[[email protected] CA]# ls

certs crl index.txt newcerts private serial

2、生成CA自簽證書；

[[email protected] CA]# (umask 077; openssl genrsa -out /etc/pki/CA/cakey.pem 4096)

Generating RSA private key, 4096 bit long modulus

..............................++

...............................................................................++

e is 65537 (0x10001)

[[email protected] CA]# openssl req -new -x509 -key /etc/pki/CA/private/cakey.pem -days 365 -out cacert.pem

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter ‘.‘, the field will be left blank.

-----

Country Name (2 letter code) [XX]:CN

State or Province Name (full name) []:Beijing

Locality Name (eg, city) [Default City]:Beijing

Organization Name (eg, company) [Default Company Ltd]:Dk

Organizational Unit Name (eg, section) []:Ops

Common Name (eg, your name or your server‘s hostname) []:ca.xiong.cn

Email Address []:[email protected]

一些選項的作用：

-new: 生成新證書簽署請求

-x509: 專用於CA生成自簽證書；

-key: 生成請求時用到的私鑰文件；

-days n: 證書的有效期限；

-out /PATH/TO/SOMECEFTFILE: 證書的保存路徑；

查看剛生成的cakey.pem、cacert.pem兩個文件

[[email protected] CA]# ls -l

總用量 28

-rw-r--r-- 1 root root 1399 6月 14 19:51 cacert.pem

-rw------- 1 root root 3247 6月 14 19:06 cakey.pem

drwxr-xr-x. 2 root root 4096 6月 14 18:50 certs

drwxr-xr-x. 2 root root 4096 2月 20 23:49 crl

-rw-r--r-- 1 root root 0 6月 14 19:03 index.txt

drwxr-xr-x. 2 root root 4096 6月 14 18:48 newcerts

drwx------. 2 root root 4096 6月 14 18:17 private

-rw-r--r-- 1 root root 3 6月 14 19:03 serial

在客戶端上主機生成證書請求

[[email protected] ssl]# (umask 077; openssl genrsa -out /etc/httpd/ssl/httpd.key 4096)

Generating RSA private key, 4096 bit long modulus

..................................................................................++

............................................................................................................++

e is 65537 (0x10001)

[[email protected] ssl]# openssl req -new -key /etc/httpd/ssl/httpd.key -days 369 -out /etc/httpd/ssl/httpd.csr

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter ‘.‘, the field will be left blank.

-----

Country Name (2 letter code) [XX]:CN

State or Province Name (full name) []:Beijing

Locality Name (eg, city) [Default City]:Beijing

Organization Name (eg, company) [Default Company Ltd]:Dk

Organizational Unit Name (eg, section) []:Ops

Common Name (eg, your name or your server‘s hostname) []:www.xiong.cn

Email Address []:[email protected]

Please enter the following ‘extra‘ attributes

to be sent with your certificate request

A challenge password []:123456

An optional company name []:centos

查看客戶端生成的兩個文件

[[email protected] ssl]# ls

httpd.csr httpd.key

把httpd.csr這個文件傳給CA，然後CA進行授權。實驗的話 就上傳到CA下的/tmp目錄下，按照規範的話 都是傳到相對應的文件夾裏頭去，這裏為了方便就放到了/tmp下

[[email protected] ssl]# scp httpd.csr [email protected]:/tmp/

The authenticity of host ‘192.168.2.30 (192.168.2.32)‘ can‘t be established.

ECDSA key fingerprint is 62:d9:92:9a:3a:be:c1:82:6a:96:36:da:b7:9d:e3:a9.

Are you sure you want to continue connecting (yes/no)? yes

Warning: Permanently added ‘192.168.2.32‘ (ECDSA) to the list of known hosts.

[email protected] password:

httpd.csr 100% 1801 1.8KB/s 00:00

[[email protected] ssl]#

然後在CA上進行授權並同意

[[email protected] CA]# openssl ca -in /tmp/httpd.csr -out /etc/pki/CA/certs/httpd.crt -days 365

Using configuration from /etc/pki/tls/openssl.cnf

Check that the request matches the signature

Signature ok

Certificate Details:

Serial Number: 1 (0x1)

Validity

Not Before: Jun 14 15:20:46 2017 GMT

Not After : Jun 14 15:20:46 2018 GMT

Subject:

countryName = CN

stateOrProvinceName = Beijing

organizationName = Dk

organizationalUnitName = Ops

commonName = www.xiong.cn

emailAddress = [email protected]

X509v3 extensions:

X509v3 Basic Constraints:

CA:FALSE

Netscape Comment:

OpenSSL Generated Certificate

X509v3 Subject Key Identifier:

37:6B:FF:B5:74:93:4F:ED:36:BC:23:2F:77:66:4D:31:48:BF:23:A6

X509v3 Authority Key Identifier:

keyid:8C:D9:52:FD:D6:EC:86:99:DE:14:D4:A8:D9:C5:01:CF:69:DA:E2:D1

Certificate is to be certified until Jun 14 15:20:46 2018 GMT (365 days)

這塊的話它是問你確定要給它授權嗎，咱輸入y同意即可

Sign the certificate? [y/n]: y

1 out of 1 certificate requests certified, commit? [y/n]y

Write out database with 1 new entries

Data Base Updated

查看授權證書裏頭的信息，有點長就復制一丟丟過來了

[[email protected] CA]# openssl x509 -in /etc/pki/CA/certs/httpd.crt -noout -text

Certificate:

Data:

Version: 3 (0x2)

Serial Number: 1 (0x1)

Signature Algorithm: sha1WithRSAEncryption

Issuer: C=CN, ST=Beijing, L=Beijing, O=Dk, OU=Ops, [email protected]

Validity

Not Before: Jun 14 15:20:46 2017 GMT

Not After : Jun 14 15:20:46 2018 GMT

Subject: C=CN, ST=Beijing, O=Dk, OU=Ops, [email protected]

Subject Public Key Info:

Public Key Algorithm: rsaEncryption

Public-Key: (4096 bit)

Modulus:

再次從CA服務器上把已授權的證書發放到客戶端的指定目錄下即可

[[email protected] CA]# scp certs/httpd.crt [email protected]:/etc/httpd/ssl/

Address 192.168.2.30 maps to bogon, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!

[email protected] password:

httpd.crt 100% 6051 5.9KB/s 00:00

在客戶端指定文件夾查看證書

[[email protected] ~]# ls /etc/httpd/ssl/

httpd.crt httpd.csr httpd.key

小白第一次寫博客 裏頭肯定有很多問題，文章裏頭有什麽問題大神們可以幫忙指出來！！十分感謝。

Linux下私有CA搭建