创建私有CA并发放证书

Posted 2020-08-09

公司内部证书发放流程

1、自建私有CA主机1

openssl的配置文件：/etc/pki/tls/openssl.cnf

1）创建所需要的文件：cd /etc/pki/CA/

 touch index.txt

echo 01 > serial

[[email protected] CA]# tree
.
├── cacert.pem
├── certs
├── crl
├── index.txt
├── newcerts
│   ├── 01httpd.pem
│   └── 01.pem
├── private
│   └── cakey.pem
├── serial
└── serial.old

 

 

2）CA字签证书

#(umask 077 ;openssl genrsa -out private/cakey.pem 2048)

#openssl req -new -x509 -key private/cakey.pem -days 3650 -out  cacert.pem

-new:生成新证书签署请求

-x509：专用于CA生成自签证书

-key：生成请求时用到的私钥文件

-days ###：证书有效期限###

-out /PATH/TO/SOMEWCERTFILE ：证书保存路径

[[email protected] CA]# openssl x509 -in cacert.pem -noout -text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 15788607697337265536 (0xdb1c670c91c92d80)
    Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=cn, ST=hubei, L=hubei, O=longjingcun, OU=Ops, CN=lanin/[email protected]
        Validity
            Not Before: Sep 24 01:43:32 2016 GMT
            Not After : Sep 22 01:43:32 2026 GMT
        Subject: C=cn, ST=hubei, L=hubei, O=longjingcun, OU=Ops, CN=lanin/[email protected]
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:c2:3a:c0:a0:b2:fe:9b:0f:d5:91:43:31:e9:85:
                    47:a8:ad:b7:16:06:c7:04:6a:46:67:c4:41:e7:05:
                    6c:4b:8f:6a:dd:94:48:a5:04:93:20:cb:f6:ec:65:
                    b2:49:12:76:f3:e8:a5:b6:0c:80:0b:d9:ae:9d:23:
                    b1:3f:c3:6a:3c:00:d9:36:bb:da:4e:24:3b:71:f6:
                    f0:c5:28:2a:24:72:c9:ac:c8:6e:5a:aa:0c:21:60:
                    b5:f1:ff:3f:7c:d6:a8:a0:4c:42:b8:c1:f5:d5:de:
                    b7:37:be:38:6a:bf:6d:a1:0a:97:be:b9:22:25:d6:
                    6c:f0:fd:af:5e:27:aa:cf:7e:64:e9:8e:0d:a9:b0:
                    0b:5b:95:cd:20:7b:8d:23:64:2f:0a:07:86:2b:32:
                    2f:13:0b:66:f1:35:f3:75:37:c9:a0:3e:49:40:5f:
                    e6:6a:89:58:d4:77:c3:cc:db:aa:46:e3:8e:b1:3d:
                    d3:5b:22:bf:1e:4d:48:7f:a5:0b:eb:6e:a9:b7:5b:
                    e1:10:80:0d:7d:38:21:ac:60:a1:95:5e:2c:d7:72:
                    ee:b1:fd:52:df:70:a5:6f:6e:aa:4c:cb:82:bb:8c:
                    a7:0a:e8:b4:f7:ea:06:7a:fd:b3:00:b9:8c:6a:17:
                    7d:69:d7:c6:2f:83:c6:35:12:1c:f5:ff:d2:0a:cf:
                    1e:6d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                01:E4:14:ED:C7:E3:1A:24:17:DE:15:F2:45:D3:1C:FD:D4:E3:52:A3
            X509v3 Authority Key Identifier: 
                keyid:01:E4:14:ED:C7:E3:1A:24:17:DE:15:F2:45:D3:1C:FD:D4:E3:52:A3
 
            X509v3 Basic Constraints: 
                CA:TRUE
    Signature Algorithm: sha1WithRSAEncryption
         86:b8:78:0b:af:02:1b:de:4c:d8:fb:56:cc:3c:48:e8:0a:2a:
         f3:26:7e:33:b5:b0:3b:b8:b7:c1:66:aa:f2:a6:7a:42:82:6a:
         22:76:64:b3:5c:25:4f:c4:1e:24:0c:51:48:56:58:1d:ae:83:
         66:bf:50:6f:81:97:2e:69:3d:fa:35:c3:b0:0f:7f:2f:3f:40:
         99:be:1a:ca:5c:67:b6:7e:bd:b8:67:2d:62:42:8f:b3:fb:e2:
         c3:5f:80:fb:07:ab:69:10:db:5f:13:b3:61:bd:23:aa:f9:13:
         0b:1d:e6:df:98:37:51:a5:f9:9f:e8:e1:f5:13:a7:96:7c:c2:
         20:cf:b4:22:d3:d0:90:a2:65:a7:1f:b9:06:6a:5d:8e:00:ac:
         55:6b:cd:3a:10:e5:f0:3e:d3:9f:59:a8:f6:a9:2a:cd:70:a8:
         21:d7:7d:bc:41:a9:3a:66:13:3f:63:e3:be:fe:3d:be:7c:06:
         33:3e:f5:7e:e6:68:7f:a7:60:5d:f8:0a:80:a7:6d:3a:36:b0:
         97:71:7a:f5:2c:a1:35:d5:1a:f3:f3:a0:b3:34:58:88:39:36:
         fd:48:4b:2c:9b:20:b7:82:10:5d:77:ca:77:20:9c:39:94:bb:
         3a:9f:05:0a:54:66:62:f2:3a:c0:3a:1a:83:6b:78:11:d6:ee:
         f1:b7:78:59

2、发证

1）用到证书的主机2生成证书请求：

#(umask 077; openssl genrsa -out /etc/httpd/ssl/httpd.key 2048)

#openssl req -new -key /etc/httpd/ssl/httpd.key -days 365 -out /etc/httpd/ssl/httpd.csr

2）把请求文件传输给CA主机

#scp /etc/httpd/ssl/httpd.key [email protected]_IP:/tmp/

3）CA 签证，并发还给主机2

#openssl ca -in /tmp/httpd.csr -out /etc/pki/CA/certs/httpd.crt -days 365

#scp /etc/pki/CA/certs/httpd.crt [email protected]主机2_IP:/etc/httpd/ssl/

查看证书中的信息：

#openssl x509 -in /PATN/FROM/CERT_FILE -noout -text |-subject |-serial

3、吊销证书

1）客户端获取要吊销的证书serial

#openssl x509 -in /PATN/FROM/CERT_FILE -noout -serial

[[email protected] ~]# openssl x509 -in /etc/httpd/ssl/httpd.crt -noout -serial
serial=01
[[email protected] ~]# openssl x509 -in /etc/httpd/ssl/httpd.crt -noout -subject
subject= /C=cn/ST=hubei/O=longjingcun/OU=OP\x08ps/CN=lanli\x08\x08in/emailAddress=lani\[email protected]

2）CA

先根据客户提交的serial和subject信息，对比检验是否与index.txt 文件中的信息一致。

吊销证书：

#openssl ca -revoke /etc/pki/CA/newcerts/SERIAL.pem

 

3）生成吊销证书的编号（第一次吊销一个证书）

#echo 01 > /etc/pki/CA/crlnumber

 

4）更新证书吊销列表

#openssl ca -gencrl -out thiscrl.crl

查看吊销证书

#openssl crl -in /PATH/FROM/CRL_FILE.crl -noout -text

 

 

本文出自 “11460225” 博客，请务必保留此出处http://11470225.blog.51cto.com/11460225/1856023