Linux CA服务器申请流程

CA服务器申请流程

##申请根证书
[root@linux1 CA]# yum install openssl-* -y
[root@linux1 CA]# cd /etc/pki/CA
[root@linux1 CA]# touch index.txt
[root@linux1 CA]# echo 01 > serial
[root@linux1 CA]# openssl genrsa -out private/cakey.pem
[root@linux1 CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 3650 
[root@linux1 CA]# cp -p cacert.pem /etc/ssl

##申请域证书
[root@linux1 CA]# cd /etc/ssl
[root@linux1 ssl]# openssl genrsa -out skills.key
[root@linux1 ssl]# openssl req -new -key example.key -out example.csr
[root@linux1 ssl]# echo "subjectAltName=DNS:*.example.com,DNS:example.com" >> sign.cnf
[root@linux1 ssl]# openssl ca -in skills.csr -out skills.crt -days 1825 -extfile sign.cnf
[root@linux1 ssl]# scp root@linux1:/etc/ssl/* /etc/ssl/;cp -p /etc/ssl/cacert.pem /etc/pki/ca-trust/source/anchors/;update-ca-trust  ##使用scp命令使主机信任证书

Apache2证书
[root@linux1 ssl]# openssl pkcs12 -export  -in example.crt -inkey example.key -out example.pfx
[root@linux1 ssl]# openssl pkcs12 -nodes  -in example.pfx -out example.pem
[root@linux1 ssl]# openssl x509 -in example.pem -out apache.crt
[root@linux1 ssl]# openssl rsa -in example.pem -out apache.key

Tomcat证书
[root@linux1 ssl]# openssl pkcs12 -export -in skills.crt -inkey skills.key -out skills.pfx
[root@linux1 ssl]# keytool -importkeystore -srckeystore skills.pfx -srcstoretype pkcs12 -destkeystore skills.jks -deststoretype jksfu