centos 配置CA

迟今天学习了吗

已于 2024-01-08 15:41:24 修改

阅读量369

点赞数 8

分类专栏： 2022年全国职业院校技能大赛之网络系统管理服务部署文章标签： centos linux 运维

于 2023-12-07 16:19:23 首次发布

本文链接：https://blog.csdn.net/weixin_49514207/article/details/134856197

版权

2022年全国职业院校技能大赛之网络系统管理服务部署专栏收录该内容

2 篇文章 0 订阅

订阅专栏

赛题

CA根证书路径/CA/cacert.pem；
签发数字证书，颁发者信息：

国家 = CN

单位 = Inc

组织机构 = www.skills.com

公用名 = Skill Global Root CA

创建用户组ldsgp ,将zsuser、lsusr、wuusr添加到组内。

1.修改根证书存放目录

vim /etc/pki/tls/openssl.cnf 
42 dir             = /CA           # Where everything is kept
50 certificate     = $dir/cacert.pem       # The CA certificate

2.创建根证书存放目录

[root@rserver ~]# cp -ra /etc/pki/CA/ /CA
[root@rserver CA]# touch {index.txt,serial}
[root@rserver CA]# echo 01 > serial

3.创建根证书

创建私钥

[root@rserver CA]# openssl genrsa -out private/cakey.pem
Generating RSA private key, 2048 bit long modulus
.....................................+++
.........................................+++
e is 65537 (0x10001)

生成cacert.pem根证书

[root@rserver CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:China
Locality Name (eg, city) [Default City]:GuangDong
Organization Name (eg, company) [Default Company Ltd]:skills
Organizational Unit Name (eg, section) []:Inc
Common Name (eg, your name or your server's hostname) []:Skill Global Root CA
Email Address []:

4.测试

[root@rserver CA]# openssl x509 -text -in /CA/cacert.pem -noout | grep Subject
        Subject: C=CN, ST=China, O=skills, OU=Inc, CN=Skill Global Root CA
        Subject Public Key Info:
            X509v3 Subject Key Identifier: 
[root@rserver CA]#