dir = /etc/pki/CA # Where everything is kept certs = $dir/certs # Where the issued certs are kept crl_dir = $dir/crl # Where the issued crl are kept database = $dir/index.txt # database index file. #unique_subject = no # Set to 'no' to allow creation of # several ctificates with same subject. new_certs_dir = $dir/newcerts # default place for new certs.
certificate = $dir/cacert.pem # The CA certificate serial = $dir/serial # The current serial number crlnumber = $dir/crlnumber # the current crl number # must be commented out to leave a V1 CRL crl = $dir/crl.pem # The current CRL private_key = $dir/private/cakey.pem# The private key RANDFILE = $dir/private/.rand # private random number file
x509_extensions = usr_cert # The extentions to add to the cert
# A few difference way of specifying how similar the request should look # For type CA, the listed attributes must be the same, and the optional # and supplied fields are just that :-) policy = policy_match #此处若修改为policy_anything就能实现客户端申请证书时countryName、stateOrProvinceName、organizationName和CA不同也能签署。
# For the CA policy [ policy_match ] countryName = match stateOrProvinceName = match organizationName = match organizationalUnitName = optional commonName = supplied emailAddress = optional
# For the 'anything' policy # At this point in time, you must list all acceptable 'object' # types. [ policy_anything ] countryName = optional stateOrProvinceName = optional localityName = optional organizationName = optional organizationalUnitName = optional commonName = supplied emailAddress = optional
一、创建私有CA
1.生成证书索引数据库文件
1
[root@centos7 CA]# touch index.txt
2.指定证书颁发序列号
1
[root@centos7 CA]# echo 01 > serial
3.生成私钥
私钥必须存放在/etc/pki/CA/private下取名为cakey.pem
1 2 3 4 5
[root@centos7 CA]# (umask 066;openssl genrsa -out private/cakey.pem 4096) #生成私钥，指定长度为4096位 Generating RSA private key, 4096 bit long modulus .........................................++ .....................++ e is 65537 (0x10001)
4.生成自签证书
自签证书的存放位置和命名也有规定，必须存放在/etc/pki/CA/下，取名为cacert.pem
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
[root@centos7 CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 3650 #生成自签证书，指定有效时长为3650天 You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:CN State or Province Name (full name) []:beijing Locality Name (eg, city) [Default City]:beijing Organization Name (eg, company) [Default Company Ltd]:magedu Organizational Unit Name (eg, section) []:ops Common Name (eg, your name or your server's hostname) []:ca.magedu.com Email Address []:
二、客户端申请证书
1.在客户端生成私钥文件
客户端的私钥一般在需要生成私钥的应用下生成
1 2 3 4 5
[root@centos7 data]# (umask 066;openssl genrsa -out test.key 1024) Generating RSA private key, 1024 bit long modulus ....................................................................................................................++++++ .....++++++ e is 65537 (0x10001)
2.利用私钥生成证书签署请求
签署请求中Country Name、State or Provice Name、Organization Name必须相同。
[root@centos7 data]# openssl req -new -key test.key -out test.csr You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:CN State or Province Name (full name) []:beijing Locality Name (eg, city) [Default City]:beijing Organization Name (eg, company) [Default Company Ltd]:magedu Organizational Unit Name (eg, section) []:ops Common Name (eg, your name or your server's hostname) []:www.mylinuxops.com Email Address []: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []:
3.将证书签署请求发给CA
1 2 3 4 5 6 7 8
[root@centos7 data]# scp test.csr 192.168.73.132:/tmp The authenticity of host '192.168.73.132 (192.168.73.132)' can't be established. ECDSA key fingerprint is SHA256:YNlH0VBV0kp4lAClVvfMWVx/bHcbKKHXQwyd13d+MME. ECDSA key fingerprint is MD5:8a:1c:3d:c2:04:b1:be:05:95:33:9e:16:e8:ad:6c:25. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '192.168.73.132' (ECDSA) to the list of known hosts. root@192.168.73.132's password: test.csr 100% 660 220.9KB/s 00:00
[root@centos7 CA]# cat index.txt V 200414224233Z 01 unknown /C=CN/ST=beijing/O=magedu/OU=ops/CN=www.mylinuxops.com
3.吊销证书
1 2 3 4
[root@centos7 CA]# openssl ca -revoke /etc/pki/CA/newcerts/01.pem Using configuration from /etc/pki/tls/openssl.cnf Revoking Certificate 01. Data Base Updated
