rhel6.3下使用openssl来生成CA证书并颁发证书实例解

• 一、配置OPENSSL

[root@test1 /]#rpm -qa|grep openssl

openssl-1.0.0-20.el6_2.5.i686

[root@test1 /]# cd/etc/pki/tls

[root@test1 tls]#ls

cert.pem certs misc openssl.cnf private

[root@test1 tls]#vim openssl.cnf

####################################################################

[ CA_default ]

Dir = /etc/pki/CA #(CA中心的目录)

Certs = $dir/certs # (证书保存目录)

crl_dir = $dir/crl #(被吊销证书的目录)

database = $dir/index.txt # (证书索引文件)

#unique_subject =no #Set to 'no' to allow creation of

# severalctificates with same subject.

new_certs_dir = $dir/newcerts #(经过CA中心签名的证书备份目录)

certificate =$dir/my-ca.crt # (CA的用于签名的证书)

serial =$dir/serial #(CA中心的颁发证书序列号)

crlnumber =$dir/crlnumber #(已吊销证书序列号)

# must becommented out to leave a V1 CRL

crl =$dir/my-ca.crl
#证书吊销列表

private_key =$dir/private/my-ca.key # CA私钥文件

RANDFILE =$dir/private/.rand
# private random number file

x509_extensions =usr_cert # The extentions to add to the cert

default_days =365 #证书有效期

default_crl_days = 30 # how long before next CRL

default_md =default #
use public key default MD

preserve =no
# keep passed DN ordering

[ policy_match ] #此段为证书相关信息选项，其中match指定的项，要求被签名证书一定要与CA的对应项一致。

countryName =match

stateOrProvinceName = match

organizationName = match

organizationalUnitName = optional

commonName =supplied

emailAddress =optional

[req_distinguished_name ]

countryName = Country Name (2 letter code)

countryName_default =CN （国家代码需要自己修改）

countryName_min =2

countryName_max = 2

stateOrProvinceName =State or Province Name (full name)

stateOrProvinceName_default =Hebei （州或省名需要自己修改）

localityName = Locality Name (eg, city)

localityName_default =Beijing（地点名称需要自己修改）

0.organizationName =Organization Name (eg, company)

0.organizationName_default =Tianli(组织或公司名需要自己修改)

[root@test1 tls]#cd ../CA/

[root@test1 CA]#ls

certs crl newcerts private

注：需要有这几个目录，如果没有可以自己新建

[root@test1 CA]#touch index.txt

[root@test1 CA]#echo "00"> serial

[root@test1 CA]#ls

certs crl index.txt newcerts private serial

二、创建密钥过程

创建私钥

[root@test1CA]#(umask 077;openssl genrsa -out private/my-ca.key -des3 2048)

Generating RSAprivate key, 2048 bit long modulus

............................................................+++

..........+++

e is 65537(0x10001)

Enter pass phrasefor private/my-ca.key:

Verifying - Enterpass phrase for private/my-ca.key:

由私钥生成公钥

[root@test1CA]#openssl req -new -x509 -key private/my-ca.key -days 365 > my-ca.crt

Enter pass phrasefor private/my-ca.key:

You are about tobe asked to enter information that will be incorporated

into yourcertificate request.

What you are aboutto enter is what is called a Distinguished Name or a DN.

There are quite afew fields but you can leave some blank

For some fieldsthere will be a default value,

If you enter '.',the field will be left blank.

-----

Country Name (2letter code) [CN]:CN

State or ProvinceName (full name) []:Hebei

Locality Name (eg,city) [Beijing]:Beijing

Organization Name(eg, company) [Default Company Ltd]:Tianli Company

OrganizationalUnit Name (eg, section) []:

Common Name (eg,your name or your server's hostname) []:test1

Email Address []:

[root@test1 CA]#ls

certs crl index.txt my-ca.crt newcerts private serial

三、客户端验证CA服务

主机端(192.168.1.130)上：

[root@test1CA]#yum -y install httpd

[root@test1CA]#service httpd start

[root@test1CA]#mkdir -p /var/www/html/yum

[root@test1 CA]#cpmy-ca.crt /var/www/html/yum 将my-ca.crt,即公钥放到http服务器，供其他人下载

另外客户端(192.168.1.117)上：

[root@test2Desktop]#openssl genrsa 1024 > test2.key

Generating RSAprivate key, 1024 bit long modulus

.....................++++++

.......++++++

e is 65537(0x10001)

[root@test2Desktop]#openssl req -new -key test2.key -out dovecot.csr

You are about tobe asked to enter information that will be incorporated

into yourcertificate request.

What you are aboutto enter is what is called a Distinguished Name or a DN.

There are quite afew fields but you can leave some blank

For some fieldsthere will be a default value,

If you enter '.',the field will be left blank.

-----

Country Name (2letter code) [XX]:CN

State or ProvinceName (full name) []:Hebei

Locality Name (eg,city) [Default City]:Beijing

Organization Name(eg, company) [Default Company Ltd]:Tianli Company

OrganizationalUnit Name (eg, section) []:

Common Name (eg,your name or your server's hostname) []:test2

Email Address []:

Please enter thefollowing 'extra' attributes

to be sent withyour certificate request

A challengepassword []:

An optionalcompany name []:

[root@test2Desktop]# scp dovecot.csr root@192.168.1.130:/root/

root@192.168.1.130'spassword:

dovecot.csr 100% 668 0.7KB/s 00:00

四、服务端签发CA证书

在CA认证服务器上

[root@test1 ~]#openssl ca -in dovecot.csr -out dovecot.cst

Usingconfiguration from /etc/pki/tls/openssl.cnf

Enter pass phrasefor /etc/pki/CA/private/my-ca.key:

Check that therequest matches the signature

Signature ok

CertificateDetails:

Serial Number: 1 (0x1)

Validity

Not Before: Jan 22 10:44:36 2013GMT

Not After : Jan 22 10:44:36 2014GMT

Subject:

countryName = CN

stateOrProvinceName = Hebei

organizationName = Tianli Company

commonName = test2

X509v3 extensions:

X509v3 Basic Constraints:

CA:FALSE

Netscape Comment:

OpenSSL Generated Certificate

X509v3 Subject Key Identifier:

56:69:58:12:67:C7:FC:9E:AC:70:1D:2A:2C:56:A4:E1:61:97:B2:23

X509v3 Authority Key Identifier:

keyid:4C:45:25:5F:60:7F:F8:6E:6F:B4:53:C4:FB:BD:A3:C6:82:AE:2A:62

Certificate is tobe certified until Jan 22 10:44:36 2014 GMT (365 days)

Sign thecertificate? [y/n]:y

1 out of 1certificate requests certified, commit? [y/n]y

Write out databasewith 1 new entries

Data Base Updated

最后签发成功。

吊销证书：

[root@test1 ~]#openssl ca -revoke my-ca.crt

Usingconfiguration from /etc/pki/tls/openssl.cnf

Enter pass phrasefor /etc/pki/CA/private/my-ca.key:

Adding Entry withserial number B443BCCFCD08C1CD to DB for /C=CN/ST=Hebei/L=Beijing/O=DefaultCompany Ltd/CN=test1

RevokingCertificate B443BCCFCD08C1CD.

Data Base Updated

生成吊销证书列表

[root@test1 ~]#openssl ca -gencrl -out my-ca.crl

Usingconfiguration from /etc/pki/tls/openssl.cnf

Enter pass phrasefor /etc/pki/CA/private/my-ca.key:

unable to loadnumber from /etc/pki/CA/crlnumber

error whileloading CRL number

3079087852:error:0D066096:asn1encoding routines:a2i_ASN1_INTEGER:short line:f_int.c:215:

出现error while loading CRL number，解决办法给crlnumber赋值

[root@test1 ~]#echo "00" >/etc/pki/CA/crlnumber

[root@test1 ~]#openssl ca -gencrl -out my-ca.crl

Usingconfiguration from /etc/pki/tls/openssl.cnf

Enter pass phrasefor /etc/pki/CA/private/my-ca.key:

[root@test1 ~]# ls

anaconda-ks.cfg dovecot.csr install.log my-ca.crl Public

dead.letter dovecot.cst install.log.syslog my-ca.crt Templates

Desktop dovecot.pem Music test2.key

Documents Downloads Pictures Videos

[root@test1 ~]#cat my-ca.crl

-----BEGIN X509CRL-----

MIIB1DCBvQIBATANBgkqhkiG9w0BAQUFADBdMQswCQYDVQQGEwJDTjEOMAwGA1UE

CAwFSGViZWkxEDAOBgNVBAcMB0JlaWppbmcxHDAaBgNVBAoME0RlZmF1bHQgQ29t

cGFueSBMdGQxDjAMBgNVBAMMBXRlc3QxFw0xMzAxMjQwMzMyMzRaFw0xMzAyMjMw

MzMyMzRaMBwwGgIJALRDvM/NCMHNFw0xMzAxMjQwMzIzMDVaoA4wDDAKBgNVHRQE

AwIBADANBgkqhkiG9w0BAQUFAAOCAQEAhUevJlfn+W4VpX2SWn1RA9Y+qqEHB9i1

9rPSBDpC+NUpiKhF09n1eZRGqbInGQ+KVGxWF7iRAQ/znVV06wJiRU1i1/os3f9E

s2PiYYx8fltLOmaR027BhOB1ZO2mQmF/rvl+Soox+XH/YXD9T6wyD9STwm9jzFnD

iY86D+dgCRFCa3GWJyCFV1jr+79gY4q9rNV5Cmpozyxtz+szVgk8D+03X52KSg35

Ow7eCwK9W0rToq31+nR9+EQ3Cx7dUNrXftfzTCbFFhr87/b4w7iH+G9/3hfv91rt

zLuEriAlumiLVNAVk4gU0VJImAbArCOewaNmarzG8N8U9KYAcAWITw==

-----END X509CRL-----

在签发证书的过程中容易出现的两个问题

问题一：

[root@test1 ~]#openssl ca -in
dovecot.csr -out dovecot.cst

Usingconfiguration from /etc/pki/tls/openssl.cnf

Enter pass phrasefor /etc/pki/CA/private/my-ca.key:

unable to loadnumber from /etc/pki/CA/serial

error whileloading serial number

3078239980:error:0D066096:asn1encoding routines:a2i_ASN1_INTEGER:short line:f_int.c:215:

提示error while loading serial number，一般是因为serial文件中没有赋初值

解决办法

[root@test1 ~]#cd/etc/pki/CA

[root@test1 CA]#echo "00" >serial

[root@test1 CA]#cat serial

00

问题二：

在CA签名时，最后出现failed to update database错误

[root@test1~]#openssl ca -in dovecot.csr -out dovecot.crt

Usingconfiguration from /etc/pki/tls/openssl.cnf

Enter pass phrasefor /etc/pki/CA/private/my-ca.key:

Check that therequest matches the signature

Signature ok

CertificateDetails:

Serial Number: 2 (0x2)

Validity

Not Before: Jan 23 02:23:39 2013GMT

Not After : Jan 23 02:23:39 2014GMT

Subject:

countryName = CN

stateOrProvinceName = Hebei

organizationName = Tianli Company

commonName = test2

X509v3 extensions:

X509v3 Basic Constraints:

CA:FALSE

Netscape Comment:

OpenSSL Generated Certificate

X509v3 Subject Key Identifier:

96:86:28:B7:ED:2E:96:79:32:88:7E:C3:23:37:02:BC:43:1C:76:87

X509v3 Authority Key Identifier:

keyid:4C:45:25:5F:60:7F:F8:6E:6F:B4:53:C4:FB:BD:A3:C6:82:AE:2A:62

Certificate is tobe certified until Jan 23 02:23:39 2014 GMT (365 days)

Sign thecertificate? [y/n]:y

1 out of 1certificate requests certified, commit? [y/n]y

Write out databasewith 1 new entries

Data Base Updated

Certificate is tobe certified until Jan 23 02:17:38 2014 GMT (365 days)

Sign thecertificate? [y/n]:y

failed to updatedatabase

TXT_DB errornumber 2
遇到这个错误，只需要清空/etc/pki/CA/index.txt的内容再签发就可以成功了。