1.查看軟件包是否安裝
[root@rrcy ~]# rpm -qa |grep ssl
nss_compat_ossl-0.9.6-1.el6.x86_64
openssl-1.0.1e-16.el6_5.7.x86_64
openssl-devel-1.0.1e-16.el6_5.7.x86_64
mod_ssl-2.2.15-30.el6.centos.x86_64
2.切換到CA目錄
[root@rrcy ~]# cd /etc/pki/CA/
[root@rrcy CA]# ls
certs crl newcerts private
[root@rrcy CA]# pwd
/etc/pki/CA
3.創建一個rsa 私鑰 2048位
cakey.pem
[root@rrcy CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048)
Generating RSA private key, 2048 bit long modulus
............................................................................................+++
..............................+++
e is 65537 (0x10001)
權限600
[root@rrcy CA]# ls -l private/cakey.pem
-rw------- 1 root root 1679 Jul 28 14:32 private/cakey.pem
4.生成自簽證書
[root@rrcy CA]# vim ../tls/openssl.cnf
修改countryName_default = XX 默認國家名字CN
修改stateOrProvinceName_default = Fujian 默認省會名稱
localityName_default = Fuzhou 城市名稱
0.organizationName_default = MageEdu 組織名稱
organizationalUnitName_default = Tech 部門名稱
[root@rrcy CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 3655
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) [Fujian]:
Locality Name (eg, city) [Fuzhou]:
Organization Name (eg, company) [MageEdu]:
Organizational Unit Name (eg, section) [Tech]:
Common Name (eg, your name or your server's hostname) []:ca.magedu.com
Email Address []:[email protected]
[ CA_default ]
dir = /etc/pki/CA
5.創建證書
[root@rrcy CA]# cd /etc/httpd/
[root@rrcy httpd]# ls
conf conf.d logs modules run
[root@rrcy httpd]# mkdir ssl
[root@rrcy httpd]# ls
conf conf.d logs modules run ssl
[root@rrcy httpd]# cd ssl/
6.創建私鑰1024位
[root@rrcy ssl]# (umask 077;openssl genrsa 1024 >httpd.key)
Generating RSA private key, 1024 bit long modulus
................++++++
..................++++++
e is 65537 (0x10001)
7.權限600
[root@rrcy ssl]# ll
total 4
-rw------- 1 root root 887 Jul 28 14:49 httpd.key
8.生成證書頒發請求
CSR是Cerificate Signing Request的英文縮寫,即證書請求文件
[root@rrcy ssl]# openssl req -new -key httpd.key -out httpd.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:CN
State or Province Name (full name) [Fujian]:
Locality Name (eg, city) [Fuzhou]:
Organization Name (eg, company) [MageEdu]:
Organizational Unit Name (eg, section) [Tech]:
Common Name (eg, your name or your server's hostname) []:hello.magedu.com
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@rrcy ssl]# ls
httpd.csr httpd.key
9.頒發證書
[root@rrcy ssl]# openssl ca -in httpd.csr -out httpd.crt -days 3650
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Jul 28 06:53:08 2014 GMT
Not After : Jul 25 06:53:08 2024 GMT
Subject:
countryName = CN
stateOrProvinceName = Fujian
organizationName = MageEdu
organizationalUnitName = Tech
commonName = hello.magedu.com
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
D4:5B:C9:45:2E:27:94:62:85:90:33:CB:38:ED:61:26:B1:B2:D8:CF
X509v3 Authority Key Identifier:
keyid:EA:DB:92:B3:D2:20:A3:9D:28:E8:73:6D:64:0D:EF:6D:5F:4A:D6:7B
Certificate is to be certified until Jul 25 06:53:08 2024 GMT (3650 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
[root@rrcy ssl]# cd /etc/pki/CA/
[root@rrcy CA]# ls
cacert.pem crl index.txt.attr newcerts serial
certs index.txt index.txt.old private serial.old
[root@rrcy CA]# cat index.txt
V 240725065308Z 01 unknown /C=CN/ST=Fujian/O=MageEdu/OU=Tech/CN=hello.magedu.com
[root@rrcy CA]# cat serial
02