OpenSSL generates self-signed sha256 generic domain name certificates

Environment:

CentOS 6.8 x86_64

Installation

OpenSSL Openssl-devel

CP/ETC/PKI/TLS/OPENSSL.CNF openssl.cnf

Modify OPENSSL.CNF

[Req]

Distinguished_name = Req_distinguished_name

Req_extensions = V3_req #取消这行注释

# Make sure there are no 0.xxx tags under the req_distinguished_name, and some words put the 0.xxx 0. Remove

[Req_distinguished_name]

CountryName = Country Name (2 letter code)

Countryname_default = CN

Stateorprovincename = State or province name (full name)

Stateorprovincename_default = Guangdong

Localityname = Locality Name (eg, city)

Localityname_default = ShenZhen

Organizationalunitname = organizational Unit Name (eg, section)

Organizationalunitname_default = 303 IT Lab

CommonName = IT Lab

Commonname_max = 64

[V3_req]

# Extensions to add to a certificate request

Basicconstraints = Ca:false

Keyusage = nonrepudiation, DigitalSignature, keyencipherment

SubjectAltName = @alt_names #增加这行

# Add the following sections

[Alt_names]

Dns.1 = abc.com

Dns.2 = *.abc.com

Dns.3 = xyz.com

Dns.4 = *.xyz.com

Multiple domain names can be added on their own

Create related directories and files

Mkdir-p Ca/{certs,crl,newcerts,private}

Touch Ca/index.txt

echo > Ca/serial

1. Generate Ca.key and self-signed

OpenSSL req-sha256-new-x509-days 3650-keyout ca.key-out ca.crt-config openssl.cnf

2. Generate Server.key

OpenSSL genrsa-out Server.key 2048

3. Generate a Certificate signing request

OpenSSL req-new-sha256-key server.key-out server.csr-config openssl.cnf

Common name is in this step fill in *.abc.com Common name must be included in Alt_names

4. View Signature Request file information

OpenSSL req-in Server.csr-text

Check Signature algorithm is not sha256withrsaencryptio

5. Using a self-signed CA, sign SERVER.SCR

OpenSSL ca-in server.csr-md sha256-out server.crt-cert ca.crt-keyfile ca.key-extensions v3_req-config openssl.cnf

Note: Even if you are in front of the sha256 root certificate and sha256 request file, if you do not add-MD sha256, the default is to follow the SHA1 signed

6. View Certificates

OpenSSL x509-in Server.crt-text

Same check Signature algorithm isn't sha256withrsaencryptio

This article is from "Maple Night" blog, please be sure to keep this source http://fengwan.blog.51cto.com/508652/1869743

OpenSSL generates self-signed sha256 generic domain name certificates