建站
咨詢
售后
建站咨詢
新聞中心
這里有您想知道的互聯(lián)網(wǎng)營銷解決方案
使用OpenSSL創(chuàng)建CA和申請證書
OpenSSL簡介
OpenSSL是一種加密工具套件，可實現(xiàn)安全套接字層（SSL v2 / v3）和傳輸層安全性（TLS v1）網(wǎng)絡(luò)協(xié)議以及它們所需的相關(guān)加密標準。
創(chuàng)新互聯(lián)建站是專業(yè)的順慶網(wǎng)站建設(shè)公司，順慶接單;提供網(wǎng)站制作、成都做網(wǎng)站,網(wǎng)頁設(shè)計,網(wǎng)站設(shè)計,建網(wǎng)站,PHP網(wǎng)站建設(shè)等專業(yè)做網(wǎng)站服務(wù);采用PHP框架,可快速的進行順慶網(wǎng)站開發(fā)網(wǎng)頁制作和功能擴展;專業(yè)做搜索引擎喜愛的網(wǎng)站,專業(yè)的做網(wǎng)站團隊,希望更多企業(yè)前來合作!
openssl命令行工具用于從shell程序使用OpenSSL加密庫的各種加密功能。 它可以用于：
- 創(chuàng)建和管理私鑰，公鑰和參數(shù)
- 公鑰加密操作
- 創(chuàng)建X.509證書，CSR和CRL
- 消息摘要的計算
- 使用密碼進行加密和解密
- SSL / TLS客戶端和服務(wù)器測試
- 處理S / MIME簽名或加密的郵件
- 時間戳記請求，生成和驗證
openssl配置文件及三種策略
配置文件
/etc/pki/tls/openssl.cnf
三種策略
match（匹配）：要求申請?zhí)顚懙男畔⒏鶦A設(shè)置信息必須一致
optional（可選）：可有可無，跟CA設(shè)置信息可不一致
supplied（提供）：必須填寫這項申請信息創(chuàng)建私有CA和申請、頒發(fā)證書文件（以下操作都是在一臺機器上執(zhí)行）
1.創(chuàng)建所需要的文件
[root@CentOS7 ~]# cd /etc/pki/CA/
[root@CentOS7 CA]# touch index.txt 生成證書索引數(shù)據(jù)庫文件
[root@CentOS7 CA]# echo 01 > serial 指定第一個頒發(fā)證書的序列號2.CA自簽證書
2.1生成私鑰
[root@CentOS7 CA]# (umask 066;openssl genrsa -out private/cakey.pem 2048)
Generating RSA private key, 2048 bit long modulus
...................................................................................+++
.+++
e is 65537 (0x10001)2.2生成自簽名證書
[root@CentOS7 CA]# openssl req -new -x509 -key private/cakey.pem -days 3650 -out cacert.pem
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:beijing
Locality Name (eg, city) [Default City]:beijing
Organization Name (eg, company) [Default Company Ltd]:abc
Organizational Unit Name (eg, section) []:IT
Common Name (eg, your name or your server's hostname) []:hechunping
Email Address []:root@abc.com
選項說明：
-new：生成新證書簽署請求
-x509：專用于CA生成自簽證書
-key：生成請求時用到的私鑰文件
-days n：證書的有效期限
-out /PATH/TO/SOMECERTFILE: 證書的保存路徑3.頒發(fā)證書
3.1在需要使用證書的主機生成證書請求（本實驗是在本機）
3.1.1生成私鑰
[root@CentOS7 CA]# (umask 066;openssl genrsa -out /data/test.key 2048)
Generating RSA private key, 2048 bit long modulus
..................................................+++
...............................+++
e is 65537 (0x10001)3.1.2生成證書申請文件
[root@CentOS7 CA]# openssl req -new -key /data/test.key -out /data/test.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:beijing
Locality Name (eg, city) [Default City]:beijing
Organization Name (eg, company) [Default Company Ltd]:abc
Organizational Unit Name (eg, section) []:IT
Common Name (eg, your name or your server's hostname) []:hechunping
Email Address []:root@abc.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:3.2將證書申請文件傳輸給CA（兩臺不同的主機可以使用scp命令傳輸）
3.3CA簽署證書，并將證書頒發(fā)給請求者
[root@CentOS7 CA]# openssl ca -in /data/test.csr -out certs/test.crt -days 100
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Nov 10 13:45:34 2019 GMT
Not After : Feb 18 13:45:34 2020 GMT
Subject:
countryName = CN
stateOrProvinceName = beijing
organizationName = abc
organizationalUnitName = IT
commonName = hechunping
emailAddress = root@abc.com
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
4C:AE:F0:13:F0:CD:8F:B5:F7:3F:1B:C8:E4:77:91:02:9E:88:6B:5A
X509v3 Authority Key Identifier:
keyid:E3:C1:5E:6D:94:5E:F2:AE:16:67:79:2C:69:B5:B9:10:D9:E0:51:BE
Certificate is to be certified until Feb 18 13:45:34 2020 GMT (100 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
注意：默認要求 countryName（國家），stateOrProvinceName（省），organizationName（公司）三項必須和CA一致3.4查看證書中的信息
[root@CentOS7 CA]# openssl x509 -in certs/test.crt -noout -text|issuer|subject|serial|dates3.5查看指定編號的證書狀態(tài)
[root@CentOS7 CA]# openssl ca -status 01
Using configuration from /etc/pki/tls/openssl.cnf
01=Valid (V)4.吊銷證書
4.1在客戶端獲取要吊銷的證書的serial
[root@CentOS7 CA]# openssl x509 -in certs/test.crt -noout -serial -subject
serial=01
subject= /C=CN/ST=beijing/O=abc/OU=IT/CN=hechunping/emailAddress=root@abc.com4.2在CA上，根據(jù)客戶提交的serial與subject信息，對比檢驗是否與index.txt文件中的信息一致
[root@CentOS7 CA]# cat index.txt
V 200218134534Z 01 unknown /C=CN/ST=beijing/O=abc/OU=IT/CN=hechunping/emailAddress=root@abc.com4.2.1吊銷證書
[root@CentOS7 CA]# openssl ca -revoke newcerts/01.pem
Using configuration from /etc/pki/tls/openssl.cnf
Revoking Certificate 01.
Data Base Updated4.2指定第一個吊銷證書的編號，注意：第一次更新證書吊銷列表前才需要執(zhí)行。
[root@CentOS7 CA]# echo 01 > crlnumber4.3更新證書吊銷列表
[root@CentOS7 CA]# openssl ca -gencrl -out crl.pem
Using configuration from /etc/pki/tls/openssl.cnf4.4查看crl文件
[root@CentOS7 CA]# openssl crl -in crl.pem -noout -text將申請下來的證書導(dǎo)出到windows中查看
1.在windows上按"win+R"鍵，然后運行"certmgr.msc"命令。
2.找到“受信任的根證書頒發(fā)機構(gòu)”右鍵單擊“所有任務(wù)”--->“導(dǎo)入”，然后按照向?qū)нx擇在Linux申請下來的證書。
3.查看證書信息
網(wǎng)站名稱：使用OpenSSL創(chuàng)建CA和申請證書
分享網(wǎng)址：http://www.ef60e0e.cn/article/gsjidg.html
