openssl命令：配置文件：/etc/pki/tls/openssl.cnf
構建私有CA：
在確定配置爲CA的服務上生成一個自簽證書，併爲CA提供所需要的目錄及文件即可
步驟：
(1) 生成私鑰；
[root@localhost ~]# (umask 077; openssl genrsa -out /etc/pki/CA/private/cakey.pem 4096)
(2) 生成自簽證書；
[root@localhost ~]# openssl req -new -x509 -key /etc/pki/CA/private/cakey.pem -out /etc/pki/CA/cacert.pem -days 3655
/*-new：生成新證書籤署請求；
-x509：生成自籤格式證書，專用於創建私有CA時；
-key：生成請求時用到的私有文件路徑；
-out：生成的請求文件路徑；如果自籤操作將直接生成簽署過的證書；
-days：證書的有效時長，單位是day；*/
You are about to be asked to enter information that will be incorporatedinto your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:Beijing
Locality Name (eg, city) [Default City]:Beijing
Organization Name (eg, company) [Default Company Ltd]:ME
Organizational Unit Name (eg, section) []:Ops
Common Name (eg, your name or your server's hostname) []:ca.me.com
Email Address []:[email protected]
(3) 爲CA提供所需的目錄及文件；
[root@localhost /]# mkdir -pv /etc/pki/CA/{certs,crl,newcerts}
[root@localhost /]# touch /etc/pki/CA/{serial,index.txt}
[root@localhost /]# echo 01 > /etc/pki/CA/serial
要用到證書進行安全通信的服務器，需要向CA請求籤署證書：
步驟：（以httpd爲例）
(1) 用到證書的主機生成私鑰；
[root@localhost httpd]# mkdir /etc/httpd/ssl
[root@localhost httpd]# cd /etc/httpd/ssl
[root@localhost ssl]# (umask 077; openssl genrsa -out /etc/httpd/ssl/httpd.key 2048)
Generating RSA private key, 2048 bit long modulus
........+++
..+++
e is 65537 (0x10001)
(2) 生成證書籤署請求
[root@localhost ssl]# openssl req -new -key /etc/httpd/ssl/httpd.key -out /etc/httpd/ssl/httpd.csr -days 365
You are about to be asked to enter information that will be incorporatedinto your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:Beijing
Locality Name (eg, city) [Default City]:Beijing
Organization Name (eg, company) [Default Company Ltd]:ME
Organizational Unit Name (eg, section) []:Ops
Common Name (eg, your name or your server's hostname) []:www.me.com
Email Address []:[email protected]
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
(3) 將請求通過可靠方式發送給CA主機；
測試使用scp命令將請求發送至CA主機
[root@localhost ssl]# scp http.csr [email protected]:/tmp/
The authenticity of host '192.168.0.104 (192.168.0.104)' can't be established.
ECDSA key fingerprint is f6:80:c9:d6:5a:68:10:a0:95:49:a5:1c:48:f8:65:68.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.0.104' (ECDSA) to the list of known hosts.
[email protected]'s password:
http.csr 100% 1041 1.0KB/s 00:00
(4) 在CA主機上籤署證書；
[root@localhost /]# openssl ca -in /tmp/http.csr -out /etc/pki/CA/certs/httpd.crt -days 365
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Jun 3 14:05:39 2017 GMT
Not After : Jun 3 14:05:39 2018 GMT
Subject:
countryName = CN
stateOrProvinceName = Beijing
organizationName = ME
organizationalUnitName = Ops
commonName = www.me.com
emailAddress = [email protected]
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
5A:FA:98:3F:D1:96:7B:F0:FF:83:BC:F5:2A:41:85:3E:DF:20:81:3E
X509v3 Authority Key Identifier:
keyid:74:46:21:24:27:6E:85:46:7E:37:6F:44:E9:97:76:3C:65:EB:6C:F8
Certificate is to be certified until Jun 3 14:05:39 2018 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
查看證書序列號：
[root@localhost CA]# cat /etc/pki/CA/index.txt
V 180603140539Z 01 unknown /C=CN/ST=Beijing/O=ME/OU=Ops/CN=www.me.com
將證書發給請求者：
[root@localhost CA]# scp /etc/pki/CA/certs/httpd.crt [email protected]:/etc/httpd/ssl/
The authenticity of host '192.168.0.150 (192.168.0.150)' can't be established.
ECDSA key fingerprint is 3b:89:4b:0b:f3:88:e8:9f:ab:8b:d0:d8:7a:83:6c:f2.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.0.150' (ECDSA) to the list of known hosts.
[email protected]'s password:
httpd.crt
100% 5819 5.7KB/s 00:00
查看證書中的信息：
[root@localhost CA]# openssl x509 -in /etc/pki/CA/certs/httpd.crt -noout -serial -subjectserial=01
subject= /C=CN/ST=Beijing/O=ME/OU=Ops/CN=www.me.com/[email protected]
或者：在客戶機查看
[root@localhost ssl]# openssl x509 -in /etc/httpd/ssl/httpd.crt -noout -serial -subjectserial=01
subject= /C=CN/ST=Beijing/O=ME/OU=Ops/CN=www.me.com/[email protected]
吊銷證書：
步驟：
(1) 客戶端獲取要吊銷的證書的serial（在使用證書的主機執行）：
~]# openssl x509 -in /etc/pki/CA/certs/httpd.crt -noout -serial -subject
(2) CA主機吊銷證書
先根據客戶提交的serial和subject信息，對比其與本機數據庫index.txt中存儲的是否一致；
吊銷：
# openssl ca -revoke /etc/pki/CA/newcerts/SERIAL.pem
其中的SERIAL要換成證書真正的序列號；
(3) 生成吊銷證書的吊銷編號（第一次吊銷證書時執行）
# echo 01 > /etc/pki/CA/crlnumber
(4) 更新證書吊銷列表
# openssl ca -gencrl -out thisca.crl
查看crl文件：
# openssl crl -in /PATH/FROM/CRL_FILE.crl -noout -text