CA机构的搭建
1、CA简介：
ca：Certificate Authority，证书颁发机构，也叫证书授权中心。CA主要职责是颁发和管理数字证书。其中心任务是颁发数字证书，并履行用户身份认证的责任。现阶段主要作为电子商务交易中受信任的第三方，承担公钥体系中公钥的合法性检验的责任。
2、公司自建CA实现架构：
1、使用openssl程序完成搭建；
2、需要构建角色：
1、CA服务器；
2、客户端pc；
3、电商web服务器；
3、构建CA的过程：
CA服务器上操作：
[root@localhost ~]# yum -y install openssl ：安装openssl，这是搭建的核心命令；
[root@localhost ~]# vim /etc/pki/tls/openssl.cnf
[CA_default]
dir ：ca的工作目录变量。被下方参数引用（注意：centos5上，此参数要改成绝对路径，不能用相对路径）；
certs ：证书存放位置；
crl_dir ：吊销证书的存放位置；
database ：索引文件数据库。签署的所有证书索引文件。自动生成；
new_certs_dir ：刚签署的证书存放位置；
certificate ：ca自己的证书位置；
serial ：下一个证书的编号；
crlnumber ：已吊销证书的证书编号；
crl ：当前正在使用的证书吊销列表文件；
private_key ：ca自己的私钥，安全性很高（可以加密私钥位置文件，让别人拿到也看不了。但是每次使用都得解密）；
RANDFILE ：随机种子数据文件；
x509_extensions ：用户证书；
name_opt ：
cert_opt ：
.........
自签证书默认使用期限
吊销期限
自签证书需要的交互式信息，如国家代码..
..........
：查看CA主配置文件，了解部分参数内容；
[root@localhost ~]# cd /etc/pki/CA/ :进入CA的工作目录；
[root@localhost CA]# (umask 077; openssl genrsa -out /etc/pki/CA/private/cakey.pem 2048)
Generating RSA private key, 2048 bit long modulus
................................................+++
....................................+++
e is 65537 (0x10001) ： 生成CA自己的私钥文件，cakey.pem。默认权限为600；
[root@localhost CA]# openssl req -new -x509 -key /etc/pki/CA/private/cakey.pem -out /etc/pki /CA/cacert.pem -days 365
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.‘, the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn ：国家代码；
State or Province Name (full name) []:beijing ：所在省份；
Locality Name (eg, city) [Default City]:beijing ：所在城市；
Organization Name (eg, company) [Default Company Ltd]:CA ：机构名称；
Organizational Unit Name (eg, section) []:manager ：部门名称；
Common Name (eg, your name or your server‘s hostname) []:ca.manager.com ：主机名称（重要）；
Email Address []:test@163.com ：邮箱地址；
[root@localhost CA]#
：根据私钥文件生成CA自签证书。CA给自己签发一个证书；
[root@localhost CA]# pwd
/etc/pki/CA
[root@localhost CA]# touch index.txt ：创建索引文件；
[root@localhost CA]# touch serial ：证书编号位置；
[root@localhost CA]# echo 01 > serial ：自定义开始证书编号；
[root@localhost CA]# touch crlnumber ：已吊销证书编号文件；
[root@localhost CA]# ll
：以上的三个文件，是CA配置文件中定义的文件名，必须手动创建出来；
ok，以上简单自建CA机构配置完毕；
4、为httpd服务签发证书：
有了自己的CA证书机构，现在测试给httpd服务器颁发一次证书；
操作位置：
CA服务器---192.168.57.172；
httpd服务器---192.168.57.175；
httpd服务器上操作：
[root@localhost ~]# cd /etc/httpd/
[root@localhost httpd]# mkdir ssl
[root@localhost httpd]# (umask 077; openssl genrsa -out httpd.key 1024)
Generating RSA private key, 1024 bit long modulus
......................++++++
..++++++
e is 65537 (0x10001) ：生成httpd私钥；
[root@localhost httpd]# mv httpd.key ssl/
[root@localhost httpd]# openssl req -new -key /etc/httpd/ssl/httpd.key -out /etc/httpd/ssl/httpd.csr -days 365
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.‘, the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:beijing
Locality Name (eg, city) [Default City]:beijing
Organization Name (eg, company) [Default Company Ltd]:test
Organizational Unit Name (eg, section) []:test
Common Name (eg, your name or your server‘s hostname) []:www.test.com
Email Address []:test@163.com
Please enter the following ‘extra‘ attributes
to be sent with your certificate request
A challenge password []: 空
An optional company name []: 空
[root@localhost httpd]# ：根据私钥，创建证书申请文件httpd.csr；
[root@localhost httpd]# scp /etc/httpd/ssl/httpd.csr 192.168.57.172:/tmp/
The authenticity of host ‘192.168.57.172 (192.168.57.172)‘ can‘t be established.
RSA key fingerprint is f3:c6:fd:6b:c8:66:56:15:c7:2e:88:07:b3:ff:4b:48.
Are you sure you want to continue connecting (yes/no)? y
Please type ‘yes‘ or ‘no‘: yes
Warning: Permanently added ‘192.168.57.172‘ (RSA) to the list of known hosts.
root@192.168.57.172‘s password:
httpd.csr 100% 688 0.7KB/s 00:00
[root@localhost httpd]# ：利用scp命令，将httpd证书申请文件复制到CA服务器上，有CA进行数字签名；
CA服务器上操作：
[root@localhost tmp]# openssl ca -in /tmp/httpd.csr -out /tmp/httpd.crt -days 365
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
The organizationName field needed to be the same in the
CA certificate (CA) and the request (test)
[root@localhost tmp]# ：报错了，这里说httpd申请里的机构名字跟CA证书里的机构名字不一样。原因就是CA配置文件中有策略定义必须要一样，编辑配置文件，关闭这些策略即可；
[root@localhost tmp]# vim /etc/pki/tls/openssl.cnf
[ policy_match ]
countryName = match
stateOrProvinceName = match
organizationName = match
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
：将match改成optional即可，如下：
[ policy_match ]
countryName = optional
stateOrProvinceName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
[root@localhost tmp]# openssl ca -in /tmp/httpd.csr -out /tmp/httpd.crt -days 365
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Mar 31 12:11:08 2015 GMT
Not After : Mar 30 12:11:08 2016 GMT
Subject:
countryName = cn
stateOrProvinceName = beijing
organizationName = test
organizationalUnitName = test
commonName = www.test.com
emailAddress = test@163.com
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
7E:01:A5:A2:66:F4:5A:8C:D5:A1:2F:6A:B1:86:B2:89:28:D4:24:4D
X509v3 Authority Key Identifier:
keyid:25:CE:A2:A1:00:A7:19:69:94:96:7C:4F:32:1C:C8:7E:2D:E1:85:0B
Certificate is to be certified until Mar 30 12:11:08 2016 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
[root@localhost tmp]# ：再次执行证书签发，生成httpd.crt证书文件。ok，没问题了；
[root@localhost tmp]# cat /etc/pki/CA/serial
02
[root@localhost tmp]# ll /etc/pki/CA/newcerts/
总用量 4
-rw-r--r--. 1 root root 3830 3月 31 20:11 01.pem
[root@localhost tmp]# ：查看CA证书编号和已颁发的证书；
[root@localhost tmp]# pwd
/tmp
[root@localhost tmp]# scp httpd.crt 192.168.57.175:/etc/httpd/ssl/
The authenticity of host ‘192.168.57.175 (192.168.57.175)‘ can‘t be established.
RSA key fingerprint is f3:c6:fd:6b:c8:66:56:15:c7:2e:88:07:b3:ff:4b:48.
Are you sure you want to continue connecting (yes/no)? y
Please type ‘yes‘ or ‘no‘: yes
Warning: Permanently added ‘192.168.57.175‘ (RSA) to the list of known hosts.
root@192.168.57.175‘s password:
httpd.crt 100% 3830 3.7KB/s 00:00
[root@localhost tmp]# ：将证书文件复制到httpd服务器的指定目录下面；
[root@localhost ssl]# pwd
/etc/httpd/ssl
[root@localhost ssl]#
[root@localhost ssl]#
[root@localhost ssl]# ll
总用量 12
-rw-r--r--. 1 root root 3830 3月 31 20:15 httpd.crt
-rw-r--r--. 1 root root 688 3月 31 19:23 httpd.csr
-rw-------. 1 root root 887 3月 31 19:20 httpd.key
[root@localhost ssl]# ：来到httpd服务器上，查看自己成功申请的证书；
ok，至此，简单的CA搭建和签证过程完成了。
本文出自 “linux运维集锦” 博客，请务必保留此出处http://5200linux.blog.51cto.com/6012970/1626756
原文地址：http://5200linux.blog.51cto.com/6012970/1626756
