SSL HTTPS Generation Certificate

Tag:crt   ras   mon   man    name     constrain   name   pass   icc   

SSL HTTPS one, generate server private key, public key $ OpenSSL genrsa-out server.key 2048$ OpenSSL rsa-in server.key-pubout-out Server.pem Two, generate CA certificate, step is   (1) Generate the private key (2) to generate the Certificate Signing Request (CSR), this step requires entering the country, province, city, organization company name (note that the name of the CA does not have the same name as the server and client), Department (Nullable), Common name (fill in the domain name, such as localhost), email address (nullable), A Challenge Password (empty), an optional company Name (empty) (3) Generate X509 Certificat E Data managent (CRT) $ openssl genrsa-out ca.key 2048$ OpenSSL req-new-key ca.key-out ca.csr$ OpenSSL x509-req-in ca. Csr-signkey ca.key-out ca.crt (Note: V3 version please replace with the following) Iii. Generate server certificate (signed by CA) $ OpenSSL req-new-key server.key-out server.csr$ openss L X509-REQ-CA ca.crt-cakey ca.key-cacreateserial-in server.csr-out server.crt (Note: V3 version please replace with the following) Iv. other (1) if Genras with-des3 parameter , you will be asked to enter a password. (2) Merging certificates and private keys pem$ cat server.crt server.key > Server_.pem (3) Add X509 7310 to req-days command to set the certificate to 20, example: Set the CA to 20, Server certificate set to 10 $ OpenSSL x509-req-days 7310-in ca.csr-signkey ca.key-out ca.crt$ OpenSSL x509-req-days 3650-ca ca.crt -cakey Ca.key-cacreateseriAl-in server.csr-out SERVER.CRT (4) Create version V3 certificate $ vim V3ca.extbasicconstraints=ca:trueauthoritykeyidentifier=keyid, Issuerkeyusage = Critical, crlsign, DigitalSignature, keycertsign$ vim v3.extbasicconstraints=ca: Falseauthoritykeyidentifier=keyid, issuerkeyusage = DigitalSignature, nonrepudiation, KeyEncipherment, dataencipherment$ OpenSSL x509-req-days 7310-sha1-extfile v3ca.ext-in ca.csr-signkey ca.key-out ca.crt$ OpenSSL x50 9-req-days 3650-sha1-extfile v3.ext-ca ca.crt-cakey ca.key-cacreateserial-in server.csr-out server.crt

SSL HTTPS Generation Certificate