Create private CAs and request CA steps in LAN

Preparation environment: 2 virtual machines, centos6.7 (client) and centos7.0 (server side)

Configuration file:/etc/pki/tls/openssl.cnf

①, create the required files

Touch/etc/pki/ca/index.txt

echo >/etc/pki/ca/serial

②, Cd/etc/pki/ca Directory

Generate private key

(Umask 066; OpenSSL genrsa-out Private/cakey.pem 2048)

Generate a self-signed certificate

OpenSSL req-new-x509-key/etc/pki/ca/private/cakey.pem-days 3650-out/etc/pki/ca/cacert.pem

-new: Generate a new certificate signing request

-x509: Dedicated to CA generate self-signed certificate

-key: The private key file used to generate the request

-days N: Validity period of the certificate

-out/path/to/somecertfile: Certificate Save path

③, generating the private key on the client (6.7)

(Umask 066; OpenSSL Genrsa-out/etc/pki/ca/httpd.key 1024)

To generate a certificate request file:

OpenSSL req-new-key/etc/pki/ca/httpd.key-days 365-OUT/ETC/PKI/CA/HTTPD.CSR

Note: Country, province, company name must be consistent with CA

④, transferring the certificate file to (7.0)

SCP/ETC/PKI/CA/HTTPD.CSR 192.168.1.10 (IP address ):/etc/pki/ca/newcerts

⑤,

OpenSSL ca-in/et/pki/ca/newcerts/httpd.csr-out/etc/pki/ca/certs/httpd.crt-days 365

Pass the HTTPD.CRT back (6.7)

SCP/ETC/PKI/CA/CERTS/HTTPD.CRT IP Address:/etc/pki/ca/

This article is from the "linux-Struggle snail" blog, please make sure to keep this source http://sdwcg.blog.51cto.com/3171500/1794491

Create private CA and request CA steps within LAN