利用openssl搭建CA

需求描述：

(1) 在节点上搭建一个CA；

(2) 给用户user1颁发证书；

(3) 验证证书的可信。

1.创建CA

–(1)创建CA需要用到的目录和文件

–mkdir "$HOME/testca"

–cd "$HOME/testca"

–mkdir newcerts private conf

–chmod g-rwx,o-rwx private

–echo"01" > serial

–touchindex.txt

•说明：

–$HOME/testca为待建CA的主目录，其中，

•newcerts子目录将存放CA签署（颁发）过的数字证书（证书备份目录）；

•Private子目录用于存放CA的私钥；

•目录conf只是用于存放一些简化参数用的配置文件；

•文件serial和index.txt分别用于存放下一个证书的序列号和证书信息数据库。

–(2)生成CA的私钥和自签名证书（即根证书）

–vi"$HOME/testca/conf/gentestca.conf"

–cd "$HOME/testca"

–openssl req -x509 -newkey rsa:2048 -outcacert.pem -outform PEM -days 2190 -config "$HOME/testca/conf/gentestca.conf"

–查看证书（私钥存储文件/private/cakey.pem）

•openssl x509 -in cacert.pem-text -noout

–(3)创建一个配置文件，以便后续CA日常操作中使用

–vi"$HOME/testca/conf/testca.conf" 

•2. CA给User1签发证书

–(1)CA为网关User1创建密钥和证书请求（证书请求里包含了公钥）

–mkdir $HOME/testuser

–cd $HOME/testuser

–openssl req -newkey rsa:1024 -keyout testkey.pem -keyform PEM -out testreq.pem-outform PEM -subj "/O=TestCom/OU=TestOU/CN=testuser“

–查看req

–openssl req -in testreq.pem-text -noout

–(2)CA为user1签发证书

–openssl ca -in testreq.pem-out testcert.pem -config "$HOME/testca/conf/testca.conf"

–查看证书

–openssl x509 -intestcert.pem -text -noout

•3.证书可信校验163

–openssl verify -CAfile testca/cacert.pem –verbose testuser/testcert.pem 

文件：gentestca.conf

==============================
[ req ]
default_keyfile = $ENV::HOME/testca/private/cakey.pem
default_md = md5
prompt = no
distinguished_name = ca_distinguished_name
x509_extensions = ca_extensions


[ ca_distinguished_name ]
organizationName = TestOrg
organizationalUnitName = TestDepartment
commonName = TestCA
emailAddress = ca_admin@testorg.com


[ ca_extensions ]
basicConstraints = CA:true

==================================

文件：testca.conf

==================

[ ca ]
default_ca = testca # The default ca section


[ testca ]
dir = $ENV::HOME/testca # top dir
database = $dir/index.txt # index file.
new_certs_dir = $dir/newcerts # new certs dir
certificate = $dir/cacert.pem # The CA cert
serial = $dir/serial # serial no file
private_key = $dir/private/cakey.pem # CA private key
RANDFILE = $dir/private/.rand # random number file
default_days = 365 # how long to certify for
default_crl_days= 30 # how long before next CRL
default_md = md5 # message digest method to use
unique_subject = no # Set to 'no' to allow creation of
                    # several ctificates with same subject.
policy = policy_any # default policy


[ policy_any ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional

==================================