OpenSSL证书申请
1、PKI: Public Key Infrastructure
- CA 证书颁发机构
- RA 证书请求机构 request
- CRL
2、建立私有CA: 搭建CA
- OpenCA
- openssl
3、证书申请及签署步骤:
- 1、生成申请请求 后缀位csr
- 2、 RA核验
- 3、 CA签署
- 4、获取证书
创建CA和申请证书
创建私有CA:
[root@centos7-4 ~]# cd /etc/pki/tls/
[root@centos7-4 tls]# ls
cert.pem certs misc openssl.cnf private
*******openssl的配置文件: /etc/pki/tls/openssl.cnf CA重要配置文件******
三种策略: 匹配、支持和可选
匹配指要求申请填写的信息跟CA设置信息必须一致, 支持指必须填写这项申请信息, 可选指可有可无
openssl.cnf文件中和证书相关的项目有
[root@centos7-4 tls]# vim openssl.cnf
[ ca ] #default_ca默认ca 为 CA_default
default_ca = CA_default # The default ca section
[ CA_default ]
dir = /etc/pki/CA # Where everything is kept (CA的工作目录)
certs = $dir/certs # Where the issued certs are kept (颁发证书的目录)
crl_dir = $dir/crl # Where the issued crl are kept (证书吊销列表目录)
database = $dir/index.txt # database index file. (证书数据库索引文件目录)
index.txt 文件默认不存在 需要手工创建,其中的内容由CA自动生成
new_certs_dir = $dir/newcerts # default place for new certs. (新证书的存放路径)
certificate = $dir/cacert.pem # The CA certificate ( CA的根证书存放文件)
serial = $dir/serial # The current serial number (证书编号 16进制)
crlnumber = $dir/crlnumber # the current crl number (吊销证书编号存放处)
crl = $dir/crl.pem # The current CRL (证书吊销列表文件)
private_key = $dir/private/cakey.pem # The private key ( CA证书私钥)后缀必须命名为cakey.pem)
RANDFILE = $dir/private/.rand # private random number file ( 随机文件不重要)
default_days = 365 # how long to certify for (证书默认有效期)
default_crl_days= 30 # how long before next (CRL吊销列表有效期发布时间)
default_md = default # use public key default MD ( 默认公钥机密机制为MD5)
preserve = no # keep passed DN ordering ( 不重要)
CA策略问题 很重要
[ policy_match ]
countryName = match(CA所在的国家和客户端必须相同)
stateOrProvinceName = match(省必须相同)
organizationName = match (组织必须相同)
organizationalUnitName = optional (部门)
commonName = supplied (给谁颁发的证书必须填)
emailAddress = optional (邮箱可选)
创建CA
1、创建所需要的文件
[root@centos7-4 CA]# touch /etc/pki/CA/index.txt
生成证书索引数据库文件 (默认为空文件)
[root@centos7-4 CA]# echo 01 > /etc/pki/CA/serial
指定第一个颁发证书的序列号
2、 CA自签证书
生成私钥
- cd /etc/pki/CA/
- (umask 066; openssl genrsa -out /etc/pki/CA/private/cakey.pem 2048)
[root@centos7-4 ~]# cd /etc/pki/CA/
[root@centos7-4 CA]# (umask 077;openssl genrsa -out /etc/pki/CA/private/cakey.pem 2048)
Generating RSA private key, 2048 bit long modulus
.......................................................................................+++
...................................+++
生成自签名证书
- openssl req -new -x509 –key(私钥的文件名)
- /etc/pki/CA/private/cakey.pem -days 7300 -out
- /etc/pki/CA/cacert.pem
- -new: 生成新证书签署请求
- -x509: 专用于CA生成自签证书
- -key: 生成请求时用到的私钥文件 (private下的cakey.pem文件名)
- -days n:证书的有效期限
- -out /PATH/TO/SOMECERTFILE: 证书的保存路径
[root@centos7-4 CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 3650
Country Name (2 letter code) [XX]:CN ##国家
State or Province Name (full name) []:beijing ##省份
Locality Name (eg, city) [Default City]:beijing ##城市
Organization Name (eg, company) [Default Company Ltd]:magedu ##机构
Organizational Unit Name (eg, section) []:opt
Common Name (eg, your name or your server's hostname) []:ca.magedu.com
Email Address []:
[root@centos7-4 CA]# ll
total 4
-rw-r--r-- 1 root root 1322 Oct 5 11:12 cacert.pem
drwxr-xr-x. 2 root root 6 Aug 4 2017 certs
drwxr-xr-x. 2 root root 6 Aug 4 2017 crl
drwxr-xr-x. 2 root root 6 Aug 4 2017 newcerts
drwx------. 2 root root 23 Oct 5 11:07 private
同时也可以把CA证书导出到windows中
[root@centos7-4 CA]# sz cacert.pem
rz
Starting zmodem transfer. Press Ctrl+C to cancel.
Transferring cacert.pem...
100% 1 KB 1 KB/sec 00:00:01 0 Errors
导出后修改文件后缀:cacert.pem.crt
[root@centos7-4 CA]# openssl x509 -in cacert.pem -noout -text
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
d4:a9:a8:07:a3:d3:fd:13
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=CN, ST=beijing, L=beijing, O=magedu, OU=opt, CN=ca.magedu.com
Validity
Not Before: Oct 5 03:12:54 2018 GMT
Not After : Oct 2 03:12:54 2028 GMT
Subject: C=CN, ST=beijing, L=beijing, O=magedu, OU=opt, CN=ca.magedu.com
***********************************查看已经存在的CA证书*************************
客户端向服务器申请证书
3、颁发证书
1、在需要使用证书的主机生成证书请求
给web服务器生成私钥
(umask 066; openssl genrsa -out /etc/pki/tls/private/test.key 2048)
例子:生成私钥的目录可以根据需求放置
[root@centos6-10 /etc/httpd 07:17:49]#(umask 066;openssl genrsa -out app.key 1024)
Generating RSA private key, 1024 bit long modulus
....................................................................++++++
....................++++++
e is 65537 (0x10001)
2、生成证书申请文件
openssl req -new -key /etc/pki/tls/private/test.key -days 365 -out etc/pki/tls/text.csr
[root@centos6-10 /etc/httpd 07:19:57]#openssl req -new -key app.key -out app.csr
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:beijing
Locality Name (eg, city) [Default City]:beijing
Organization Name (eg, company) [Default Company Ltd]:magedu
Organizational Unit Name (eg, section) []:opt
Common Name (eg, your name or your server's hostname) []:www.bgg.com
Email Address []:
***********注意:客户端向服务器申请证书时,填写的国家、省份、组织,必须和CA证书相同
[root@centos6-10 /etc/httpd 07:23:06]#ls
app.csr app.key
3、将证书请求文件传输给CA服务器
[root@centos6-10 /etc/httpd 07:25:32]#scp app.csr 192.168.161.130:/etc/pki/CA
[email protected]'s password:
app.csr 100% 647 0.6KB/s 00:00
4、CA签署证书,并将证书颁发给请求者
[root@centos7-4 CA]# openssl ca -in app.csr -out certs/app.crt -days 360
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Oct 5 06:15:04 2018 GMT
Not After : Sep 30 06:15:04 2019 GMT
Subject:
countryName = CN
stateOrProvinceName = beijing
organizationName = magedu
organizationalUnitName = opt
commonName = www.bgg.com
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
62:B6:BA:94:C0:24:F1:B1:A1:37:20:C1:25:59:DA:A9:FA:65:C2:B1
X509v3 Authority Key Identifier:
keyid:45:26:FF:3F:81:CF:80:5C:35:C5:4D:FB:E2:DE:DA:6E:63:35:9A:4E
Certificate is to be certified until Sep 30 06:15:04 2019 GMT (360 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
[root@centos7-4 CA]# tree
.
├── app.csr
├── cacert.pem
├── certs
│ └── app.crt
├── crl
├── index.txt
├── index.txt.attr
├── index.txt.old
├── newcerts
│ └── 01.pem
├── private
│ └── cakey.pem
├── serial
└── serial.old
注意:默认国家,省,公司名称三项必须和CA一致
[root@centos7-4 CA]# sz certs/app.crt
rz
Starting zmodem transfer. Press Ctrl+C to cancel.
Transferring app.crt...
100% 3 KB 3 KB/sec 00:00:01 0 Errors
导出到windows中
如果默认国家,省,公司名称三项必须和CA不一致,我们可以修改策略来解决证书颁发问题
[root@centos7-4 tls]# vim /etc/pki/tls/openssl.cnf ##修改策咯
[ policy_match ]
countryName = match ##改为optional
stateOrProvinceName = match ##改为optional
organizationName = match
organizationalUnitName = optional
********************************证书颁发完成*************************************
5、吊销证书
3、吊销证书:openssl ca -revoke /etc/pki/CA/newcerts/01.pem
[root@centos7-4 CA]# openssl ca -revoke newcerts/01.pem
4、指定第一个吊销证书的编号,注意:第一次更新证书吊销列表前,才需要执行 echo 01 > /etc/pki/CA/crlnumber
[root@centos7-4 CA]# echo 01 > /etc/pki/CA/crlnumber
5、更新证书吊销列表
[root@centos7-4 CA]# openssl ca -gencrl -out /etc/pki/CA/crl.pem
6、查看crl吊销列表文件:
[root@centos7-4 CA]# openssl crl -in /etc/pki/CA/crl.pem -noout -text