 |
|
茫茫網海中的冷日
發生過的事，不可能遺忘，只是想不起來而已！ |
|
|
恭喜您是本站第 1671854
位訪客!
登入 | 註冊
|
|
|
|
對這文章發表回應
發表限制: 非會員 可以發表
發表者： 冷日 發表時間： 2010/12/6 7:50:14
openssl genrsa -des3 -out RootCA.key 2048
chmod og-rwx RootCA.key 看產生結果
[jonathan@pd920 ca]$ openssl genrsa -des3 -out RootCA.key 2048
Generating RSA private key, 2048 bit long modulus
..............................................+++
.+++
e is 65537 (0x10001)
Enter pass phrase for RootCA.key: <-- 設定 RootCA 密鑰的密碼
Verifying - Enter pass phrase for RootCA.key: <-- 再次輸入 RootCA 密鑰的密碼
[jonathan@pd920 ca]$ chmod og-rwx RootCA.key <-- 讓 RootCA 只有自己可以讀寫
openssl req -new -key RootCA.key -out RootCA.req 看產生結果
[jonathan@pd920 ca]$ openssl req -new -key RootCA.key -out RootCA.req
Enter pass phrase for RootCA.key: <-- 輸入 RootCA 密鑰的密碼
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:TW
State or Province Name (full name) [Berkshire]:Taiwan
Locality Name (eg, city) [Newbury]:Taipei
Organization Name (eg, company) [My Company Ltd]:Trysoft Corp.
Organizational Unit Name (eg, section) []: <-- 可以不輸入
Common Name (eg, your name or your server's hostname) []: <-- 不是當 Server 憑證不需要輸入
Email Address []:tryweb@ichiayi.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []: <-- 可以不輸入
An optional company name []: <-- 可以不輸入
[jonathan@pd920 ca]$
openssl x509 -req -days 3650 -sha1 -extensions v3_ca -signkey RootCA.key -in RootCA.req -out RootCA.crt
rm -f RootCA.req 看產生結果
[jonathan@pd920 ca]$ openssl x509 -req -days 3650 -sha1 -extensions v3_ca -signkey RootCA.key -in RootCA.req -out RootCA.crt
Signature ok
subject=/C=TW/ST=Taiwan/L=Taipei/O=Trysoft Corp./emailAddress=tryweb@ichiayi.com
Getting Private key
Enter pass phrase for RootCA.key: <-- 輸入 RootCA 密鑰的密碼
[jonathan@pd920 ca]$ rm -f RootCA.req
openssl genrsa -out ServerCA.key 2048
chmod og-rwx ServerCA.key 看產生結果
[jonathan@pd920 ca]$ openssl genrsa -out ServerCA.key 2048
Generating RSA private key, 2048 bit long modulus
.............................................+++
...........................................................................................................+++
e is 65537 (0x10001)
不會出現輸入密碼的訊息，因為 Server CA 不需要輸入密碼，否則啟動 Service 時會需要輸入密碼後，才可繼續執行服務
openssl req -new -key ServerCA.key -out ServerCA.req 看產生結果
[jonathan@pd920 ca]$ openssl req -new -key ServerCA.key -out ServerCA.req
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:TW
State or Province Name (full name) [Berkshire]:Taiwan
Locality Name (eg, city) [Newbury]:Taipei
Organization Name (eg, company) [My Company Ltd]:Trysoft Corp.
Organizational Unit Name (eg, section) []: <-- 可以不輸入
Common Name (eg, your name or your server's hostname) []:mail.ichiayi.com <-- 輸入 Server 的 Domain Name
Email Address []:tryweb@ichiayi.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []: <-- 可以不輸入
An optional company name []: <-- 可以不輸入
openssl x509 -req -days 730 -sha1 -extensions v3_req -CA RootCA.crt -CAkey RootCA.key -CAserial RootCA.srl -CAcreateserial -in ServerCA.req -out ServerCA.crt
rm -f ServerCA.req 看產生結果
[jonathan@pd920 ca]$ openssl x509 -req -days 730 -sha1 -extensions v3_req -CA RootCA.crt -CAkey RootCA.key -CAserial RootCA.srl -CAcreateserial -in ServerCA.req -out ServerCA.crt
Signature ok
subject=/C=TW/ST=Taiwan/L=Taipei/O=Trysoft Corp./CN=mail.ichiayi.com/emailAddress=tryweb@ichiayi.com
Getting CA Private Key
Enter pass phrase for RootCA.key: <-- 輸入 RootCA 密鑰的密碼
[jonathan@pd920 ca]$ rm -f ServerCA.req
openssl genrsa -des3 -out ClientCA.key 2048
chmod og-rwx ClientCA.key 看產生結果
[jonathan@pd920 ca]$ openssl genrsa -des3 -out ClientCA.key 2048
Generating RSA private key, 2048 bit long modulus
...........+++
................................................+++
e is 65537 (0x10001)
Enter pass phrase for ClientCA.key: <- 設定用戶憑證密碼
Verifying - Enter pass phrase for ClientCA.key: <- 再次輸入確認密碼
[jonathan@pd920 ca]$ chmod og-rwx ClientCA.key
openssl req -new -key ClientCA.key -out ClientCA.req 看產生結果
[jonathan@pd920 ca]$ openssl req -new -key ClientCA.key -out ClientCA.req
Enter pass phrase for ClientCA.key: <- 輸入用戶憑證密碼
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:TW
State or Province Name (full name) [Berkshire]:Taiwan
Locality Name (eg, city) [Newbury]:Taipei
Organization Name (eg, company) [My Company Ltd]:Trysoft Corp.
Organizational Unit Name (eg, section) []:Tech.
Common Name (eg, your name or your server's hostname) []:Jonathan Tsai
Email Address []:jonathan@ichiayi.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []: <-- 可以不輸入
An optional company name []: <-- 可以不輸入
openssl x509 -req -days 730 -sha1 -extensions v3_req -CA RootCA.crt -CAkey RootCA.key -CAserial RootCA.srl -CAcreateserial -in ClientCA.req -out ClientCA.crt
rm -f ClientCA.req 看產生結果
[jonathan@pd920 ca]$ openssl x509 -req -days 730 -sha1 -extensions v3_req -CA RootCA.crt -CAkey RootCA.key -CAserial RootCA.srl -CAcreateserial -in ClientCA.req -out ClientCA.crt
Signature ok
subject=/C=TW/ST=Taiwan/L=Taipei/O=Trysoft Corp./OU=Tech./CN=Jonathan Tsai/emailAddress=jonathan@ichiayi.com
Getting CA Private Key
Enter pass phrase for RootCA.key: <-- 輸入 RootCA 密鑰的密碼
[jonathan@pd920 ca]$ rm -f ClientCA.req
openssl pkcs12 -export -in ClientCA.crt -inkey ClientCA.key -out ClientCA.pfx 看產生結果
[jonathan@pd920 ca]$ openssl pkcs12 -export -in ClientCA.crt -inkey ClientCA.key -out ClientCA.pfx
Enter pass phrase for ClientCA.key: <-- 輸入用戶憑證密碼
Enter Export Password: <-- 設定匯出用戶憑證時的密碼, 可以和用戶憑證密碼相同
Verifying - Enter Export Password: <-- 輸入確認匯出用戶憑證時的密碼
[root@pd920 httpd]# cat ssl_request_log
[20/Aug/2008:16:28:12 +0800] 192.168.11.248 TLSv1 RC4-MD5 "GET /t.txt HTTP/1.1" 25 <-- IE7
[20/Aug/2008:16:46:14 +0800] 192.168.11.248 SSLv3 DHE-RSA-AES256-SHA "GET /t.txt HTTP/1.1" 25 <-- Firefox3
[21/Aug/2008:12:18:55 +0800] 127.0.0.1 TLSv1 DHE-RSA-AES256-SHA "GET /t.txt HTTP/1.1" 5 <-- cURL 7.15.5
[root@pd920 httpd]#
原文出處： OpenSSL 簽發憑證方式 [蔡宗融個人網站]
|
