Generate a certificate request (CSR) to generate a certificate request csr

Generate a certificate request (CSR) to generate a certificate request csr

This article original from the http://blog.csdn.net/voipmaker reprint indicate the source.

This series of articles is divided into three parts. It mainly introduces how to build your own certificate issuing service, generate certificate requests, and sign the generated certificate request through the self-built CA and finally apply it to the service.

The application must generate a certificate request when applying for a signature from a Certificate Authority (CA). The following describes how to generate a certificate request for openssl.

1. create directories and files

Mkdir/home/cg/mycert
Cd/home/cg/mycert/
Mkdir private conf csr


Vim/home/cg/mycert/conf/serverconfig. cnf


[Ca]
Default_ca = CA_default


[CA_default]
Dir =/home/cg/mycert/
Certs = $ dir/certs
Crl_dir = $ dir/crl
Database = $ dir/index.txt
New_certs_dir = $ dir/newcerts
Certificate = $ dir/certs/cacert. pem
Serial = $ dir/serial
# Crl = $ dir/crl. pem
Private_key = $ dir/private/cakey. pem
# RANDFILE = $ dir/private/. rand
X509_extensions = usr_cert
# Crl_extensions = crl_ext
Default_days = 3650
# Default_startdate = YYMMDDHHMMSSZ
# Default_enddate = YYMMDDHHMMSSZ
# Default_crl_days = 30
# Default_crl_hours = 24
Default_md = sha1
Preserve = no
# Msie_hack
Policy = policy_match


[Policy_match]
CountryName = match
StateOrProvinceName = match
LocalityName = match
OrganizationName = match
OrganizationalUnitName = optional
CommonName = supplied
EmailAddress = optional


[Req]
Default_bits = 4096 # Size of keys
Default_keyfile = key. pem # name of generated keys
Distinguished_name = req_distinguished_name
Attributes = req_attributes
X509_extensions = v3_ca
# Input_password
# Output_password
String_mask = nombstr # permitted characters
Req_extensions = v3_req


[Req_distinguished_name]
CountryName = Country Name (2 letter code)
CountryName_default = US
CountryName_min = 2
CountryName_max = 2
StateOrProvinceName = State or Province Name (full name)
StateOrProvinceName_default = New York
LocalityName = Locality Name (city, district)
LocalityName_default = New York
OrganizationName = Organization Name (company)
OrganizationName_default = Code Ghar
OrganizationalUnitName = Organizational Unit Name (department, division)
OrganizationalUnitName_default = IT
CommonName = Common Name (hostname, FQDN, IP, or your name)
CommonName_max = 64
CommonName_default = CGIT
EmailAddress = Email Address
EmailAddress_max = 40
EmailAddress_default = codeghar@example.com


[Req_attributes]
# ChallengePassword = A challenege password
# ChallengePassword_min = 4
# ChallengePassword_max = 20
# UnstructuredName = An optional company name


[Usr_cert]
BasicConstraints = CA: FALSE
SubjectKeyIdentifier = hash
AuthorityKeyIdentifier = keyid, issuer: always
# NsComment = ''openssl Generated Certificate''
# NsCertType = client, email, objsign for ''everything including object signing''
SubjectAltName = email: copy
IssuerAltName = issuer: copy
# NsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
# NsBaseUrl =
# Nsenewalurl =
# Nscapoicyurl =
# NsSslServerName =


[V3_req]
BasicConstraints = CA: FALSE
KeyUsage = nonRepudiation, digitalSignature, keyEncipherment


[V3_ca]
SubjectKeyIdentifier = hash
AuthorityKeyIdentifier = keyid: always, issuer: always
BasicConstraints = CA: TRUE
# KeyUsage = cRLSign, keyCertSign
# NsCertType = sslCA, emailCA
# SubjectAltName = email: copy
# IssuerAltName = issuer: copy
# Obj = DER: 02: 03


[Crl_ext]
# IssuerAltName = issuer: copy
AuthorityKeyIdentifier = keyid: always, issuer: always

2. Generate csr
Openssl req-new-config conf/serverconfig. cnf-keyform PEM-keyout private/key. csr. server1.pem-outform PEM-out csr/csr. server1.pem-nodes

File key. csr. server1.pem and csr. server1.pem are generated in the directory $ dir/private and $ dir/csr.


Run csr. server1.pem to generate a certificate for the CA.