码迷,mamicode.com
首页 > 其他好文 > 详细

实验:CentOS下构建私有CA

时间:2018-08-11 16:20:43      阅读:175      评论:0      收藏:0      [点我收藏+]

标签:.com   count   password   gui   建立   known   签证   pem   查看   

一、建立一CA颁发主机(机构)
1、生成私钥;2、自签证书

[root@www1 ~]# (umask 077;openssl genrsa -out /etc/pki/CA/private/cakey.pem 4096)
Generating RSA private key, 4096 bit long modulus
..............................++
....++
e is 65537 (0x10001)

[root@www1 ~]# openssl req -new -x509 -key /etc/pki/CA/private/cakey.pem -out
/etc/pki/CA/cacert.pem -days 360

Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:GuangXi
Locality Name (eg, city) [Default City]:GuiLin
Organization Name (eg, company) [Default Company Ltd]:jinglin
Organizational Unit Name (eg, section) []:IT
Common Name (eg, your name or your server‘s hostname) []:ca.jinglin.com
Email Address []:caadmin@jinglin.com #可留空
[root@www1 ~]# ls /etc/pki/CA/
cacert.pem certs crl newcerts private
[root@www1 ~]# touch /etc/pki/CA/{serial,index.txt} #为CA提供所需的目录及文件
[root@www1 ~]# echo 01 > /etc/pki/CA/serial

二、向CA主机请求签署证书
1、生成私钥;2、生成证书签署请求,3、将请求(通过可靠方式)发送给CA主机;4、CA主机签署证书

[root@localhost httpd]# mkdir ssl #以httpd为例,创建一目录,
[root@localhost httpd]# cd ssl/
[root@localhost ssl]# (umask 077; openssl genrsa -out httpd.key 2048)
Generating RSA private key, 2048 bit long modulus
.+++
...............+++
e is 65537 (0x10001)

[root@localhost ssl]# openssl req -new -key httpd.key -out httpd.csr -days 365

Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:GuangXi
Locality Name (eg, city) [Default City]:GuiLin
Organization Name (eg, company) [Default Company Ltd]:jinglin
Organizational Unit Name (eg, section) []:IT
Common Name (eg, your name or your server‘s hostname) []:www.jinglin.com
Email Address []:webmaster@jinglin.com

Please enter the following ‘extra‘ attributes
to be sent with your certificate request
A challenge password []:123456
An optional company name []:123456
[root@localhost ssl]# scp httpd.csr root@172.16.128.67:/tmp/

[root@www1 ~]# openssl ca -in /tmp/httpd.csr -out /etc/pki/CA/certs/httpd.crt -days 365
[root@www1 ~]# cd /etc/pki/CA/
[root@www1 CA]# cat index.txt
V 190802095707Z 01 unknown /C=CN/ST=GuangXi/O=jinglin/OU=ca.jinglin.com/CN=www.jinglin.org/emailAddress=webmaster@jinglin.org
[root@www1 CA]# scp certs/httpd.crt root@172.16.128.9:/etc/httpd/ssl/ #签完后发回,然后删除两台主机上的httpd.csr

[root@localhost ssl]# openssl x509 -in httpd.crt -noout -serial -subject #查看证书信息
serial=01
subject= /C=CN/ST=GuangXi/O=jinglin/OU=ca.jinglin.com/CN=www.jinglin.org/emailAddress=webmaster@jinglin.org

私有CA构建完成

实验:CentOS下构建私有CA

标签:.com   count   password   gui   建立   known   签证   pem   查看   

原文地址:http://blog.51cto.com/10201808/2158019

(0)
(0)
   
举报
评论 一句话评论(0
登录后才能评论!
© 2014 mamicode.com 版权所有  联系我们:gaon5@hotmail.com
迷上了代码!