OpenSSL command line common functions (1)

OpenSSL command line common functions (1)

Author: Rainbow Article Source: China information Security organization released Time: 2005-11-04 clicks: 3390 font: " small medium big"

1. Create an RSA private key for the CA D:/openssl/bin>openssl Genrsa-des3-out-ca.key 1024 Loading ' screen ' into random state-done Generating RSA private key, 1024 bit long modulus ............................................................................++++++ ........++++++ E is 65537 (0x10001) Enter Pass phrase for-ca.key:123456 Verifying-enter Pass phrase for-ca.key:123456 2, using the CA's RSA private key to create a self-signed CA certificate D:/openssl/bin>openssl req-new-x509-days 3650-key ca.key-out ca.crt-config openssl.cnf Enter Pass phrase for Ca.key: are about to is asked to enter information that would be incorporated into your certificate request. What you are about to enter the What is called a distinguished Name or a DN. There are quite a few fields but you can leave some For some fields there would be a default value, If you enter '. ', the field would be left blank. ----- Country Name (2 letter code) [AU]:CN State or province Name (full name) [Some-state]:sh Locality Name (eg, city) []:sh Organization Name (eg, company) [Internet widgits Pty Ltd]:ciso Organizational unit Name (eg, section) []:ciso Common name (eg, YOUR name) []:infosecurity.org.cn Email Address []:webmaster@infosecurity.org.cn 3. Generate Certificate Request D:/openssl/bin>openssl req-config openssl.cnf-new-keyout webmaster.key-out wm_req.pem-days 365 Loading ' screen ' into random state-done Generating a 1024 bit RSA private key .....++++++ ......................++++++ Writing new private key to ' Newreq.pem ' Enter PEM pass phrase:123456 (own loser) Verifying-enter PEM Pass phrase:123456 (lost) ----- are about to is asked to enter information that would be incorporated into your certificate request. What you are about to enter the What is called a distinguished Name or a DN. There are quite a few fields but you can leave some For some fields there would be a default value, If you enter '. ', the field would be left blank. ----- Country Name (2 letter code) [AU]:CN State or province Name (full name) [Some-state]:sh Locality Name (eg, city) []:sh Organization Name (eg, company) [Internet widgits Pty Ltd]:ciso Organizational unit Name (eg, section) []:ciso Common name (eg, YOUR name) []:webmaster Email Address []:webmaster@infosecurity.org.cn Please enter the following ' extra ' attributes To is sent with your certificate request A Challenge Password []:(do not lose) An optional company name []:(not lost) 4. Issuing certificate D:/openssl/bin>openssl ca-config openssl.cnf-out webmaster.pem-infiles Wm_req.pem Using Configuration from OPENSSL.CNF Loading ' screen ' into random state-done 1896:error:0e06d06c:configuration file Routines:NCONF_get_string:no Value:./crypto/conf/conf_lib.c:329:group=ca_ Defa Ult Name=unique_subject Enter pass phrase for./ca.key: Check that the request matches the signature Signature OK The Subject ' s distinguished Name is as follows CountryName:P rintable: ' CN ' Stateorprovincename:P rintable: ' sh ' Localityname:P rintable: ' sh ' OrganizationName:P rintable: ' Ciso ' Organizationalunitname:printable: ' Ciso ' CommonName:P rintable: ' Webmaster ' emailaddress:ia5string:&# 39webmaster@infosecurity.org.cn ' Certificate is to be certified until Aug 10:01:35-GMT (365 days) Sign the certificate? [Y/n]:y 1 out of 1 certificate requests certified, commit? [Y/n]y Write out database with 1 new entries Data Base Updated 5. Repeat steps 3 and 4 to create a personal certificate. 6, package into a PFX file format. Input: Z1.key and Z1.CRT Output: z1.pfx D:/openssl/bin>openssl Pkcs12-export-inkey z1.key-in z1.crt-out z1.pfx Loading ' screen ' into random state-done Enter pass phrase for Z1.key: (Enter password) Enter Export Password::(Enter password) Verifying-enter Export Password::(Enter password) 7, remove the private key password. D:/openssl/bin>openssl rsa-in z1.key-out Z1_nopwd.key Enter pass phrase for Z1.key: (Enter password) Writing RSA Key