{"id":237,"date":"2012-04-17T17:14:35","date_gmt":"2012-04-17T17:14:35","guid":{"rendered":"539fd53b59e3bb12d203f45a912eeaf2"},"modified":"2012-04-17T17:14:35","modified_gmt":"2012-04-17T17:14:35","slug":"","status":"publish","type":"post","link":"https:\/\/www.xiaobo.li\/notes\/archives\/237","title":{"rendered":"\u57fa\u4e8e OpenSSL \u7684 CA \u5efa\u7acb\u53ca\u8bc1\u4e66\u7b7e\u53d1"},"content":{"rendered":"

\u5efa\u7acb CA<\/span> <\/b><\/h2>\n

\u5efa\u7acb CA \u76ee\u5f55\u7ed3\u6784<\/h3>\n

\u6309\u7167 OpenSSL \u7684\u9ed8\u8ba4\u914d\u7f6e\u5efa\u7acb CA \uff0c\u9700\u8981\u5728\u6587\u4ef6\u7cfb\u7edf\u4e2d\u5efa\u7acb\u76f8\u5e94\u7684\u76ee\u5f55\u7ed3\u6784\u3002\u76f8\u5173\u7684\u914d\u7f6e\u5185\u5bb9\u4e00\u822c\u4f4d\u4e8e \/usr\/ssl\/openssl.cnf<\/span> \u5185\uff0c\u8be6\u60c5\u53ef\u53c2\u89c1 config (1) \u3002\u5728\u7ec8\u7aef\u4e2d\u4f7f\u7528\u5982\u4e0b\u547d\u4ee4\u5efa\u7acb\u76ee\u5f55\u7ed3\u6784\uff1a<\/p>\n

\n

$ mkdir -p .\/demoCA\/{private,newcerts}
\n$ touch .\/demoCA\/index.txt
\n$ echo 01 > .\/demoCA\/serial<\/span><\/p>\n<\/blockquote>\n

\u4ea7\u751f\u7684\u76ee\u5f55\u7ed3\u6784\u5982\u4e0b\uff1a<\/p>\n

\n

.
\n`-- demoCA\/
\n    |-- index.txt
\n    |-- newcerts\/
\n    |-- private\/
\n    `-- serial
\n<\/span><\/p>\n<\/blockquote>\n

\u751f\u6210 CA \u8bc1\u4e66\u7684 RSA \u5bc6\u94a5\u5bf9<\/h3>\n

\u9996\u5148\uff0c\u6211\u4eec\u8981\u4e3a CA \u5efa\u7acb RSA \u5bc6\u94a5\u5bf9\u3002\u6253\u5f00\u7ec8\u7aef\uff0c\u4f7f\u7528\u5982\u4e0b\u547d\u4ee4\u751f\u6210 RSA \u5bc6\u94a5\u5bf9\uff1a<\/p>\n

\n

$ openssl genrsa -des3 -out .\/demoCA\/private\/cakey.pem 2048<\/span><\/p>\n<\/blockquote>\n

\u53c2\u6570\u89e3\u91ca<\/u><\/h4>\n
\n

genrsa<\/span><\/p>\n

\n

\u7528\u4e8e\u751f\u6210 RSA \u5bc6\u94a5\u5bf9\u7684 OpenSSL \u547d\u4ee4\u3002<\/p>\n<\/blockquote>\n

-des3<\/span><\/p>\n

\n

\u4f7f\u7528 3-DES \u5bf9\u79f0\u52a0\u5bc6\u7b97\u6cd5\u52a0\u5bc6\u5bc6\u94a5\u5bf9\uff0c\u8be5\u53c2\u6570\u9700\u8981\u7528\u6237\u5728\u5bc6\u94a5\u751f\u6210\u8fc7\u7a0b\u4e2d\u8f93\u5165\u4e00\u4e2a\u53e3\u4ee4\u7528\u4e8e\u52a0\u5bc6\u3002\u4eca\u540e\u4f7f\u7528\u8be5\u5bc6\u94a5\u5bf9\u65f6\uff0c\u9700\u8981\u8f93\u5165\u76f8\u5e94\u7684\u53e3\u4ee4\u3002\u5982\u679c\u4e0d\u52a0\u8be5\u9009\u9879\uff0c\u5219\u4e0d\u5bf9\u5bc6\u94a5\u8fdb\u884c\u52a0\u5bc6\u3002<\/p>\n<\/blockquote>\n

-out .\/demoCA\/private\/cakey.pem<\/span><\/p>\n

\n

\u4ee4\u751f\u6210\u7684\u5bc6\u94a5\u5bf9\u4fdd\u5b58\u5230\u6587\u4ef6 .\/demoCA\/private\/cakey.pem<\/span> \u3002<\/p>\n<\/blockquote>\n

2048<\/span><\/p>\n

\n

RSA \u6a21\u6570\u4f4d\u6570\uff0c\u5728\u4e00\u5b9a\u7a0b\u5ea6\u4e0a\u8868\u5f81\u4e86\u5bc6\u94a5\u5f3a\u5ea6\u3002<\/p>\n<\/blockquote>\n<\/blockquote>\n

\u8be5\u547d\u4ee4\u8f93\u51fa\u5982\u4e0b\uff0c\u7528\u6237\u5e94\u8f93\u5165\u81ea\u5df1\u7684\u5bc6\u94a5\u53e3\u4ee4\u5e76\u786e\u8ba4\uff1a<\/p>\n

\n
Generating RSA private key, 2048 bit long modulus\r\n................................................+++\r\n.........................+++\r\ne is 65537 (0x10001)\r\nEnter pass phrase for .\/demoCA\/private\/cakey.pem:<enter your pass-phrase><\/b>Verifying - Enter pass phrase for .\/demoCA\/private\/cakey.pem:<re-enter your pass-phrase><\/b><\/span><\/pre>\n<\/blockquote>\n
\u751f\u6210 CA \u8bc1\u4e66\u8bf7\u6c42<\/h3>\n
\u4e3a\u4e86\u83b7\u53d6\u4e00\u4e2a CA \u6839\u8bc1\u4e66\uff0c\u6211\u4eec\u9700\u8981\u5148\u5236\u4f5c\u4e00\u4efd\u8bc1\u4e66\u8bf7\u6c42\u3002\u5148\u524d\u751f\u6210\u7684 CA \u5bc6\u94a5\u5bf9\u88ab\u7528\u4e8e\u5bf9\u8bc1\u4e66\u8bf7\u6c42\u7b7e\u540d\u3002<\/p>\n
\n
$ openssl req -new -days 365 -key .\/demoCA\/private\/cakey.pem -out careq.pem<\/span><\/p>\n<\/blockquote>\n
\u53c2\u6570\u89e3\u91ca<\/span><\/u><\/h4>\n
\n
req<\/span><\/p>\n
\n
\u7528\u4e8e\u751f\u6210\u8bc1\u4e66\u8bf7\u6c42\u7684 OpenSSL \u547d\u4ee4\u3002<\/p>\n<\/blockquote>\n
-new<\/span><\/p>\n
\n
\u751f\u6210\u4e00\u4e2a\u65b0\u7684\u8bc1\u4e66\u8bf7\u6c42\u3002\u8be5\u53c2\u6570\u5c06\u4ee4 OpenSSL \u5728\u8bc1\u4e66\u8bf7\u6c42\u751f\u6210\u8fc7\u7a0b\u4e2d\u8981\u6c42\u7528\u6237\u586b\u5199\u4e00\u4e9b\u76f8\u5e94\u7684\u5b57\u6bb5\u3002<\/p>\n<\/blockquote>\n
-days 365<\/span><\/p>\n
\n
\u4ece\u751f\u6210\u4e4b\u65f6\u7b97\u8d77\uff0c\u8bc1\u4e66\u65f6\u6548\u4e3a 365 \u5929\u3002<\/p>\n<\/blockquote>\n
-key .\/demoCA\/private\/cakey.pem<\/span><\/p>\n
\n
\u6307\u5b9a .\/demoCA\/private\/cakey.pem<\/span> \u4e3a\u8bc1\u4e66\u6240\u4f7f\u7528\u7684\u5bc6\u94a5\u5bf9\u6587\u4ef6\u3002<\/p>\n<\/blockquote>\n
-out careq.pem<\/span><\/p>\n
\n
\u4ee4\u751f\u6210\u7684\u8bc1\u4e66\u8bf7\u6c42\u4fdd\u5b58\u5230\u6587\u4ef6 careq.pem<\/span> \u3002<\/p>\n<\/blockquote>\n<\/blockquote>\n
\u8be5\u547d\u4ee4\u5c06\u63d0\u793a\u7528\u6237\u8f93\u5165\u5bc6\u94a5\u53e3\u4ee4\u5e76\u586b\u5199\u8bc1\u4e66\u76f8\u5173\u4fe1\u606f\u5b57\u6bb5\uff0c\u8f93\u51fa\u5982\u4e0b\uff1a<\/p>\n
\n
Enter pass phrase for .\/demoCA\/private\/cakey.pem:<enter you pass-phrase><\/b>
\nYou are about to be asked to enter information that will be incorporated
\ninto your certificate request.
\nWhat you are about to enter is what is called a Distinguished Name or a DN.
\nThere are quite a few fields but you can leave some blank
\nFor some fields there will be a default value,
\nIf you enter '.', the field will be left blank.
\n-----
\nCountry Name (2 letter code) [AU]:CN<\/b>
\nState or Province Name (full name) [Some-State]:ZJ<\/b>
\nLocality Name (eg, city) []:HZ<\/b>
\nOrganization Name (eg, company) [Internet Widgits Pty Ltd]:Some Ltd. Corp.<\/b>
\nOrganizational Unit Name (eg, section) []:Some Unit<\/b>
\nCommon Name (eg, YOUR name) []:Someone<\/b>
\nEmail Address []:some@email.com<\/b><\/p>\n
Please enter the following 'extra' attributes
\nto be sent with your certificate request
\nA challenge password []:
\nAn optional company name []:<\/span><\/p>\n<\/blockquote>\n
\u5bf9 CA \u8bc1\u4e66\u8bf7\u6c42\u8fdb\u884c\u7b7e\u540d<\/h3>\n
\u5728\u5b9e\u9645\u5e94\u7528\u4e2d\uff0c\u7528\u6237\u53ef\u4ee5\u901a\u8fc7\u5411\u77e5\u540d CA \u9012\u4ea4\u8bc1\u4e66\u8bf7\u6c42\u6765\u7533\u8bf7\u8bc1\u4e66\u3002\u4f46\u662f\u5728\u8fd9\u91cc\uff0c\u6211\u4eec\u9700\u8981\u5efa\u7acb\u7684\u662f\u4e00\u4e2a\u6839 CA \uff0c\u53ea\u80fd\u7531\u6211\u4eec\u81ea\u5df1\u6765\u5bf9\u8bc1\u4e66\u8bf7\u6c42\u8fdb\u884c\u7b7e\u540d\u3002\u6240\u4ee5\u6211\u4eec\u8ba9 OpenSSL \u4f7f\u7528\u8bc1\u4e66\u8bf7\u6c42\u4e2d\u9644\u5e26\u7684\u5bc6\u94a5\u5bf9\u5bf9\u8be5\u8bf7\u6c42\u8fdb\u884c\u7b7e\u540d\uff0c\u4e5f\u5c31\u662f\u6240\u8c13\u7684\u201c self sign \u201d\uff1a<\/p>\n
\n
$ openssl ca -selfsign -in careq.pem -out cacert.pem<\/span><\/p>\n<\/blockquote>\n
\u53c2\u6570\u89e3\u91ca<\/span><\/u><\/h4>\n
\n
ca<\/span><\/p>\n
\n
\u7528\u4e8e\u6267\u884c CA \u76f8\u5173\u64cd\u4f5c\u7684 OpenSSL \u547d\u4ee4\u3002<\/p>\n<\/blockquote>\n
-selfsign<\/span><\/p>\n
\n
\u4f7f\u7528\u5bf9\u8bc1\u4e66\u8bf7\u6c42\u8fdb\u884c\u7b7e\u540d\u7684\u5bc6\u94a5\u5bf9\u6765\u7b7e\u53d1\u8bc1\u4e66\u3002<\/p>\n<\/blockquote>\n
-in careq.pem<\/span><\/p>\n
\n
\u6307\u5b9a careq.pem<\/span> \u4e3a\u8bc1\u4e66\u8bf7\u6c42\u6587\u4ef6\u3002<\/p>\n<\/blockquote>\n
-out .\/demoCA\/cacert.pem<\/span><\/p>\n
\n
\u6307\u5b9a .\/demoCA\/cacert.pem<\/span> \u4e3a\u8f93\u51fa\u7684\u8bc1\u4e66\u3002<\/p>\n<\/blockquote>\n<\/blockquote>\n
\u8be5\u547d\u4ee4\u8981\u6c42\u7528\u6237\u8f93\u5165\u5bc6\u94a5\u53e3\u4ee4\u5e76\u8f93\u51fa\u76f8\u5173\u8bc1\u4e66\u4fe1\u606f\uff0c\u8bf7\u6c42\u7528\u6237\u786e\u8ba4\uff1a<\/p>\n
\n
Using configuration from \/usr\/lib\/ssl\/openssl.cnf
\nEnter pass phrase for .\/demoCA\/private\/cakey.pem:<enter your pass-phrase><\/b>
\nCheck that the request matches the signature
\nSignature ok
\nCertificate Details:
\n        Serial Number: 2 (0x2)
\n        Validity
\n            Not Before: Jan 16 13:05:09 2008 GMT
\n            Not After : Jan 15 13:05:09 2009 GMT
\n        Subject:
\n            countryName = CN
\n            stateOrProvinceName = ZJ
\n            organizationName = Some Ltd. Corp.
\n            organizationalUnitName = Some Unit
\n            commonName = Someone
\n            emailAddress = some@email.com
\n        X509v3 extensions:
\n            X509v3 Basic Constraints:
\n                CA:FALSE
\n            Netscape Comment:
\n                OpenSSL Generated Certificate
\n            X509v3 Subject Key Identifier:
\n                75:F5:3C:CC:C1:5E:6D:C3:8B:46:A8:08:E6:EA:29:E8:22:7E:70:03
\n            X509v3 Authority Key Identifier:
\n                keyid:75:F5:3C:CC:C1:5E:6D:C3:8B:46:A8:08:E6:EA:29:E8:22:7E:70:03<\/p>\n
Certificate is to be certified until Jan 15 13:05:09 2009 GMT (365 days)
\nSign the certificate? [y\/n]:y<\/b><\/p>\n
\n1 out of 1 certificate requests certified, commit? [y\/n]y<\/b>
\nWrite out database with 1 new entries
\nData Base Updated<\/span><\/p>\n<\/blockquote>\n
\u4e00\u6b65\u5b8c\u6210 CA \u8bc1\u4e66\u8bf7\u6c42\u751f\u6210\u53ca\u7b7e\u540d<\/h3>\n
\u4ee5\u4e0a\u4e24\u4e2a\u6b65\u9aa4\u53ef\u4ee5\u5408\u4e8c\u4e3a\u4e00\u3002\u5229\u7528 ca \u547d\u4ee4\u7684 -x509 <\/span>\u53c2\u6570\uff0c\u901a\u8fc7\u4ee5\u4e0b\u547d\u4ee4\u540c\u65f6\u5b8c\u6210\u8bc1\u4e66\u8bf7\u6c42\u751f\u6210\u548c\u7b7e\u540d\u4ece\u800c\u751f\u6210 CA \u6839\u8bc1\u4e66\uff1a<\/p>\n
\n
$ openssl req -new -x509 -days 365 -key .\/demoCA\/private\/cakey.pem -out .\/demoCA\/cacert.pem<\/span><\/p>\n<\/blockquote>\n
\u53c2\u6570\u89e3\u91ca<\/u><\/h4>\n
\n
req<\/span><\/p>\n
\n
\u7528\u4e8e\u751f\u6210\u8bc1\u4e66\u8bf7\u6c42\u7684 OpenSSL \u547d\u4ee4\u3002<\/p>\n<\/blockquote>\n
-new<\/span><\/p>\n
\n
\u751f\u6210\u4e00\u4e2a\u65b0\u7684\u8bc1\u4e66\u8bf7\u6c42\u3002\u8be5\u53c2\u6570\u5c06\u4ee4 OpenSSL \u5728\u8bc1\u4e66\u8bf7\u6c42\u751f\u6210\u8fc7\u7a0b\u4e2d\u8981\u6c42\u7528\u6237\u586b\u5199\u4e00\u4e9b\u76f8\u5e94\u7684\u5b57\u6bb5\u3002<\/p>\n<\/blockquote>\n
-x509<\/span><\/p>\n
\n
\u751f\u6210\u4e00\u4efd X.509 \u8bc1\u4e66\u3002<\/p>\n<\/blockquote>\n
-days 365<\/span><\/p>\n
\n
\u4ece\u751f\u6210\u4e4b\u65f6\u7b97\u8d77\uff0c\u8bc1\u4e66\u65f6\u6548\u4e3a 365 \u5929\u3002<\/p>\n<\/blockquote>\n
-key .\/demoCA\/private\/cakey.pem<\/span><\/p>\n
\n
\u6307\u5b9a cakey.pem<\/span> \u4e3a\u8bc1\u4e66\u6240\u4f7f\u7528\u7684\u5bc6\u94a5\u5bf9\u6587\u4ef6\u3002<\/p>\n<\/blockquote>\n
-out .\/demoCA\/cacert.pem<\/span><\/p>\n
\n
\u4ee4\u751f\u6210\u7684\u8bc1\u4e66\u4fdd\u5b58\u5230\u6587\u4ef6 .\/demoCA\/cacert.pem<\/span> \u3002<\/p>\n<\/blockquote>\n<\/blockquote>\n
\u8be5\u547d\u4ee4\u8f93\u51fa\u5982\u4e0b\uff0c\u7528\u6237\u5e94\u8f93\u5165\u76f8\u5e94\u7684\u5b57\u6bb5\uff1a<\/p>\n
\n
Enter pass phrase for .\/demoCA\/private\/cakey.pem:
\nYou are about to be asked to enter information that will be incorporated
\ninto your certificate request.
\nWhat you are about to enter is what is called a Distinguished Name or a DN.
\nThere are quite a few fields but you can leave some blank
\nFor some fields there will be a default value,
\nIf you enter '.', the field will be left blank.
\n-----
\nCountry Name (2 letter code) [AU]:CN<\/b>
\nState or Province Name (full name) [Some-State]:ZJ<\/b>
\nLocality Name (eg, city) []:HZ<\/b>
\nOrganization Name (eg, company) [Internet Widgits Pty Ltd]:Some Ltd. Corp.<\/b>
\nOrganizational Unit Name (eg, section) []:Some Unit<\/b>
\nCommon Name (eg, YOUR name) []:Someone<\/b>
\nEmail Address []:some@email.com<\/b><\/span><\/p>\n<\/blockquote>\n
\u81f3\u6b64\uff0c\u6211\u4eec\u4fbf\u5df2\u6210\u529f\u5efa\u7acb\u4e86\u4e00\u4e2a\u79c1\u6709\u6839 CA \u3002\u5728\u8fd9\u4e2a\u8fc7\u7a0b\u4e2d\uff0c\u6211\u4eec\u83b7\u5f97\u4e86\u4e00\u4efd CA \u5bc6\u94a5\u5bf9\u6587\u4ef6 .\/demoCA\/private\/cakey.pem<\/span> \u4ee5\u53ca\u4e00\u4efd\u7531\u6b64\u5bc6\u94a5\u5bf9\u7b7e\u540d\u7684 CA \u6839\u8bc1\u4e66\u6587\u4ef6 .\/demoCA\/cacert.pem<\/span> \uff0c\u5f97\u5230\u7684 CA \u76ee\u5f55\u7ed3\u6784\u5982\u4e0b\uff1a<\/p>\n
.<\/span>

\n|-- careq.pem<\/span>

\n`-- demoCA\/<\/span>

\n    |-- cacert.pem
\n    |-- index.txt<\/span>

\n    |-- index.txt.attr<\/span>

\n    |-- index.txt.old<\/span>

\n    |-- newcerts\/<\/span>

\n    |   `-- 01.pem<\/span>

\n    |-- private\/<\/span>

\n    |   `-- cakey.pem<\/span>

\n    |-- serial<\/span>

\n    `-- serial.old<\/span><\/span><\/p>\n
\u6ce8\uff1a\u5982\u679c\u5728 CA \u5efa\u7acb\u8fc7\u7a0b\u4e2d\u8df3\u8fc7\u8bc1\u4e66\u8bf7\u6c42\u751f\u6210\u7684\u6b65\u9aa4\uff0c\u5219\u4e0d\u4f1a\u4ea7\u751f careq.pem<\/span> \u6587\u4ef6\u3002<\/p>\n
\u7b7e\u53d1\u8bc1\u4e66<\/h2>\n
\u4e0b\u9762\u6211\u4eec\u5c31\u53ef\u4ee5\u5229\u7528\u5efa\u7acb\u8d77\u6765\u7684 CA \u8fdb\u884c\u8bc1\u4e66\u7b7e\u53d1\u4e86\u3002<\/p>\n
\u751f\u6210\u7528\u6237\u8bc1\u4e66 RSA \u5bc6\u94a5\u5bf9<\/h3>\n
\u53c2\u7167 CA \u7684 RSA \u5bc6\u94a5\u5bf9\u751f\u6210\u8fc7\u7a0b\uff0c\u4f7f\u7528\u5982\u4e0b\u547d\u4ee4\u751f\u6210\u65b0\u7684\u5bc6\u94a5\u5bf9\uff1a<\/p>\n
\n
$ openssl genrsa -des3 -out userkey.pem
\nGenerating RSA private key, 512 bit long modulus
\n....++++++++++++
\n...++++++++++++
\ne is 65537 (0x10001)
\nEnter pass phrase for userkey.pem:<enter your pass-phrase><\/b>
\nVerifying - Enter pass phrase for userkey.pem:<re-enter your pass-phrase><\/b><\/span><\/p>\n<\/blockquote>\n
\u751f\u6210\u7528\u6237\u8bc1\u4e66\u8bf7\u6c42<\/h3>\n
\u53c2\u7167 CA \u7684\u8bc1\u4e66\u8bf7\u6c42\u751f\u6210\u8fc7\u7a0b\uff0c\u4f7f\u7528\u5982\u4e0b\u547d\u4ee4\u751f\u6210\u65b0\u7684\u8bc1\u4e66\u8bf7\u6c42\uff1a<\/p>\n
\n
$ openssl req -new -days 365 -key userkey.pem -out userreq.pem
\nEnter pass phrase for userkey.pem:<enter your pass-phrase><\/span>
\nYou are about to be asked to enter information that will be incorporated
\ninto your certificate request.
\nWhat you are about to enter is what is called a Distinguished Name or a DN.
\nThere are quite a few fields but you can leave some blank
\nFor some fields there will be a default value,
\nIf you enter '.', the field will be left blank.
\n-----
\nCountry Name (2 letter code) [AU]:CN<\/span>
\nState or Province Name (full name) [Some-State]:ZJ<\/span>
\nLocality Name (eg, city) []:HZ<\/span>
\nOrganization Name (eg, company) [Internet Widgits Pty Ltd]:Some Ltd. Corp.<\/span>
\nOrganizational Unit Name (eg, section) []:Some Other Unit<\/span>
\nCommon Name (eg, YOUR name) []:Another<\/span>
\nEmail Address []:another@email.com<\/span><\/p>\n
Please enter the following 'extra' attributes
\nto be sent with your certificate request
\nA challenge password []:
\nAn optional company name []:<\/span><\/p>\n<\/blockquote>\n
\u7b7e\u53d1\u7528\u6237\u8bc1\u4e66<\/h3>\n
\u73b0\u5728\uff0c\u6211\u4eec\u53ef\u4ee5\u7528\u5148\u524d\u5efa\u7acb\u7684 CA \u6765\u5bf9\u7528\u6237\u7684\u8bc1\u4e66\u8bf7\u6c42\u8fdb\u884c\u7b7e\u540d\u6765\u4e3a\u7528\u6237\u7b7e\u53d1\u8bc1\u4e66\u4e86\u3002\u4f7f\u7528\u5982\u4e0b\u547d\u4ee4\uff1a<\/p>\n
$ openssl ca -in userreq.pem -out usercert.pem<\/span><\/p>\n
\u53c2\u6570\u89e3\u91ca<\/u><\/h4>\n
ca<\/span><\/p>\n
\n
\u7528\u4e8e\u6267\u884c CA \u76f8\u5173\u64cd\u4f5c\u7684 OpenSSL \u547d\u4ee4\u3002<\/p>\n<\/blockquote>\n
-in userreq.pem<\/span><\/p>\n
\n
\u6307\u5b9a\u7528\u6237\u8bc1\u4e66\u8bf7\u6c42\u6587\u4ef6\u4e3a userreq.pem<\/span> \u3002<\/p>\n<\/blockquote>\n
-out usercert.pem<\/span><\/p>\n
\n
\u6307\u5b9a\u8f93\u51fa\u7684\u7528\u6237\u8bc1\u4e66\u6587\u4ef6\u4e3a usercert.pem<\/span> \u3002<\/p>\n<\/blockquote>\n
\u8be5\u547d\u4ee4\u8981\u6c42\u7528\u6237\u8f93\u5165\u5bc6\u94a5\u53e3\u4ee4\u5e76\u8f93\u51fa\u76f8\u5173\u8bc1\u4e66\u4fe1\u606f\uff0c\u8bf7\u6c42\u7528\u6237\u786e\u8ba4\uff1a<\/p>\n
Using configuration from \/usr\/lib\/ssl\/openssl.cnf
\nEnter pass phrase for .\/demoCA\/private\/cakey.pem:<enter your pass-phrase><\/span>
\nCheck that the request matches the signature
\nSignature ok
\nCertificate Details:
\n        Serial Number: 2 (0x2)
\n        Validity
\n            Not Before: Jan 16 14:50:22 2008 GMT
\n            Not After : Jan 15 14:50:22 2009 GMT
\n        Subject:
\n            countryName               = CN
\n            stateOrProvinceName       = ZJ
\n            organizationName          = Some Ltd. Corp.
\n            organizationalUnitName    = Some Other Unit
\n            commonName                = Another
\n            emailAddress              = another@email.com
\n        X509v3 extensions:
\n            X509v3 Basic Constraints:
\n                CA:FALSE
\n            Netscape Comment:
\n                OpenSSL Generated Certificate
\n            X509v3 Subject Key Identifier:
\n                97:E7:8E:84:B1:45:27:83:94:A0:DC:24:79:7B:83:97:99:0B:36:A9
\n            X509v3 Authority Key Identifier:
\n                keyid:D9:87:12:94:B2:20:C7:22:AB:D4:D5:DF:33:DB:84:F3:B0:4A:EC:A2<\/p>\n
Certificate is to be certified until Jan 15 14:50:22 2009 GMT (365 days)
\nSign the certificate? [y\/n]:y<\/span><\/p>\n
\n1 out of 1 certificate requests certified, commit? [y\/n]y<\/span>
\nWrite out database with 1 new entries
\nData Base Updated<\/span><\/span><\/p>\n
\u81f3\u6b64\uff0c\u6211\u4eec\u4fbf\u5b8c\u6210\u4e86 CA \u7684\u5efa\u7acb\u53ca\u7528\u6237\u8bc1\u4e66\u7b7e\u53d1\u7684\u5168\u90e8\u5de5\u4f5c\u3002<\/span>\u4e0d\u59a8\u628a\u6240\u6709 shell \u547d\u4ee4\u653e\u5230\u4e00\u8d77\u7eb5\u89c8\u4e00\u4e0b\uff1a<\/span> <\/p>\n
\n
# \u5efa\u7acb CA \u76ee\u5f55\u7ed3\u6784
\nmkdir -p .\/demoCA\/{private,newcerts}
\ntouch .\/demoCA\/index.txt
\necho 01 > .\/demoCA\/serial<\/p>\n
# \u751f\u6210 CA \u7684 RSA \u5bc6\u94a5\u5bf9
\nopenssl genrsa -des3 -out .\/demoCA\/private\/cakey.pem 2048<\/p>\n
# \u751f\u6210 CA \u8bc1\u4e66\u8bf7\u6c42
\nopenssl req -new -days 365 -key .\/demoCA\/private\/cakey.pem -out careq.pem<\/p>\n
# \u81ea\u7b7e\u53d1 CA \u8bc1\u4e66
\nopenssl ca -selfsign -in careq.pem -out .\/demoCA\/cacert.pem<\/p>\n
# \u4ee5\u4e0a\u4e24\u6b65\u53ef\u4ee5\u5408\u4e8c\u4e3a\u4e00
\nopenssl req -new -x509 -days 365 -key .\/demoCA\/private\/cakey.pem -out .\/demoCA\/cacert.pem<\/p>\n
# \u751f\u6210\u7528\u6237\u7684 RSA \u5bc6\u94a5\u5bf9
\nopenssl genrsa -des3 -out userkey.pem<\/p>\n
# \u751f\u6210\u7528\u6237\u8bc1\u4e66\u8bf7\u6c42
\nopenssl req -new -days 365 -key userkey.pem -out userreq.pem<\/p>\n
# \u4f7f\u7528 CA \u7b7e\u53d1\u7528\u6237\u8bc1\u4e66
\nopenssl ca -in userreq.pem -out usercert.pem<\/span><\/p>\n
# \u540a\u9500\u8bc1\u4e66\uff0c \u5176\u4e2dcrlexts \u6307\u5b9a\u662f\u5426\u5728\u540a\u9500\u8bc1\u4e66\u4e2d\u663e\u793a\u66f4\u65b0\u70b9<\/span>
\nopenssl ca -gencrl -crldays 365 -crlexts crl_ext -out %CRL_PATH% -config %DIR%openssl.cnf<\/span><\/p>\n<\/blockquote>\n
\u4e86\u89e3\u4e86\u8fd9\u4e9b\u57fa\u7840\u6b65\u9aa4\u4e4b\u540e\uff0c\u5c31\u53ef\u4ee5\u901a\u8fc7\u811a\u672c\u751a\u81f3 makefile \u7684\u65b9\u5f0f\u6765\u5c06\u8fd9\u4e9b\u5de5\u4f5c\u81ea\u52a8\u5316\u3002 CA.pl<\/span> \u548c CA.sh<\/span> \u4fbf\u662f\u5bf9 OpenSSL \u7684 CA \u76f8\u5173\u529f\u80fd\u7684\u7b80\u5355\u5c01\u88c5\uff0c\u5728 Debian \u7cfb\u7edf\u4e2d\uff0c\u5b89\u88c5\u4e86 OpenSSL \u540e\uff0c\u53ef\u4ee5\u5728 \/usr\/lib\/ssl\/misc\/<\/span> \u76ee\u5f55\u4e0b\u627e\u5230\u8fd9\u4e24\u4e2a\u6587\u4ef6\u3002\u800c makefile \u7684\u89e3\u51b3\u65b9\u6848\u5219\u53ef\u4ee5\u53c2\u8003\u8fd9\u91cc<\/a>\u3002<\/p>\n
\u53c2\u8003\u6587\u732e<\/h2>\n