HTTP bidirectional authentication Fourth article

First, Two-way authentication for http

① To generate a CA certificate using OpenSSL

# CD/ETC/PKI/CA

# OpenSSL Genrsa-out Private/my-ca.key

# OpenSSL Req-new-key private/my-ca.key-out private/SYSCA.CSR

:HealthintoCertificate Requestfile

# OpenSSL req-new-x509-key/etc/pki/ca/private/my-ca.key-days 365 > MY-CA.CRT

# touch index.txt  : create ca key library

# OpenSSL ca-gencrl-out/etc/pki/ca/private/ca.crl-crldays 7-config "/Etc/pki/tls/openssl.conf " :Create a certificate revocation list for removing client certificates

② step three : Generate client certificate Span style= "margin:0px; Color:rgb (51, 51, 51); Text-transform:none; letter-spacing:0pt; Font-family:calibri; font-size:10.5pt; Font-style:normal; " >

# cd/etc/pki/ca

# mkdir users

# OpenSSL genrsa-des3-out/etc/pki/ca/users/client.key 1024x768: Create a for the client Span style= "Font-family:calibri" >key

# OpenSSL REQ-NEW-KEY/ETC/PKI/CA/USERS/CLIENT.KEY-OUT/ETC/PKI/CA/USERS/CLIENT.CSR

: with ca Key key signature

# OpenSSL ca-in/etc/pki/ca/users/client.csr-cert/etc/pki/ca/private/my-ca.crt-keyfile/etc/pki/ca/private/ My-ca.key-out/etc/pki/ca/users/client.crt-config "/etc/pki/tls/openssl.cnf"

                            : convert certificates to most browsers to recognize other pkcs12 file Span style= "margin:0px; Color:rgb (51, 51, 51); Text-transform:none; letter-spacing:0pt; FONT-FAMILY:PINGFANGSC; font-size:10.5pt; Font-style:normal; " >

# CD Users

# ls

③ Install the client certificate

# SCP  /etc/pki/ca/users/client.p12  [email protected]/root/

firefox Import the downloaded client certificate

Cloud Host implementation:https://help.aliyun.com/document_detail/54508.html

HTTP bidirectional authentication Fourth article