SSL certificates must be known to issue self-issued certificates

1 overview

The SSL certificate establishes an SSL secure channel between the client browser and the Web server (Secure Socket Layer (SSL), which is designed and developed by the Netscape Communication Company. This security protocol is mainly used to provide authentication to the user and server, encrypt and hide the transmitted data, ensure that the data is not changed in the transmission, that is, the integrity of the data, has become the standard of globalization in this field.

2 What is the X509 certificate chain

X509 certificates typically use a class three file, Key,csr,crt.

Key is the private key, the OpenSSL format, usually the RSA algorithm.

A CSR is a certificate request file that is used to request a certificate. When making a CSR file, you must use your own private key to sign the application, and you can set a key.

The CRT is the CA-certified certificate file (the CSR under Windows, in fact, the CRT), and the signer signs your credentials with your key.

3 Generation of key

OpenSSL genrsa-des3-out Server.key 2048

This is the generation of RSA private key, DES3 algorithm, OpenSSL format, 2048-bit strength. Server.key is the key file name. In order to generate such a key, a password of at least four bits is required. You can generate a key without a password in the following ways:

OpenSSL rsa-in server.key-out Server.key

Server.key is a version with no password.

4 Generating the CRT for the CA

OpenSSL req-new-x509-key server.key-out ca.crt-days 3650

The generated CA.CRT file is used to sign the following SERVER.CSR file.

5 How CSR is generated:

OpenSSL Req-new-key server.key-out SERVER.CSR

Need to enter country, region, organization, email in turn. Most importantly, there is a common name that can write your name or domain name (for example: www.etsec.com.cn). If the request for HTTPS, this must match the domain name, otherwise it will cause browser alerts. The generated CSR file is handed to the CA to form its own certificate after the server is signed.

6 CRT Generation Methods

A CSR file must be signed by a CA to form a certificate. This file can be sent to the CA vendor entrust and other places to be verified by it, to pay a fee, the test certificate can make its own CA.

OpenSSL x509-req-days 3650-in server.csr-ca ca.crt-cakey server.key-cacreateserial-out server.crt

After entering the key, complete the certificate generation. The-CA option indicates the CSR certificate used for signing, and the-cakey option indicates the key used for signing. -caserial indicates the serial number file, and-cacreateserial indicates that the file does not exist automatically.

Finally, a private key was generated: Server.key and its own certified SSL Certificate: SERVER.CRT

This article from "Ops said: from rookie to veteran" blog, please be sure to keep this source http://liuqunying.blog.51cto.com/3984207/1664245

SSL certificates must be known to issue self-issued certificates