CRT and key certificates for HTTPS generation under Linux

Source: Internet
Author: User
Tags csr certificate ssl certificate kibana

When you configure Kibana permission settings today, Kibana requires the use of HTTPS links.

This concludes the procedure for creating a signature for OpenSSL under Linux:

X509 certificates generally use three classes of text, KEY,CSR,CRT

Key is a private key OpenSSL, usually an RSA algorithm.

A CSR is a certificate request file that is used to request a certificate. When making a CSR file, you must use your own private key to sign the application, and you can set a key.

The CRT is the certificate of the CA certification, (under Windows, in fact, the CRT), signed by the signer with their own key to sign your credentials.

Generation of 1.key

1 openssl genrsa -des3 -out server.key 2048

This is the generation of RSA private key, DES3 algorithm, OpenSSL format, 2048-bit strength. Server.key is the key file name. In order to generate such a key, a password of at least four bits is required. You can generate a key without a password in the following ways:

1 openssl rsa -inserver.key -out server.key

Server.key is a version with no password.

2. Generate the CRT for the CA

1 openssl req -new -x509 -key server.key -out ca.crt -days 3650

The generated CA.CRT file is used to sign the following SERVER.CSR file.

3. How CSR is generated

1 openssl req -new -key server.key -out server.csr

Need to enter country, region, organization, email in turn. The most important thing is to have a common name that can write your name or domain name. If the request for HTTPS, this must match the domain name, otherwise it will cause browser alerts. The generated CSR file is handed to the CA to form its own certificate after the server is signed.

4. CRT Generation Methods

The CSR file must be signed by the CA to form a certificate, which can be sent to VeriSign and other places to be verified by it, to pay a large sum of money, why not do the CA itself.

1 openssl x509 -req -days 3650 -inserver.csr -CA ca.crt -CAkey server.key -CAcreateserial -out server.crt

After entering the key, complete the certificate generation. The-CA option indicates the CSR certificate used for signing, the-cakey option indicates the key used for signing,-caserial indicates the serial number file, and-cacreateserial indicates that the file does not exist automatically.

Finally, a private key was generated: Server.key and its own certified SSL Certificate: SERVER.CRT

Certificate consolidation:

1 catserver.key server.crt > server.pem

Turn from

http://blog.51cto.com/11736068/2052425

CRT and key certificates for HTTPS generation under Linux

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.