CRT and key certificates for HTTPS generation under Linux

When you configure Kibana permission settings today, Kibana requires the use of HTTPS links.

This concludes the procedure for creating a signature for OpenSSL under Linux:

X509 certificates generally use three classes of text, KEY,CSR,CRT

Key is a private key OpenSSL, usually an RSA algorithm.

A CSR is a certificate request file that is used to request a certificate. When making a CSR file, you must use your own private key to sign the application, and you can set a key.

The CRT is the certificate of the CA certification, (under Windows, in fact, the CRT), signed by the signer with their own key to sign your credentials.

Generation of 1.key

1	openssl genrsa -des3 -out server.key 2048

This is the generation of RSA private key, DES3 algorithm, OpenSSL format, 2048-bit strength. Server.key is the key file name. In order to generate such a key, a password of at least four bits is required. You can generate a key without a password in the following ways:

1	openssl rsa -inserver.key -out server.key

Server.key is a version with no password.

2. Generate the CRT for the CA

1	openssl req -new -x509 -key server.key -out ca.crt -days 3650

The generated CA.CRT file is used to sign the following SERVER.CSR file.

3. How CSR is generated

1	openssl req -new -key server.key -out server.csr

Need to enter country, region, organization, email in turn. The most important thing is to have a common name that can write your name or domain name. If the request for HTTPS, this must match the domain name, otherwise it will cause browser alerts. The generated CSR file is handed to the CA to form its own certificate after the server is signed.

4. CRT Generation Methods

The CSR file must be signed by the CA to form a certificate, which can be sent to VeriSign and other places to be verified by it, to pay a large sum of money, why not do the CA itself.

1	openssl x509 -req -days 3650 -inserver.csr -CA ca.crt -CAkey server.key -CAcreateserial -out server.crt

After entering the key, complete the certificate generation. The-CA option indicates the CSR certificate used for signing, the-cakey option indicates the key used for signing,-caserial indicates the serial number file, and-cacreateserial indicates that the file does not exist automatically.

Finally, a private key was generated: Server.key and its own certified SSL Certificate: SERVER.CRT

Certificate consolidation:

1	catserver.key server.crt > server.pem

Turn from

http://blog.51cto.com/11736068/2052425

CRT and key certificates for HTTPS generation under Linux