PKI介绍及搭建Linux私有CA
PKI 介绍
PKI的诞生主要是为了防范中间人攻击。中间人攻击如下图所示:
PKI 概念
PKI(Public Key Infrastructure):公钥基础设施,主要包括以下四个部分:
- 签证机构(CA)
- 注册机构(RA)
- 证书吊销列表(CRL)
- 证书存取库
X.509v3:定义了证书的结构以及认证协议标准。
- 版本号
- 序列号
- 签名算法ID
- 发行者名称
- 有效期限
- 主体名称
- 主体公钥
- 发行者的唯一标识
- 主体的唯一标识、
- 扩展
- 发行者的签名
CA
CA一般有公共信任的CA和私有CA。
建立私有CA使用的工具:OpenSSL 和 OpenCA 。
# openssl命令
配置文件:/etc/pki/tls/openssl.cnf
构建私有CA
在确定配置为CA的服务上生成一个自签证书,并为CA提供所需要的目录及文件即可。
步骤1:生成私钥
# (umask 077; openssl genrsa -out /etc/pki/CA/private/cakey.pem 4096)
[root@LeeMumu ~]# (umask 077; openssl genrsa -out /etc/pki/CA/private/cakey.pem 4096)
Generating RSA private key, 4096 bit long modulus
........................++
........................++
e is 65537 (0x10001)
[root@LeeMumu CA]# ll /etc/pki/CA/private/cakey.pem
-rw-------. 1 root root 3247 Jul 19 21:50 /etc/pki/CA/private/cakey.pem
[root@LeeMumu ~]# cat /etc/pki/CA/private/cakey.pem
-----BEGIN RSA PRIVATE KEY-----
MIIJKgIBAAKCAgEAzZJJ2dvomneSkZQpI4t//UUaEj/duUigQ7fVmbqbQvqEGzQU
86UaG7QgNiL6n1f9TQ8X+fbaQCofnWzTNof/Qkq3k4QPDLqrTQ4b646EZpihoc99
... ...
0xACKBZkrlssQJ9SrAa7wTrTBZ3GAxRSFrcQk5F5w+9W8FPedhywAkjbUO0uxAdt
oDrDhwcSPTnSWl9w5oUY9DfAwz6EXVxCgdKWrTKWeHyNjgp11YV1sBXKpLOS+A==
-----END RSA PRIVATE KEY-----
步骤2:生成自签证书
# openssl req -new -x509 -key /etc/pki/CA/private/cakey.pem -out /etc/pki/CA/cacert.pem -days 3655
-new:生成新证书签署请求;
-x509:生成自签格式证书,专用于创建私有CA时;
-key:生成请求时用到的私有文件路径;
-out:生成的请求文件路径;如果自签操作将直接生成签署过的证书;
-days:证书的有效时长,单位是day;
[root@LeeMumu ~]# openssl req -new -x509 -key /etc/pki/CA/private/cakey.pem -out /etc/pki/CA/cacert.pem -days 3655
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:BJ
Locality Name (eg, city) [Default City]:BJ
Organization Name (eg, company) [Default Company Ltd]:JT
Organizational Unit Name (eg, section) []:NEO
Common Name (eg, your name or your server's hostname) []:JT.NEO
Email Address []:
[root@LeeMumu ~]# cd /etc/pki/CA/
[root@LeeMumu CA]# ls
cacert.pem certs crl newcerts private
[root@LeeMumu CA]# ll
total 4
-rw-r--r--. 1 root root 1960 Jul 19 21:52 cacert.pem
drwxr-xr-x. 2 root root 6 Oct 30