时一些默认的值，可以不动