Based on the basic application of CentOS 6.5 encryption, decryption, OpenSSL and the implementation process of CA

One, encryption and decryption

1, encryption methods are: Symmetric encryption, one-way encryption, public key encryption

Symmetric encryption:

Tool: GPG OpenSSL enc

Encryption: OpenSSL enc-des3-a-salt-in/ets/fstab-out/tmp/fstab.cipher

Decryption: OpenSSL enc-d-dec3-a-salt-in/tmp/fstab.cipher-out file

One-way encryption:

Tool: Sha1sum,md5sum,openssl dgst

OpenSSL dgst [-md5|-md4|-md2|-sha1|-sha|-mdc2|-ripemd160|-dss1][-out filename]/path/to/somefile

Public Key cryptography: Public key cryptography, private key decryption

Tool: GPG OpenSSL rsautl

Digital certificates:

Third-party agencies use a secure way to distribute public keys

Certificate format: X509,PKCS family

X509 format:

Public key and validity period:

The personal legal identity information of the holder; (hostname)

How certificates are used

Information about the CA

Digital signature of the CA

Who issued the CA certification: self-signed certificate

User

1. Generate a pair of keys

2. Make the required information and public key in a fixed format as a certificate request

CA Organization

1. Self-signed certificate

2. Signing the certificate

3. Pass to the user

4. Maintaining the revocation List

OpenCA

Ii. implementing a private CA with OpenSSL

Configuration file/etc/pki/tls/openssl.cnf

1. Generate Key pair:

# cd/etc/pki/ca/

# (Umask 077; OpenSSL genrsa-out Private/cakey.pem 2048)

650) this.width=650; "Src=" Http://s3.51cto.com/wyfs02/M02/8A/15/wKioL1gmi23DUwpAAABJ3IMHmSs747.png-wh_500x0-wm_3 -wmp_4-s_3349488153.png "title=" 1.png "alt=" Wkiol1gmi23duwpaaabj3imhmss747.png-wh_50 "/>

2. Generate the self-visa book:

# OpenSSL Req-new-x509-key private/cakey.pem-out cacert.pem-days 3655 (indicates the validity period of the generated self-visa book)

650) this.width=650; "Src=" Http://s1.51cto.com/wyfs02/M01/8A/15/wKioL1gmjTzhpj84AAD4mZbNzV4792.png-wh_500x0-wm_3 -wmp_4-s_1583863881.png "title=" 2.png "alt=" Wkiol1gmjtzhpj84aad4mzbnzv4792.png-wh_50 "/>

3. Create the required files:

650) this.width=650; "Src=" Http://s3.51cto.com/wyfs02/M00/8A/19/wKiom1gmjamSxeNoAAAdvSCjQWs904.png-wh_500x0-wm_3 -wmp_4-s_2849030979.png "title=" 3.png "alt=" Wkiom1gmjamsxenoaaadvscjqws904.png-wh_50 "/>

Third, use OpenSSL to implement the certificate application:

1. Generate the key on the host and save it to the configuration file directory of the service where the certificate is applied, for example:

650) this.width=650; "Src=" Http://s2.51cto.com/wyfs02/M00/8A/15/wKioL1gmjjjh3MRGAABOFQj0Oco295.png-wh_500x0-wm_3 -wmp_4-s_3866330158.png "title=" 4.png "alt=" Wkiol1gmjjjh3mrgaabofqj0oco295.png-wh_50 "/>

2. Generate Certificate Signing Request:

650) this.width=650; "Src=" Http://s4.51cto.com/wyfs02/M01/8A/19/wKiom1gmjveTKBfiAADB7rBVFPo277.png-wh_500x0-wm_3 -wmp_4-s_1351898471.png "title=" 5.png "alt=" Wkiom1gmjvetkbfiaadb7rbvfpo277.png-wh_50 "/>

3. Send the request file to CA:

650) this.width=650; "Src=" Http://s1.51cto.com/wyfs02/M01/8A/15/wKioL1gmj6exUCfKAAAoUkbzKkI909.png-wh_500x0-wm_3 -wmp_4-s_3700598331.png "title=" 6.png "alt=" Wkiol1gmj6exucfkaaaoukbzkki909.png-wh_50 "/>

Third, CA sign certificate

1. Signature:

650) this.width=650; "Src=" Http://s3.51cto.com/wyfs02/M01/8A/19/wKiom1gmkECRgbYTAACgGUkJbUA727.png-wh_500x0-wm_3 -wmp_4-s_1323259148.png "title=" 7.png "alt=" Wkiom1gmkecrgbytaacggukjbua727.png-wh_50 "/>

2. Pass the certificate back to the requestor

650) this.width=650; "Src=" Http://s5.51cto.com/wyfs02/M02/8A/19/wKiom1gmkKuzXhNKAAAy51dEurM794.png-wh_500x0-wm_3 -wmp_4-s_3601899834.png "title=" 8.png "alt=" Wkiom1gmkkuzxhnkaaay51deurm794.png-wh_50 "/>

Four: Revoking the certificate:

Back to the CA host:

# OpenSSL CA-REVOKE/TEST/HTTPD.CRT

650) this.width=650; "Src=" Http://s1.51cto.com/wyfs02/M02/8A/19/wKiom1gmkS3zexMqAAAofhGOC5A814.png-wh_500x0-wm_3 -wmp_4-s_554978200.png "title=" 9.png "alt=" Wkiom1gmks3zexmqaaaofhgoc5a814.png-wh_50 "/>

This article is from the "11501323" blog, please be sure to keep this source http://11511323.blog.51cto.com/11501323/1872016

Based on the basic application of CentOS 6.5 encryption, decryption, OpenSSL and the implementation process of CA